Document Nextcloud deployment and Infisical secrets

SUMMARY.md

@@ -1,6 +1,6 @@
 # SilverLinux Infrastructure Summary
 
-Last Updated: 2026-06-25
+Last Updated: 2026-07-08
 
 ## Overview
 
@@ -22,6 +22,7 @@ Monitoring, alerting, automated backups and restore validation are now productio
 | Jitsi Meet  | https://meet.silveressence.net      |
 | BaGet       | https://nuget.silveressence.net     |
 | DbGate      | https://dbgate.silveressence.net    |
+| Nextcloud   | https://cloud.silveressence.net     |
 | Xray        | Public tunneling endpoint           |
 
 ---
@@ -259,6 +260,34 @@ Status:
 
 ---
 
+### Nextcloud
+
+Purpose:
+
+* Private cloud storage
+* File sharing
+* Team document storage
+
+Access:
+
+* https://cloud.silveressence.net
+* HTTPS through Nginx Proxy Manager
+* Nextcloud user authentication required
+
+Runtime:
+
+* `nextcloud:29-apache`
+* `postgres:16`
+* `redis:7-alpine`
+* Data volume `nextcloud_nextcloud_data`
+* Database volume `nextcloud_nextcloud_db`
+
+Status:
+
+* Operational
+
+---
+
 ### Xray
 
 Purpose:
@@ -307,10 +336,10 @@ Purpose:
 
 ### Shared Secrets
 
-Location:
+Primary source:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Contains:
@@ -319,10 +348,19 @@ Contains:
 * PostgreSQL passwords
 * MSSQL SA password
 * OpenProject secrets
-* Future DbGate password
+* DbGate password
+* Nextcloud secrets
 * Future OAuth secrets
 
-This file must never be committed to Git.
+Secrets are injected into standard SilverLinux Compose stacks at runtime through `slcompose`.
+
+Exception:
+
+* Sentry follows its upstream self-hosted installer pattern because it is a much larger multi-service application.
+
+Legacy note:
+
+* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists on the server.
 
 ---
 
@@ -338,12 +376,14 @@ Plane.so was removed to reduce maintenance complexity and duplicate functionalit
 
 ### Centralized Secrets
 
-All shared credentials are stored in:
+All standard service credentials are stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
+They are injected by `slcompose` at runtime. Sentry is the exception and follows the default self-hosted Sentry installation model.
+
 ### Xray Connectivity Layer
 
 Xray is classified as a tunneling and connectivity layer rather than an application backend.
@@ -380,7 +420,6 @@ Completed:
 ### Phase 2 - Security And Stability
 
 * CrowdSec
-* Sentry
 * Fail2Ban upgrade
 * Cloudflare rate limiting and WAF
 
@@ -388,13 +427,13 @@ Completed:
 
 * Backup v5.3 automation
 * Restore validation
+* Sentry
 
 ### Phase 3 - Scale And Enterprise Services
 
 * SonarQube
 * Harbor Docker registry
 * Backstage portal
-* Nextcloud
 
 ---