feat(wireguard): configure native OIDC authentication

wireguard/docker-compose.yml

@@ -23,6 +23,15 @@ services:
 
       DISABLE_IPV6: ${DISABLE_IPV6}
 
+      OAUTH_PROVIDERS: ${OAUTH_PROVIDERS}
+      OAUTH_OIDC_SERVER: ${OAUTH_OIDC_SERVER}
+      OAUTH_OIDC_CLIENT_ID: ${OAUTH_OIDC_CLIENT_ID}
+      OAUTH_OIDC_CLIENT_SECRET: ${OAUTH_OIDC_CLIENT_SECRET}
+      OAUTH_OIDC_NAME: ${OAUTH_OIDC_NAME}
+      OAUTH_AUTO_REGISTER: ${OAUTH_AUTO_REGISTER}
+      OAUTH_ALLOWED_DOMAINS: ${OAUTH_ALLOWED_DOMAINS}
+      DISABLE_PASSWORD_AUTH: ${DISABLE_PASSWORD_AUTH}
+
     volumes:
       - ${WG_DATA_PATH}:/etc/wireguard:Z
       - ${WG_MODULES_PATH}:/lib/modules:ro,Z

wireguard/stack.env

@@ -1,5 +1,5 @@
 ##### wg-easy #####
-WG_EASY_IMAGE=ghcr.io/wg-easy/wg-easy:15.2.2
+WG_EASY_IMAGE=ghcr.io/wg-easy/wg-easy:15.4.0
 WG_HOST=app.example.com
 WG_PORT=51820
 WG_UI_PORT=51821
@@ -9,6 +9,17 @@ INIT_USERNAME=example-user
 INIT_PASSWORD=change-me
 DISABLE_IPV6=true
 
+##### OAuth nativo (Authentik) — capa extra sobre el forward-auth de Traefik #####
+# Rellenar tras crear el OAuth2/OpenID Provider en Authentik (ver README)
+OAUTH_PROVIDERS=oidc
+OAUTH_OIDC_SERVER=https://auth.example.com/application/o/wireguard-oidc/
+OAUTH_OIDC_CLIENT_ID=change-me
+OAUTH_OIDC_CLIENT_SECRET=change-me
+OAUTH_OIDC_NAME=Authentik
+OAUTH_AUTO_REGISTER=false
+OAUTH_ALLOWED_DOMAINS=example.com,example.org
+DISABLE_PASSWORD_AUTH=false
+
 WG_DATA_PATH=/opt/wg-easy
 WG_MODULES_PATH=/lib/modules
 WG_UDP_PORT=51820