chore(security): remove committed basic auth examples

.gitignore

@@ -4,6 +4,7 @@
 
 # Configuraciones live con datos reales de producción
 *.live.yaml
+backups/kopia/traefik-kopia.yml
 opencode/opencode.json
 cheerfy_pentest_report.md
 

backups/kopia/README.md

@@ -96,7 +96,7 @@ Kopia UI is exposed at:
 https://kopia.sherlockhomeless.net
 ```
 
-The service listens only on the Docker host gateway `10.0.0.1:51515` and is published through Traefik using `traefik-kopia.yml`.
+The service listens only on the Docker host gateway `10.0.0.1:51515` and is published through Traefik using a local `traefik-kopia.yml` copied from `traefik-kopia.yml.example`.
 
 Credentials are stored outside the repo in `/opt/kopia/kopia.env`:
 
@@ -108,6 +108,8 @@ Install or update the service and Traefik route:
 
 ```bash
 sudo cp backups/kopia/systemd/kopia-server.service /etc/systemd/system/
+cp backups/kopia/traefik-kopia.yml.example backups/kopia/traefik-kopia.yml
+# Edit backups/kopia/traefik-kopia.yml and replace the Basic auth placeholder.
 sudo cp backups/kopia/traefik-kopia.yml /opt/traefik/dynamic/kopia.yml
 sudo systemctl daemon-reload
 sudo systemctl enable --now kopia-server.service

backups/kopia/traefik-kopia.yml.example

@@ -1,14 +1,14 @@
 http:
   routers:
     kopia:
-      rule: Host(`kopia.sherlockhomeless.net`)
+      rule: Host(`kopia.example.com`)
       entryPoints:
         - websecure
       tls:
         certResolver: letsencrypt
       middlewares:
         - crowdsec-bouncer@file
-      - ths-authentik@docker
+        - ths-authentik@docker
         - kopia-inject-auth
       service: kopia
 
@@ -16,7 +16,7 @@ http:
     kopia-inject-auth:
       headers:
         customRequestHeaders:
-          Authorization: "Basic <redacted-kopia-basic-auth>"
+          Authorization: "Basic <base64-user-colon-password>"
 
   services:
     kopia:

opencode/README.md

@@ -12,7 +12,6 @@ Este stack ejecuta OpenCode en un contenedor con aislamiento fuerte para exponer
 
 - Compose: `opencode/docker-compose.yml`
 - Variables: `opencode/.env` (copiar desde `opencode/.env.example`)
-- Middleware Traefik (inyecta `Authorization`): `/opt/traefik/dynamic/opencode-auth.yml`
 
 ## Despliegue en contenedor
 
@@ -22,18 +21,7 @@ mkdir -p /opt/opencode/home /opt/opencode/config /opt/opencode/workspace
 docker compose --env-file opencode/.env -f opencode/docker-compose.yml up -d
 ```
 
-Para SSO directo (sin segundo login de OpenCode), crea tambien este middleware dinamico en Traefik:
-
-```yaml
-http:
-  middlewares:
-    opencode-inject-auth:
-      headers:
-        customRequestHeaders:
-          Authorization: "Basic <base64(usuario:password-opencode)>"
-```
-
-El router sandboxed usa la cadena `ths-authentik@docker,opencode-inject-auth@file`, asi Authentik valida al usuario y Traefik pasa despues la cabecera Basic al backend.
+El router activo se define en `/opt/traefik/dynamic/opencode.yml` y aplica Authentik junto con la cabecera Basic necesaria para el backend.
 
 ## Endurecimiento aplicado
 

opencode/traefik/opencode-auth.yml

@@ -1,6 +0,0 @@
-http:
-  middlewares:
-    opencode-inject-auth:
-      headers:
-        customRequestHeaders:
-          Authorization: "Basic <redacted-opencode-basic-auth>"