chore(kasm): move stack to deprecated area

DEPRECATED-kasm/README.md

@@ -2,17 +2,14 @@
 
 Stack para desplegar [Kasm](https://www.kasmweb.com/) en `kasm.sherlockhomeless.net` detrás de Traefik y Authentik.
 
-## 🚀 Despliegue en Portainer
+## 🚀 Despliegue con Docker Compose
 
-1. Ve a **Stacks** -> **Add stack**
-2. Nombre: `kasm`
-3. Selecciona **Repository** o **Git repository**
-4. Configura:
-   - Repository URL: `<tu-repositorio>`
-   - Repository reference: `main`
-   - Compose path: `kasm/docker-compose.yml`
-5. Copia `kasm/stack.env` a `kasm/.env` y carga `kasm/.env` como archivo de variables
-6. Haz clic en **Deploy the stack**
+Asegurate de tener `kasm/.env` configurado y despliega:
+
+```bash
+cd kasm
+docker compose --env-file .env up -d
+```
 
 ## ⚙️ Variables importantes
 

DEPRECATED-kasm/docker-compose.yml

@@ -0,0 +1,226 @@
+services:
+  db:
+    image: kasmweb/postgres:${KASM_VERSION}
+    container_name: kasm_db
+    restart: unless-stopped
+    stop_signal: SIGTERM
+    stop_grace_period: 60s
+    environment:
+      POSTGRES_PASSWORD: ${KASM_DB_PASSWORD}
+      POSTGRES_USER: kasmapp
+      POSTGRES_DB: kasm
+    command: postgres -c ssl=on -c ssl_cert_file=/etc/ssl/certs/db_server.crt -c ssl_key_file=/etc/ssl/certs/db_server.key -c config_file=/var/lib/postgresql/conf/postgresql.conf -c hba_file=/var/lib/postgresql/conf/pg_hba.conf
+    healthcheck:
+      test: "pg_isready --username=$$POSTGRES_USER --dbname=$$POSTGRES_DB && cat /proc/1/cmdline | grep -q '^postgres'"
+      timeout: 5s
+      retries: 20
+    volumes:
+      - ${KASM_DB_INIT_SQL}:/docker-entrypoint-initdb.d/current.sql:ro,Z
+      - ${KASM_ROOT_PATH}/conf/database/pg_hba.conf:/var/lib/postgresql/conf/pg_hba.conf:ro,Z
+      - ${KASM_ROOT_PATH}/conf/database/postgresql.conf:/var/lib/postgresql/conf/postgresql.conf:ro,Z
+      - ${KASM_ROOT_PATH}/certs/db_server.crt:/etc/ssl/certs/db_server.crt:ro,Z
+      - ${KASM_ROOT_PATH}/certs/db_server.key:/etc/ssl/certs/db_server.key:ro,Z
+      - ${KASM_ROOT_PATH}/log/postgres:/var/log/postgres:Z
+      - ${KASM_ROOT_PATH}/tmp/kasm_db:/tmp:Z
+      - ${KASM_DB_DATA_PATH}:/var/lib/postgresql/data:Z
+    networks:
+      - kasm_default_network
+    labels:
+      prune.protect: "true"
+
+  kasm_api:
+    image: kasmweb/api:${KASM_VERSION}
+    container_name: kasm_api
+    user: "${KASM_UID}:${KASM_GID}"
+    read_only: true
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: "/usr/bin/healthcheck.sh http://localhost:8080/api/__healthcheck \"\" 5 60"
+      timeout: 30s
+      interval: 10s
+      retries: 3
+      start_period: 60s
+    volumes:
+      - ${KASM_ROOT_PATH}:/opt/kasm/current:Z
+      - ${KASM_ROOT_PATH}/healthcheck/kasm_api:/healthcheck:Z
+      - ${KASM_ROOT_PATH}/tmp/api:/tmp:Z
+    networks:
+      - kasm_default_network
+    labels:
+      prune.protect: "true"
+
+  kasm_manager:
+    image: kasmweb/manager:${KASM_VERSION}
+    container_name: kasm_manager
+    user: "${KASM_UID}:${KASM_GID}"
+    read_only: true
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: "/usr/bin/healthcheck.sh http://localhost:8181/__healthcheck \"\" 5 60"
+      timeout: 30s
+      interval: 10s
+      retries: 3
+    volumes:
+      - ${KASM_ROOT_PATH}:/opt/kasm/current:Z
+      - ${KASM_ROOT_PATH}/healthcheck/kasm_manager:/healthcheck:Z
+      - ${KASM_ROOT_PATH}/tmp/manager:/tmp:Z
+    networks:
+      - kasm_default_network
+    labels:
+      prune.protect: "true"
+
+  kasm_agent:
+    image: kasmweb/agent:${KASM_VERSION}
+    container_name: kasm_agent
+    user: root
+    read_only: true
+    restart: unless-stopped
+    depends_on:
+      - kasm_manager
+    healthcheck:
+      test: "/usr/bin/healthcheck.sh http://localhost:4444/__healthcheck \"\" 30 90 15"
+      timeout: 30s
+      interval: 30s
+      retries: 3
+    volumes:
+      - ${KASM_ROOT_PATH}:/opt/kasm/current:Z
+      - ${KASM_ROOT_PATH}/healthcheck/kasm_agent:/healthcheck:Z
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ${KASM_ROOT_PATH}/conf/nginx:/etc/nginx/conf.d:Z
+    networks:
+      - kasm_default_network
+    labels:
+      prune.protect: "true"
+
+  kasm_guac:
+    image: kasmweb/kasm-guac:${KASM_VERSION}
+    container_name: kasm_guac
+    user: "${KASM_UID}:${KASM_GID}"
+    read_only: true
+    init: true
+    restart: unless-stopped
+    healthcheck:
+      test: "/usr/bin/healthcheck.sh http://localhost:3000/__healthcheck \"\" 30 90"
+      interval: 60s
+      timeout: 30s
+      retries: 3
+    volumes:
+      - ${KASM_ROOT_PATH}/log:/opt/kasm/current/log:Z
+      - ${KASM_ROOT_PATH}/tmp/guac:/opt/kasm/current/tmp/guac:Z
+      - ${KASM_ROOT_PATH}/conf/app/guac:/opt/kasm/current/conf/app/guac:Z
+      - ${KASM_ROOT_PATH}/tmp/guac:/tmp:Z
+      - ${KASM_ROOT_PATH}/healthcheck/kasm_guac:/healthcheck:Z
+    networks:
+      - kasm_default_network
+    labels:
+      prune.protect: "true"
+
+  rdp_gateway:
+    image: kasmweb/rdp-gateway:${KASM_VERSION}
+    container_name: kasm_rdp_gateway
+    user: "${KASM_UID}:${KASM_GID}"
+    read_only: true
+    restart: unless-stopped
+    depends_on:
+      - kasm_api
+    healthcheck:
+      test: "/usr/bin/healthcheck.sh http://localhost:5555/__healthcheck 3389 1 30"
+      interval: 60s
+      timeout: 30s
+      start_period: 30s
+    volumes:
+      - ${KASM_ROOT_PATH}/log:/opt/kasm/current/log:Z
+      - ${KASM_ROOT_PATH}/conf/app/rdp_gateway:/usr/local/etc/rdpproxy/conf:Z
+      - ${KASM_ROOT_PATH}/certs/kasm_nginx.key:/usr/local/etc/rdpproxy/rdpproxy.key:ro,Z
+      - ${KASM_ROOT_PATH}/certs/kasm_nginx.crt:/usr/local/etc/rdpproxy/rdpproxy.crt:ro,Z
+      - ${KASM_ROOT_PATH}/tmp/rdpgw/var:/usr/local/etc/rdpproxy/var:Z
+      - ${KASM_ROOT_PATH}/tmp/rdpgw/tmp:/tmp:Z
+      - ${KASM_ROOT_PATH}/healthcheck/rdp_gateway:/healthcheck:Z
+    networks:
+      - kasm_default_network
+    labels:
+      prune.protect: "true"
+
+  kasm_rdp_https_gateway:
+    image: kasmweb/rdp-https-gateway:${KASM_VERSION}
+    container_name: kasm_rdp_https_gateway
+    user: "${KASM_UID}:${KASM_GID}"
+    read_only: true
+    restart: unless-stopped
+    depends_on:
+      proxy:
+        condition: service_started
+    healthcheck:
+      test: "/usr/bin/healthcheck.sh https://localhost:9443/rdp-https-gateway/__healthcheck \"\" 1 30"
+      interval: 60s
+      timeout: 30s
+      start_period: 30s
+    volumes:
+      - ${KASM_ROOT_PATH}/log:/opt/kasm/current/log:Z
+      - ${KASM_ROOT_PATH}/conf/app/rdp_https_gateway:/opt/rdpgw/conf:Z
+      - ${KASM_ROOT_PATH}/certs/kasm_nginx.key:/opt/rdpgw/key.pem:ro,Z
+      - ${KASM_ROOT_PATH}/certs/kasm_nginx.crt:/opt/rdpgw/server.pem:ro,Z
+      - ${KASM_ROOT_PATH}/healthcheck/rdp_https_gateway:/healthcheck:Z
+    networks:
+      - kasm_default_network
+    labels:
+      prune.protect: "true"
+
+  proxy:
+    image: kasmweb/proxy:${KASM_VERSION}
+    container_name: kasm_proxy
+    restart: unless-stopped
+    depends_on:
+      kasm_manager:
+        condition: service_healthy
+      kasm_api:
+        condition: service_healthy
+      kasm_agent:
+        condition: service_started
+      kasm_guac:
+        condition: service_started
+    volumes:
+      - ${KASM_ROOT_PATH}/conf/nginx:/etc/nginx/conf.d:ro,Z
+      - ${KASM_ROOT_PATH}/certs/kasm_nginx.key:/etc/ssl/private/kasm_nginx.key:ro,Z
+      - ${KASM_ROOT_PATH}/certs/kasm_nginx.crt:/etc/ssl/certs/kasm_nginx.crt:ro,Z
+      - ${KASM_ROOT_PATH}/log/nginx:/var/log/external/nginx:Z
+      - ${KASM_ROOT_PATH}/log/logrotate:/var/log/external/logrotate:Z
+    networks:
+      - kasm_default_network
+      - kasm_sidecar_network
+      - proxy
+    labels:
+      prune.protect: "true"
+      traefik.enable: "true"
+      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
+      traefik.http.routers.kasm.rule: "Host(`${KASM_DOMAIN}`)"
+      traefik.http.routers.kasm.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
+      traefik.http.routers.kasm.tls: "true"
+      traefik.http.routers.kasm.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
+      traefik.http.routers.kasm.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_MIDDLEWARE}"
+      traefik.http.services.kasm.loadbalancer.server.port: "3000"
+      traefik.http.services.kasm.loadbalancer.server.scheme: "https"
+      traefik.http.services.kasm.loadbalancer.passhostheader: "true"
+      homepage.group: "Infraestructura"
+      homepage.name: "Kasm"
+      homepage.icon: "https://www.kasmweb.com/favicon.ico"
+      homepage.description: "Workspaces en navegador"
+      homepage.href: "https://${KASM_DOMAIN}"
+      homepage.siteMonitor: "https://kasm_proxy:3000/"
+      homepage.weight: "350"
+
+networks:
+  kasm_default_network:
+    name: kasm_default_network
+    driver: bridge
+  kasm_sidecar_network:
+    name: kasm_sidecar_network
+    driver: bridge
+  proxy:
+    external: true

DEPRECATED-kasm/stack.env

@@ -1,7 +1,7 @@
 TZ=Europe/Madrid
 KASM_IMAGE=lscr.io/linuxserver/kasm:latest
 KASM_DOMAIN=app.example.com
-KASM_OPT_PATH=/opt/kasm/opt
+KASM_OPT_PATH=/var/lib/kasm
 TRAEFIK_DOCKER_NETWORK=proxy
 TRAEFIK_ENTRYPOINT_SECURE=websecure
 TRAEFIK_CERTRESOLVER=letsencrypt

kasm/docker-compose.yml

@@ -1,36 +0,0 @@
-services:
-  kasm:
-    image: ${KASM_IMAGE}
-    pull_policy: always
-    container_name: kasm
-    restart: unless-stopped
-    privileged: true
-    environment:
-      TZ: ${TZ}
-      KASM_PORT: "443"
-    volumes:
-      - ${KASM_OPT_PATH}:/opt:Z
-    networks:
-      - proxy
-    labels:
-      traefik.enable: "true"
-      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
-      traefik.http.routers.kasm.rule: "Host(`${KASM_DOMAIN}`)"
-      traefik.http.routers.kasm.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
-      traefik.http.routers.kasm.tls: "true"
-      traefik.http.routers.kasm.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
-      traefik.http.routers.kasm.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_MIDDLEWARE}"
-      traefik.http.services.kasm.loadbalancer.server.port: "3000"
-      traefik.http.services.kasm.loadbalancer.server.scheme: "https"
-      traefik.http.services.kasm.loadbalancer.passhostheader: "true"
-      homepage.group: "Infraestructura"
-      homepage.name: "Kasm"
-      homepage.icon: "https://www.kasmweb.com/favicon.ico"
-      homepage.description: "Workspaces en navegador"
-      homepage.href: "https://${KASM_DOMAIN}"
-      homepage.siteMonitor: "https://kasm:3000/"
-      homepage.weight: "350"
-
-networks:
-  proxy:
-    external: true