traefik standalone adoption kit: live config versioned + compose + komodo panel router

- traefik.yml/dynamic/* copied from /etc/dokploy/traefik (acme.json gitignored — stays on host)
- compose.yaml: same image/binds/ports as dokploy-traefik, joins dokploy-network + komodo
- dynamic/komodo.yml: komodo.paginica.com router (inactive until cutover)

dynamic/authentik-forwardauth.yml

@@ -0,0 +1,93 @@
+# Traefik dynamic config — forward auth via authentik embedded outpost.
+# Deploy to: /etc/dokploy/traefik/dynamic/authentik-forwardauth.yml
+# All objects carry the `ak-` prefix; this file is never managed by Dokploy.
+#
+# Bypass model: the gated Host router (managed by Dokploy domain middlewares)
+# covers UI paths only. More-specific rules win automatically:
+#   Host + PathPrefix(`/outpost.goauthentik.io`) -> outpost   (auth callbacks)
+#   Host + PathPrefix(`/api`)                   -> app API   (CLI/SDK/agents/UI fetches)
+http:
+  services:
+    ak-authentik:
+      loadBalancer:
+        servers:
+          - url: http://authentik-server:9000
+        passHostHeader: true
+    ak-dokploy:
+      loadBalancer:
+        servers:
+          - url: http://dokploy:3000
+        passHostHeader: true
+    ak-infisical:
+      loadBalancer:
+        servers:
+          - url: http://infisical:8080
+        passHostHeader: true
+
+  middlewares:
+    ak-fw:
+      forwardAuth:
+        # embedded outpost reachable internally — no Cloudflare roundtrip
+        address: http://authentik-server:9000/outpost.goauthentik.io/auth/traefik
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-authentik-username
+          - X-authentik-groups
+          - X-authentik-email
+          - X-authentik-name
+          - X-authentik-uid
+          - X-authentik-jwt
+          - X-authentik-meta-jwks
+          - X-authentik-meta-outpost
+          - X-authentik-meta-provider
+          - X-authentik-meta-app
+          - X-authentik-meta-version
+    ak-fw-errors:
+      # turns the outpost 401 into its login redirect for browsers;
+      # machine paths bypass via dedicated routers and never see this
+      errors:
+        status: ["401-403"]
+        service: ak-authentik
+        query: /outpost.goauthentik.io/start?rd={url}
+
+  routers:
+    # Outpost endpoints on each gated host (forward_single mode needs these
+    # public: start/callback/sign_out live on the application domain).
+    ak-infisical-outpost:
+      rule: Host(`infisical.paginica.com`) && PathPrefix(`/outpost.goauthentik.io`)
+      service: ak-authentik
+      entryPoints: [websecure]
+      tls:
+        certResolver: letsencrypt
+      priority: 1000
+    ak-panel-outpost:
+      rule: Host(`panel.paginica.com`) && PathPrefix(`/outpost.goauthentik.io`)
+      service: ak-authentik
+      entryPoints: [websecure]
+      tls:
+        certResolver: letsencrypt
+      priority: 1000
+
+
+
+    # Infisical API bypass — UI fetches, CLI, SDK, agentes y syncs usan /api
+    # con tokens propios de Infisical; gated /api romperia el propio web vault.
+    ak-infisical-api:
+      rule: Host(`infisical.paginica.com`) && PathPrefix(`/api`)
+      service: ak-infisical
+      entryPoints: [websecure]
+      tls:
+        certResolver: letsencrypt
+      priority: 900
+
+    # Panel API bypass — keeps /api (tRPC, better-auth, deploy webhooks)
+    # outside the auth gate. Higher priority than the gated root router.
+    ak-panel-api:
+      rule: Host(`panel.paginica.com`) && PathPrefix(`/api`)
+      service: ak-dokploy
+      entryPoints: [websecure]
+      tls:
+        certResolver: letsencrypt
+      priority: 900
+
+

dynamic/dokploy.yml

@@ -0,0 +1,30 @@
+http:
+  routers:
+    dokploy-router-app:
+      rule: Host(`dokploy.docker.localhost`) && PathPrefix(`/`)
+      service: dokploy-service-app
+      entryPoints:
+        - web
+    dokploy-router-app-web:
+      rule: Host(`panel.paginica.com`) && PathPrefix(`/`)
+      service: dokploy-service-app
+      entryPoints:
+        - web
+      middlewares:
+        - redirect-to-https
+    dokploy-router-app-secure:
+      rule: Host(`panel.paginica.com`) && PathPrefix(`/`)
+      service: dokploy-service-app
+      entryPoints:
+        - websecure
+      middlewares:
+        - ak-fw-errors
+        - ak-fw
+      tls:
+        certResolver: letsencrypt
+  services:
+    dokploy-service-app:
+      loadBalancer:
+        servers:
+          - url: http://dokploy:3000
+        passHostHeader: true

dynamic/komodo.yml

@@ -0,0 +1,36 @@
+# Router del panel Komodo — REEMPLAZA a dokploy.yml en el cutover del
+# panel (backlog/01 Fase C). No activar mientras dokploy.yml exista con
+# el mismo Host (colisión de routers).
+#
+# komodo.paginica.com = dominio temporal del panel.
+# panel.paginica.com se reasigna al retirar Dokploy (mismo Host menos
+# churn): descomentar el segundo Host en ambas reglas entonces.
+#
+# Requiere: traefik adjunto a la red externa `komodo` (compose.yaml) —
+# core:9120 se resuelve por DNS del compose project `komodo`.
+http:
+  routers:
+    komodo-web:
+      rule: Host(`komodo.paginica.com`) && PathPrefix(`/`)
+      service: komodo-core
+      entryPoints:
+        - web
+      middlewares:
+        - redirect-to-https
+    komodo-websecure:
+      rule: Host(`komodo.paginica.com`) && PathPrefix(`/`)
+      service: komodo-core
+      entryPoints:
+        - websecure
+      # ak-fw NO se aplica: el panel usa OIDC nativo + local-auth de
+      # rescate (blueprint 22-komodo-oidc). Gatillar el panel del
+      # orquestador con ForwardAuth crearía una dependencia circular
+      # si authentik se migra en el stack 6 — se evalúa de nuevo entonces.
+      tls:
+        certResolver: letsencrypt
+  services:
+    komodo-core:
+      loadBalancer:
+        servers:
+          - url: http://core:9120
+        passHostHeader: true

dynamic/middlewares.yml

@@ -0,0 +1,6 @@
+http:
+  middlewares:
+    redirect-to-https:
+      redirectScheme:
+        scheme: https
+        permanent: true