Kratos self-service redirects point to internal address in production but work locally

An Ory Kratos deployment handles login and registration flows correctly on a local machine, where the browser and the Kratos public endpoint share the same host. After moving the same configuration into a containerized production setup behind a reverse proxy, the concern is that the absolute URLs Kratos places in its HTTP 303 Location headers may no longer match the public-facing domain.

The relevant settings appear to be serve.public.base_url and selfservice.flows.ui_url. Locally these can point at localhost, but in production the binary only sees internal network addresses unless told otherwise. It is also unclear whether Kratos ever derives the host from X-Forwarded-Host headers set by the proxy, or whether it strictly uses the static configuration. Trailing-slash handling in the base URL is a second uncertainty, since it may produce double slashes in generated redirect URIs depending on the UI.

Assume a recent Kratos v1.x release; exact behavior should be verified against the deployed version by inspecting the Location header of a real flow response.

Which configuration values must be synchronized between Kratos and the UI so redirects resolve to the public domain? Does Kratos honor forwarded host headers at all, or is static configuration the only supported mechanism? How should the base URL be written to avoid malformed redirect URIs?