feat(authentik): añadir script de creación de aplicaciones OAuth

- create-auth-app.sh: script interactivo para crear providers y
  aplicaciones en Authentik vía API, automatizando la integración SSO
- docker-compose.yml y stack.env: ajustes del stack
- README.md: documentación actualizada

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

authentik/docker-compose.yml

@@ -8,7 +8,7 @@ services:
       POSTGRES_USER: ${AUTHENTIK_DB_USER}
       POSTGRES_DB: ${AUTHENTIK_DB_NAME}
     volumes:
-      - /opt/authentik/postgres:/var/lib/postgresql/data:Z
+      - ${AUTHENTIK_POSTGRES_PATH}:/var/lib/postgresql/data:Z
     networks:
       - ths_authentik_internal
 
@@ -18,7 +18,7 @@ services:
     restart: unless-stopped
     command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"]
     volumes:
-      - /opt/authentik/redis:/data:Z
+      - ${AUTHENTIK_REDIS_PATH}:/data:Z
     networks:
       - ths_authentik_internal
 
@@ -42,26 +42,53 @@ services:
       AUTHENTIK_BOOTSTRAP_EMAIL: ${AUTHENTIK_BOOTSTRAP_EMAIL}
       AUTHENTIK_BOOTSTRAP_PASSWORD: ${AUTHENTIK_BOOTSTRAP_PASSWORD}
       AUTHENTIK_BOOTSTRAP_TOKEN: ${AUTHENTIK_BOOTSTRAP_TOKEN}
+      AUTHENTIK_EMAIL__HOST: ${AUTHENTIK_EMAIL__HOST}
+      AUTHENTIK_EMAIL__PORT: ${AUTHENTIK_EMAIL__PORT}
+      AUTHENTIK_EMAIL__USERNAME: ${AUTHENTIK_EMAIL__USERNAME}
+      AUTHENTIK_EMAIL__PASSWORD: ${AUTHENTIK_EMAIL__PASSWORD}
+      AUTHENTIK_EMAIL__FROM: ${AUTHENTIK_EMAIL__FROM}
+      AUTHENTIK_EMAIL__USE_TLS: ${AUTHENTIK_EMAIL__USE_TLS}
+      AUTHENTIK_EMAIL__USE_SSL: ${AUTHENTIK_EMAIL__USE_SSL}
 
     depends_on:
       - ths-authentik-postgres
       - ths-authentik-redis
 
     expose:
-      - "9000"
+      - "${AUTHENTIK_HTTP_PORT}"
 
     networks:
       - ths_authentik_internal
+      - mail_internal
       - proxy
 
     labels:
+      traefik.enable: "true"
+      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
+
       # Service Authentik (panel + endpoints)
-      traefik.http.services.ths-authentik.loadbalancer.server.port: "9000"
+      traefik.http.services.ths-authentik.loadbalancer.server.port: "${AUTHENTIK_HTTP_PORT}"
+
+      # Panel Authentik
+      traefik.http.routers.ths-authentik.rule: "Host(`${AUTHENTIK_DOMAIN}`)"
+      traefik.http.routers.ths-authentik.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
+      traefik.http.routers.ths-authentik.tls: "true"
+      traefik.http.routers.ths-authentik.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
+      traefik.http.routers.ths-authentik.service: "ths-authentik"
 
       # Middleware forwardAuth (para proteger otros servicios) -> usar ths-authentik@docker en tus stacks THS
       traefik.http.middlewares.ths-authentik.forwardauth.address: "http://ths-authentik-server:${AUTHENTIK_HTTP_PORT}/outpost.goauthentik.io/auth/traefik"
       traefik.http.middlewares.ths-authentik.forwardauth.trustForwardHeader: "true"
       traefik.http.middlewares.ths-authentik.forwardauth.authResponseHeaders: "X-Authentik-Username,X-Authentik-Groups,X-Authentik-Email,X-Authentik-Uid,X-Authentik-Jwt"
+      traefik.http.middlewares.ths-authentik.forwardauth.maxResponseBodySize: "1048576"
+
+      # Outpost para subdominios sherlockhomeless.net, además de apex/www
+      traefik.http.routers.ths-authentik-outpost.rule: "(HostRegexp(`[a-z0-9-]+\\.sherlockhomeless\\.net`) || Host(`sherlockhomeless.net`) || Host(`www.sherlockhomeless.net`)) && PathPrefix(`/outpost.goauthentik.io/`)"
+      traefik.http.routers.ths-authentik-outpost.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
+      traefik.http.routers.ths-authentik-outpost.tls: "true"
+      traefik.http.routers.ths-authentik-outpost.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
+      traefik.http.routers.ths-authentik-outpost.service: "ths-authentik"
+      traefik.http.routers.ths-authentik-outpost.priority: "1000"
 
   ths-authentik-worker:
     image: ${AUTHENTIK_IMAGE}
@@ -78,6 +105,13 @@ services:
       AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASSWORD}
 
       AUTHENTIK_REDIS__HOST: ths-authentik-redis
+      AUTHENTIK_EMAIL__HOST: ${AUTHENTIK_EMAIL__HOST}
+      AUTHENTIK_EMAIL__PORT: ${AUTHENTIK_EMAIL__PORT}
+      AUTHENTIK_EMAIL__USERNAME: ${AUTHENTIK_EMAIL__USERNAME}
+      AUTHENTIK_EMAIL__PASSWORD: ${AUTHENTIK_EMAIL__PASSWORD}
+      AUTHENTIK_EMAIL__FROM: ${AUTHENTIK_EMAIL__FROM}
+      AUTHENTIK_EMAIL__USE_TLS: ${AUTHENTIK_EMAIL__USE_TLS}
+      AUTHENTIK_EMAIL__USE_SSL: ${AUTHENTIK_EMAIL__USE_SSL}
 
     depends_on:
       - ths-authentik-postgres
@@ -85,8 +119,11 @@ services:
 
     networks:
       - ths_authentik_internal
+      - mail_internal
 
 networks:
+  mail_internal:
+    external: true
   proxy:
     external: true
   ths_authentik_internal: