feat(onetimesecret): añadir stack de compartición segura de secretos

OneTimeSecret para compartir contraseñas y datos sensibles mediante enlaces de un solo uso, con integración OIDC a Authentik. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-25 05:49:44 +00:00
parent 975554892a
commit c484e502c2
2 changed files with 91 additions and 0 deletions
@@ -0,0 +1,70 @@
+services:
+  ots:
+    image: ${OTS_IMAGE}
+    pull_policy: always
+    container_name: onetimesecret
+    restart: unless-stopped
+    healthcheck:
+      disable: true
+    environment:
+      TZ: ${TZ}
+      REDIS_URL: redis://onetimesecret-redis:6379/0
+      HOST: 0.0.0.0:3000
+      SSL: "false"
+      SECRET: ${OTS_SECRET}
+      HMAC_SECRET: ${OTS_SECRET}
+      RODAUTH_HMAC_SECRET: ${OTS_SECRET}
+      AUTH_SECRET: ${OTS_SECRET}
+      HOMEPAGE_MODE: internal
+      AUTHENTICATION_MODE: full
+      AUTH_SSO_ENABLED: "true"
+      AUTH_SSO_ONLY: "true"
+      AUTH_REQUIRED: "true"
+      AUTH_SIGNUP: "false"
+      SSO_ALLOW_PLATFORM_FALLBACK: "true"
+      OIDC_ISSUER: ${OTS_OIDC_ISSUER}
+      OIDC_CLIENT_ID: ${OTS_OIDC_CLIENT_ID}
+      OIDC_CLIENT_SECRET: ${OTS_OIDC_CLIENT_SECRET}
+      OIDC_REDIRECT_URI: https://${OTS_DOMAIN}/auth/sso/oidc/callback
+      SSO_DISPLAY_NAME: Authentik
+    depends_on:
+      - ots-redis
+    volumes:
+      - ${OTS_DATA_PATH}:/app/data:Z
+    networks:
+      - proxy
+    labels:
+      traefik.enable: "true"
+      traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
+      traefik.http.routers.onetimesecret.rule: "Host(`${OTS_DOMAIN}`)"
+      traefik.http.routers.onetimesecret.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
+      traefik.http.routers.onetimesecret.tls: "true"
+      traefik.http.routers.onetimesecret.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
+      traefik.http.routers.onetimesecret.middlewares: "crowdsec-bouncer@file"
+      traefik.http.routers.onetimesecret.service: "ots-svc"
+      traefik.http.services.ots-svc.loadbalancer.server.port: "3000"
+
+      homepage.group: "Automatizacion y desarrollo"
+      homepage.name: "OneTimeSecret"
+      homepage.icon: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/key.svg"
+      homepage.href: "https://${OTS_DOMAIN}/"
+      homepage.description: "Compartir secretos de un solo uso"
+      homepage.siteMonitor: "https://${OTS_DOMAIN}/"
+
+  ots-redis:
+    image: ${OTS_REDIS_IMAGE}
+    container_name: onetimesecret-redis
+    restart: unless-stopped
+    volumes:
+      - ${OTS_REDIS_PATH}:/data:Z
+    networks:
+      - proxy
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+
+networks:
+  proxy:
+    external: true
@@ -0,0 +1,21 @@
+##### OneTimeSecret #####
+OTS_IMAGE=onetimesecret/onetimesecret:latest
+OTS_REDIS_IMAGE=redis:7-alpine
+OTS_DOMAIN=ots.example.com
+OTS_DATA_PATH=/opt/onetimesecret/data
+OTS_REDIS_PATH=/opt/onetimesecret/redis
+OTS_SECRET=CHANGEME_genera_un_valor_largo_y_aleatorio
+
+##### OIDC (Authentik) #####
+# Issuer: https://auth.tudominio.com/application/o/<slug>/
+OTS_OIDC_ISSUER=change-me
+OTS_OIDC_CLIENT_ID=change-me
+OTS_OIDC_CLIENT_SECRET=change-me
+
+##### Traefik #####
+TRAEFIK_DOCKER_NETWORK=proxy
+TRAEFIK_ENTRYPOINT_SECURE=websecure
+TRAEFIK_CERTRESOLVER=letsencrypt
+
+##### General #####
+TZ=America/Mexico_City