headquarter/openspec/changes/archive/2025-05-17-oauth-traefik-integration/tasks.md

1. Externalize Authentik and domain configuration

• 1.1 Update apps/api/src/config.py to read all Authentik URLs from environment variables with no hardcoded defaults.
• 1.2 Add API_PUBLIC_URL, WEB_PUBLIC_URL, and related domain env vars to config.py.
• 1.3 Update apps/api/src/api/auth.py to construct OAuth redirect/callback URLs from configured domains.
• 1.4 Update .env.example with all new environment variables for Authentik and domain configuration.

2. Create Traefik deployment compose file

• 2.1 Create docker-compose.traefik.yml with all services configured for Traefik reverse proxy.
• 2.2 Add Traefik Docker labels to all services with configurable domain-based routing rules.
• 2.3 Ensure no ports are exposed directly in traefik mode (all through Traefik).
• 2.4 Add PROXY_WEB_NAME and other traefik-specific env vars to .env.example.

3. Frontend configuration

• 3.1 Update frontend to support configurable public URL for OAuth redirect.
• 3.2 Update apps/web/.env.example or relevant config with VITE_APP_URL.

4. Verification and testing

• 4.1 Run backend quality gates (pytest, ruff, mypy).
• 4.2 Run frontend quality gates (npm test, typecheck, lint, build).
• 4.3 Validate docker-compose config works for both compose files.
• 4.4 Update this tasks file with completed checkboxes.