From 7b4ed3e05e66bcb5bdf1730f63d2382bbb129ffe Mon Sep 17 00:00:00 2001
From: Eduardo David Paredes Vara <admin@thehomelesssherlock.com>
Date: Mon, 25 May 2026 05:49:12 +0000
Subject: [PATCH] =?UTF-8?q?feat(kasm):=20a=C3=B1adir=20stack=20de=20worksp?=
 =?UTF-8?q?aces=20aislados=20en=20navegador?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Kasm Workspaces para ejecutar aplicaciones de escritorio en contenedores
accesibles desde el navegador, protegido con Authentik SSO.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 kasm/README.md          | 41 +++++++++++++++++++++++++++++++++++++++++
 kasm/docker-compose.yml | 36 ++++++++++++++++++++++++++++++++++++
 kasm/stack.env          | 10 ++++++++++
 3 files changed, 87 insertions(+)
 create mode 100644 kasm/README.md
 create mode 100644 kasm/docker-compose.yml
 create mode 100644 kasm/stack.env

diff --git a/kasm/README.md b/kasm/README.md
new file mode 100644
index 0000000..5d052f4
--- /dev/null
+++ b/kasm/README.md
@@ -0,0 +1,41 @@
+# Kasm
+
+Stack para desplegar [Kasm](https://www.kasmweb.com/) en `kasm.sherlockhomeless.net` detrás de Traefik y Authentik.
+
+## 🚀 Despliegue en Portainer
+
+1. Ve a **Stacks** -> **Add stack**
+2. Nombre: `kasm`
+3. Selecciona **Repository** o **Git repository**
+4. Configura:
+   - Repository URL: `<tu-repositorio>`
+   - Repository reference: `main`
+   - Compose path: `kasm/docker-compose.yml`
+5. Copia `kasm/stack.env` a `kasm/.env` y carga `kasm/.env` como archivo de variables
+6. Haz clic en **Deploy the stack**
+
+## ⚙️ Variables importantes
+
+Edita `kasm/.env`:
+
+```env
+KASM_DOMAIN=kasm.sherlockhomeless.net
+KASM_OPT_PATH=/opt/kasm/opt
+TRAEFIK_AUTH_MIDDLEWARE=ths-authentik@docker
+```
+
+## 📁 Preparación del host
+
+Antes del primer arranque:
+
+```bash
+mkdir -p /opt/kasm/opt
+```
+
+## 🔐 Autenticación y acceso
+
+Este stack publica Kasm por Traefik con HTTPS y lo protege con `ths-authentik@docker`.
+
+## 🏠 Integración con Homepage
+
+El servicio publica labels `homepage.*` para aparecer automáticamente en Homepage dentro del grupo **Infraestructura**.
diff --git a/kasm/docker-compose.yml b/kasm/docker-compose.yml
new file mode 100644
index 0000000..1e08266
--- /dev/null
+++ b/kasm/docker-compose.yml
@@ -0,0 +1,36 @@
+services:
+  kasm:
+    image: ${KASM_IMAGE}
+    pull_policy: always
+    container_name: kasm
+    restart: unless-stopped
+    privileged: true
+    environment:
+      TZ: ${TZ}
+      KASM_PORT: "443"
+    volumes:
+      - ${KASM_OPT_PATH}:/opt:Z
+    networks:
+      - proxy
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
+      traefik.http.routers.kasm.rule: "Host(`${KASM_DOMAIN}`)"
+      traefik.http.routers.kasm.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
+      traefik.http.routers.kasm.tls: "true"
+      traefik.http.routers.kasm.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
+      traefik.http.routers.kasm.middlewares: "crowdsec-bouncer@file,${TRAEFIK_AUTH_MIDDLEWARE}"
+      traefik.http.services.kasm.loadbalancer.server.port: "3000"
+      traefik.http.services.kasm.loadbalancer.server.scheme: "https"
+      traefik.http.services.kasm.loadbalancer.passhostheader: "true"
+      homepage.group: "Infraestructura"
+      homepage.name: "Kasm"
+      homepage.icon: "https://www.kasmweb.com/favicon.ico"
+      homepage.description: "Workspaces en navegador"
+      homepage.href: "https://${KASM_DOMAIN}"
+      homepage.siteMonitor: "https://kasm:3000/"
+      homepage.weight: "350"
+
+networks:
+  proxy:
+    external: true
diff --git a/kasm/stack.env b/kasm/stack.env
new file mode 100644
index 0000000..409642d
--- /dev/null
+++ b/kasm/stack.env
@@ -0,0 +1,10 @@
+TZ=Europe/Madrid
+KASM_IMAGE=lscr.io/linuxserver/kasm:latest
+KASM_DOMAIN=app.example.com
+KASM_OPT_PATH=/opt/kasm/opt
+TRAEFIK_DOCKER_NETWORK=proxy
+TRAEFIK_ENTRYPOINT_SECURE=websecure
+TRAEFIK_CERTRESOLVER=letsencrypt
+TRAEFIK_AUTH_MIDDLEWARE=ths-authentik@docker
+SERVICE_URL_KASM=https://app.example.com
+SERVICE_FQDN_KASM=app.example.com