diff --git a/kasm/README.md b/kasm/README.md
new file mode 100644
index 0000000..5d052f4
--- /dev/null
+++ b/kasm/README.md
@@ -0,0 +1,41 @@
+# Kasm
+
+Stack para desplegar [Kasm](https://www.kasmweb.com/) en `kasm.sherlockhomeless.net` detrás de Traefik y Authentik.
+
+## 🚀 Despliegue en Portainer
+
+1. Ve a **Stacks** -> **Add stack**
+2. Nombre: `kasm`
+3. Selecciona **Repository** o **Git repository**
+4. Configura:
+   - Repository URL: `<tu-repositorio>`
+   - Repository reference: `main`
+   - Compose path: `kasm/docker-compose.yml`
+5. Copia `kasm/stack.env` a `kasm/.env` y carga `kasm/.env` como archivo de variables
+6. Haz clic en **Deploy the stack**
+
+## ⚙️ Variables importantes
+
+Edita `kasm/.env`:
+
+```env
+KASM_DOMAIN=kasm.sherlockhomeless.net
+KASM_OPT_PATH=/opt/kasm/opt
+TRAEFIK_AUTH_MIDDLEWARE=ths-authentik@docker
+```
+
+## 📁 Preparación del host
+
+Antes del primer arranque:
+
+```bash
+mkdir -p /opt/kasm/opt
+```
+
+## 🔐 Autenticación y acceso
+
+Este stack publica Kasm por Traefik con HTTPS y lo protege con `ths-authentik@docker`.
+
+## 🏠 Integración con Homepage
+
+El servicio publica labels `homepage.*` para aparecer automáticamente en Homepage dentro del grupo **Infraestructura**.
diff --git a/kasm/docker-compose.yml b/kasm/docker-compose.yml
new file mode 100644
index 0000000..1e08266
--- /dev/null
+++ b/kasm/docker-compose.yml
@@ -0,0 +1,36 @@
+services:
+  kasm:
+    image: ${KASM_IMAGE}
+    pull_policy: always
+    container_name: kasm
+    restart: unless-stopped
+    privileged: true
+    environment:
+      TZ: ${TZ}
+      KASM_PORT: "443"
+    volumes:
+      - ${KASM_OPT_PATH}:/opt:Z
+    networks:
+      - proxy
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
+      traefik.http.routers.kasm.rule: "Host(`${KASM_DOMAIN}`)"
+      traefik.http.routers.kasm.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
+      traefik.http.routers.kasm.tls: "true"
+      traefik.http.routers.kasm.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
+      traefik.http.routers.kasm.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_MIDDLEWARE}"
+      traefik.http.services.kasm.loadbalancer.server.port: "3000"
+      traefik.http.services.kasm.loadbalancer.server.scheme: "https"
+      traefik.http.services.kasm.loadbalancer.passhostheader: "true"
+      homepage.group: "Infraestructura"
+      homepage.name: "Kasm"
+      homepage.icon: "https://www.kasmweb.com/favicon.ico"
+      homepage.description: "Workspaces en navegador"
+      homepage.href: "https://${KASM_DOMAIN}"
+      homepage.siteMonitor: "https://kasm:3000/"
+      homepage.weight: "350"
+
+networks:
+  proxy:
+    external: true
diff --git a/kasm/stack.env b/kasm/stack.env
new file mode 100644
index 0000000..409642d
--- /dev/null
+++ b/kasm/stack.env
@@ -0,0 +1,10 @@
+TZ=Europe/Madrid
+KASM_IMAGE=lscr.io/linuxserver/kasm:latest
+KASM_DOMAIN=app.example.com
+KASM_OPT_PATH=/opt/kasm/opt
+TRAEFIK_DOCKER_NETWORK=proxy
+TRAEFIK_ENTRYPOINT_SECURE=websecure
+TRAEFIK_CERTRESOLVER=letsencrypt
+TRAEFIK_AUTH_MIDDLEWARE=ths-authentik@docker
+SERVICE_URL_KASM=https://app.example.com
+SERVICE_FQDN_KASM=app.example.com