Github OAuth flow ends up requesting token from self instead of github.com

[AskAlice]

Not really sure what's happening here. Was attempting to follow the guide on the docs about setting up github social login.
here are my OAuth source settings

and here are the logs

{"auth_via": "unauthenticated", "event": "f(plan): finished building", "flow_slug": "default-authentication-flow", "host": "id.emu.sh", "level": "debug", "logger": "authentik.flows.planner", "pid": 20691, "request_id": "84069f981b834c0a81a7b1aebe6b13af", "timestamp": "2023-04-07T22:50:50.047676"}
{"auth_via": "unauthenticated", "binding": "<FlowStageBinding: Flow-stage binding #10 to 9b3e0e9d-feab-4800-8a5f-00e7a007c857>", "event": "f(plan_inst): stage has marker", "host": "id.emu.sh", "level": "debug", "logger": "authentik.flows.planner", "marker": "ReevaluateMarker(binding=<FlowStageBinding: Flow-stage binding #10 to 9b3e0e9d-feab-4800-8a5f-00e7a007c857>)", "pid": 20691, "request_id": "84069f981b834c0a81a7b1aebe6b13af", "timestamp": "2023-04-07T22:50:50.050361"}
{"auth_via": "unauthenticated", "binding": "<FlowStageBinding: Flow-stage binding #10 to 9b3e0e9d-feab-4800-8a5f-00e7a007c857>", "event": "f(plan_inst): running re-evaluation", "host": "id.emu.sh", "level": "debug", "logger": "authentik.flows.markers", "marker": "ReevaluateMarker", "pid": 20691, "policy_binding": "<FlowStageBinding: Flow-stage binding #10 to 9b3e0e9d-feab-4800-8a5f-00e7a007c857>", "request_id": "84069f981b834c0a81a7b1aebe6b13af", "timestamp": "2023-04-07T22:50:50.050940"}
{"auth_via": "unauthenticated", "current_stage": "<IdentificationStage: Stage default-authentication-identification>", "event": "f(exec): Current stage", "flow_slug": "default-authentication-flow", "host": "id.emu.sh", "level": "debug", "logger": "authentik.flows.views.executor", "pid": 20691, "request_id": "84069f981b834c0a81a7b1aebe6b13af", "timestamp": "2023-04-07T22:50:50.100082"}
{"auth_via": "unauthenticated", "event": "f(exec): Passing GET", "flow_slug": "default-authentication-flow", "host": "id.emu.sh", "level": "debug", "logger": "authentik.flows.views.executor", "pid": 20691, "request_id": "84069f981b834c0a81a7b1aebe6b13af", "stage": "<IdentificationStage: Stage default-authentication-identification>", "timestamp": "2023-04-07T22:50:50.103137", "view_class": "authentik.stages.identification.stage.IdentificationStageView"}
{"auth_via": "unauthenticated", "event": "/api/v3/flows/executor/default-authentication-flow/?query=next%3D%252F", "host": "id.emu.sh", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 20691, "remote": "172.16.7.0", "request_id": "84069f981b834c0a81a7b1aebe6b13af", "runtime": 139, "scheme": "https", "status": 200, "timestamp": "2023-04-07T22:50:50.123882", "user": "", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36"}
{"event":"/static/authentik/sources/github.svg","host":"id.emu.sh","level":"info","logger":"authentik.router","method":"GET","remote":"172.16.7.0","runtime":"0.962","scheme":"http","size":1425,"status":200,"timestamp":"2023-04-07T22:50:50Z","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36"}
{"auth_via": "unauthenticated", "event": "dispatching OAuth2 request to", "host": "id.emu.sh", "kind": "<RequestKind.REDIRECT: 'redirect'>", "level": "debug", "logger": "authentik.sources.oauth.views.dispatcher", "pid": 20691, "request_id": "b7582a281c554552b458338600b2651d", "timestamp": "2023-04-07T22:50:51.362243", "view": "<class 'authentik.sources.oauth.types.github.GitHubOAuthRedirect'>"}
{"auth_via": "unauthenticated", "client": "<authentik.sources.oauth.clients.oauth2.OAuth2Client object at 0x7fa0751990>", "event": "Using client for oauth request", "host": "id.emu.sh", "level": "debug", "logger": "authentik.sources.oauth.views.base", "pid": 20691, "request_id": "b7582a281c554552b458338600b2651d", "timestamp": "2023-04-07T22:50:51.366664"}
{"auth_via": "unauthenticated", "client_id": "5e37b8f3ef5a1658c8a1", "event": "redirect args", "host": "id.emu.sh", "level": "info", "logger": "authentik.sources.oauth.clients.base", "pid": 20691, "redirect_uri": "https://id.emu.sh/source/oauth/callback/github/", "request_id": "b7582a281c554552b458338600b2651d", "response_type": "code", "scope": "read:org, read:user read:user, user:email", "source": "github", "state": "GgsnqnxwkqaoOSnVimvlBikvkbzjTavi", "timestamp": "2023-04-07T22:50:51.367408"}
{"auth_via": "unauthenticated", "event": "/source/oauth/login/github/", "host": "id.emu.sh", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 20691, "remote": "172.16.7.0", "request_id": "b7582a281c554552b458338600b2651d", "runtime": 59, "scheme": "https", "status": 302, "timestamp": "2023-04-07T22:50:51.377939", "user": "", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36"}
{"auth_via": "unauthenticated", "event": "/-/health/ready/", "host": "10.42.242.23:9000", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 20691, "remote": "172.16.7.4", "request_id": "7a71af542dd4453196e0c0f96ffdd51c", "runtime": 36, "scheme": "http", "status": 204, "timestamp": "2023-04-07T22:50:52.715902", "user": "", "user_agent": "kube-probe/1.26"}

{"auth_via": "unauthenticated", "event": "dispatching OAuth2 request to", "host": "id.emu.sh", "kind": "<RequestKind.CALLBACK: 'callback'>", "level": "debug", "logger": "authentik.sources.oauth.views.dispatcher", "pid": 20473, "request_id": "19767c57821d49cf923e9a12764a20f9", "timestamp": "2023-04-07T22:50:58.123839", "view": "<class 'authentik.sources.oauth.types.github.GitHubOAuth2Callback'>"}
{"event": "Certificate did not match expected hostname: github.com. Certificate: {'subject': ((('commonName', 'emu.sh'),),), 'issuer': ((('countryName', 'US'),), (('organizationName', \"Let's Encrypt\"),), (('commonName', 'R3'),)), 'version': 3, 'serialNumber': '03618F97F6EE8A32FD38CE0CDB2DC799E496', 'notBefore': 'Apr  7 02:23:44 2023 GMT', 'notAfter': 'Jul  6 02:23:43 2023 GMT', 'subjectAltName': (('DNS', '*.emu.sh'), ('DNS', 'emu.sh')), 'OCSP': ('http://r3.o.lencr.org',), 'caIssuers': ('http://r3.i.lencr.org/',)}", "level": "warning", "logger": "urllib3.connection", "timestamp": 1680907858.2381294}
{"auth_via": "unauthenticated", "event": "Unable to fetch access token", "exc": "SSLError(MaxRetryError('HTTPSConnectionPool(host=\\'github.com\\', port=443): Max retries exceeded with url: /login/oauth/access_token (Caused by SSLError(CertificateError(\"hostname \\'github.com\\' doesn\\'t match either of \\'*.emu.sh\\', \\'emu.sh\\'\")))'))", "host": "id.emu.sh", "level": "warning", "logger": "authentik.sources.oauth.clients.oauth2", "pid": 20473, "request_id": "19767c57821d49cf923e9a12764a20f9", "response": "HTTPSConnectionPool(host='github.com', port=443): Max retries exceeded with url: /login/oauth/access_token (Caused by SSLError(CertificateError(\"hostname 'github.com' doesn't match either of '*.emu.sh', 'emu.sh'\")))", "timestamp": "2023-04-07T22:50:58.240533"}

{"auth_via": "unauthenticated", "event": "Authentication Failure", "host": "id.emu.sh", "level": "warning", "logger": "authentik.sources.oauth.views.callback", "pid": 20473, "reason": "Could not retrieve token.", "request_id": "19767c57821d49cf923e9a12764a20f9", "timestamp": "2023-04-07T22:50:58.246509"}