SilverSolutions/silverlinux-infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document Nextcloud deployment and Infisical secrets

Browse Source
This commit is contained in:
Saeed Asgari
2026-07-08 15:13:17 +03:30
parent a81aa80161
commit 3f94ced9ea
23 changed files with 895 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/AI_CONTEXT.md
+16 -4
View File
@@ -35,6 +35,7 @@ Public IP: 51.255.83.140
* Node Exporter
* cAdvisor
* Alertmanager
* Nextcloud
## Domains
@@ -52,13 +53,19 @@ dbgate.silveressence.net -> DbGate (through Nginx Proxy Manager)
sentry.silveressence.net -> Sentry (through Nginx Proxy Manager)
cloud.silveressence.net -> Nextcloud (through Nginx Proxy Manager)
Xray -> Public tunneling endpoint through proxy network
## Secrets
Secrets are stored in Infisical and injected at runtime via the **slcompose orchestrator**.
Never hardcode credentials. All services receive environment variables through Infisical's secret injection at container startup.
Never hardcode credentials. Standard SilverLinux services receive environment variables through Infisical's secret injection at container startup.
Sentry is the exception because it is a much larger upstream self-hosted application and follows the default Sentry installation pattern.
Legacy note: `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists on the server.
### Secret Injection Flow
@@ -99,6 +106,8 @@ gitea-runner_default
MSSQL is attached only to `internal`. DbGate is attached to both `internal` and `proxy`.
Nextcloud is attached to `proxy` and `nextcloud_nextcloud_internal`. Its PostgreSQL and Redis containers are attached only to `nextcloud_nextcloud_internal`.
Jitsi uses `jitsi-docker-jitsi-meet-aa76415_meet.jitsi` for its internal cluster and `proxy` for web access. Xray is currently attached to `proxy`; `xray_default` exists but had no running containers attached in the 2026-06-24 runtime snapshot.
## Authentication
@@ -122,7 +131,7 @@ The global self-hosted runner is operational at `/srv/docker/gitea-runner` with
Silver 2.0 uses `.gitea/workflows/package.yml` to publish NuGet packages to BaGet when a push to `net-8-version` has a commit message containing `[Package]`.
The runner registration token is stored in `/srv/secrets/company.env`. The BaGet publishing key is stored as the repository Actions secret `BAGET_API_KEY`.
The runner registration token is stored in Infisical. The BaGet publishing key is stored as the repository Actions secret `BAGET_API_KEY`.
## Databases
@@ -207,8 +216,10 @@ Roadmap:
* Phase 1 completed: Grafana, Prometheus, Node Exporter, cAdvisor, Alertmanager, backup metrics integration, incident intelligence
* Phase 1 remaining: Loki, Redis, Authelia
* Phase 2 completed: Backup v5.3 automation, restore validation
* Phase 2 remaining: CrowdSec, Sentry, Fail2Ban upgrade, Cloudflare rate limiting and WAF
* Phase 3: SonarQube, Harbor, Backstage, Nextcloud
* Phase 2 completed: Sentry
* Phase 2 remaining: CrowdSec, Fail2Ban upgrade, Cloudflare rate limiting and WAF
* Phase 3 completed: Nextcloud
* Phase 3 remaining: SonarQube, Harbor, Backstage
See:
@@ -229,3 +240,4 @@ docs/roadmap.md
* DbGate selected as the database administration portal
* Xray introduced as a tunneling and connectivity layer
* Multi-network segmentation formalized: internal, proxy and isolated infrastructure networks
* Nextcloud deployed as the private cloud storage service at cloud.silveressence.net
docs/backups.md
+109 -8
View File
@@ -120,7 +120,7 @@ Required:
* Native SQL Server database backups
* MSSQL Compose configuration
* `MSSQL_SA_PASSWORD` from the shared secrets backup
* `MSSQL_SA_PASSWORD` from Infisical recovery data
* Runtime MSSQL data included by the v1.5+ backup structure
Importance:
@@ -174,10 +174,10 @@ Critical
#### Shared Secrets
Location:
Source:
```text
/srv/secrets/company.env
Infisical
```
Contains:
@@ -186,14 +186,58 @@ Contains:
* PostgreSQL passwords
* MSSQL SA password
* OpenProject secrets
* Future DbGate password
* DbGate password
* Future OAuth secrets
Importance:
Critical
Without this file applications may not start correctly.
Without Infisical recovery and `/etc/infisical/token` reauthorization, applications may not start correctly.
Legacy note:
* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists.
---
#### Nextcloud
Volumes:
```text
nextcloud_nextcloud_data
nextcloud_nextcloud_db
```
Compose location:
```text
/srv/docker/nextcloud
```
Contains:
* Uploaded files and user data
* Nextcloud application configuration
* Installed apps and themes
* PostgreSQL metadata database
* Compose configuration and environment references
Required:
* Logical PostgreSQL dump from `nextcloud-db`
* Archive of `nextcloud_nextcloud_data`
* Archive or cold snapshot of `nextcloud_nextcloud_db`
* `/srv/docker/nextcloud/docker-compose.yml`
* `/srv/docker/nextcloud/.env` only if it contains non-secret runtime configuration
* Infisical `/nextcloud` secrets
Importance:
Critical
The 2026-07-08 runtime snapshot verified `nextcloud_nextcloud_data` and `nextcloud_nextcloud_db` as Docker-managed named volumes.
---
@@ -293,7 +337,7 @@ Contains:
* Runner deployment configuration
* Runner state
The registration token is stored separately in `/srv/secrets/company.env`.
The registration token is stored in Infisical.
Importance:
@@ -393,6 +437,60 @@ Keep:
7 days
```
---
## Nextcloud Backup Recipe
This recipe shows practical commands to back up the operational Nextcloud PostgreSQL database and application data volume. Run these on the host where Docker runs. Adjust paths, filenames and the backup target directory as needed.
1) Backup PostgreSQL (from running `nextcloud-db` container). This creates a compressed SQL dump:
```bash
# Backup directory on host
BACKUP_DIR=/srv/backups/nextcloud
mkdir -p "$BACKUP_DIR"
docker exec -t nextcloud-db pg_dump -U nextcloud nextcloud | gzip > "$BACKUP_DIR/nextcloud_db_$(date +%F).sql.gz"
```
If the DB user or DB name differ from the example, use the values from the Nextcloud Infisical path or sanitized Compose config. For a full cluster dump, use `pg_dumpall` with the appropriate PostgreSQL user.
2) Backup application data volume (`nextcloud_nextcloud_data`):
```bash
BACKUP_DIR=/srv/backups/nextcloud
mkdir -p "$BACKUP_DIR"
docker run --rm -v nextcloud_nextcloud_data:/data -v "$BACKUP_DIR":/backup alpine \
sh -c "cd /data && tar czf /backup/nextcloud_data_$(date +%F).tar.gz ."
```
3) Backup `docker-compose.yml` and `.env` if the `.env` file contains only non-secret runtime configuration:
```bash
cp /srv/docker/nextcloud/docker-compose.yml "$BACKUP_DIR/docker-compose.yml.$(date +%F)"
if [ -f /srv/docker/nextcloud/.env ]; then
cp /srv/docker/nextcloud/.env "$BACKUP_DIR/.env.$(date +%F)"
fi
```
Do not preserve plaintext passwords from `.env`; migrate them to Infisical and remove them from the file.
4) Optional: Export Postgres data directory snapshot (cold snapshot required — stop DB or use filesystem snapshot):
```bash
# Stop DB to take a consistent file-level snapshot (or use LVM/ZFS snapshot instead)
docker compose -f /srv/docker/nextcloud/docker-compose.yml stop nextcloud-db
tar czf "$BACKUP_DIR/nextcloud_db_files_$(date +%F).tar.gz" -C /var/lib/docker/volumes/nextcloud_nextcloud_db/_data .
docker compose -f /srv/docker/nextcloud/docker-compose.yml start nextcloud-db
```
5) Retention and verification
- Keep backups in `/srv/backups/nextcloud` with rolling retention (e.g., daily 7, weekly 4, monthly 6).
- Verify SQL dumps by restoring to a staging DB and checking the Nextcloud application with `occ status` and a login test.
Security note: backups contain secrets (DB passwords stored in config, mail credentials in `config.php`). Protect backups with appropriate filesystem permissions and store them encrypted if possible.
### Weekly
Keep:
@@ -427,6 +525,7 @@ Restore order:
10. Gitea Actions Runner
11. DbGate
12. Xray
13. Nextcloud
---
@@ -449,6 +548,8 @@ Verified:
* OpenProject assets
* Docker configuration
Nextcloud restore validation is pending after its 2026-07-08 operational documentation update.
Validation results:
* MSSQL backup integrity verified
@@ -542,10 +643,10 @@ Install:
### Step 2
Restore:
Restore or reauthorize:
```text
/srv/secrets/company.env
Infisical access and service secret paths
```
### Step 3
docs/cicd.md
+7 -2
View File
@@ -95,10 +95,15 @@ The complete workflow has been tested successfully and is operational.
Runner registration token:
```text
/srv/secrets/company.env
GITEA_RUNNER_REGISTRATION_TOKEN
```
Source:
```text
Infisical
```
BaGet publishing credential:
```text
@@ -106,7 +111,7 @@ Repository Settings -> Actions -> Secrets
BAGET_API_KEY
```
No credentials are stored in repositories. Infrastructure-level secrets belong in `company.env`; repository workflow secrets belong in Gitea Actions Secrets.
No credentials are stored in repositories. Infrastructure-level secrets belong in Infisical; repository workflow secrets belong in Gitea Actions Secrets.
---
docs/decisions.md
+52 -10
View File
@@ -161,12 +161,12 @@ Implemented
Decision:
Store shared credentials in a single secrets file.
Originally store shared credentials in a single secrets file.
Location:
```text
/srv/secrets/company.env
Legacy local secrets file
```
Reason:
@@ -178,7 +178,14 @@ Reason:
Status:
Implemented
Superseded by Infisical and `slcompose`
Current state:
* Standard SilverLinux service secrets are stored in Infisical.
* `slcompose` injects secrets into Compose stacks at runtime.
* The legacy local secrets file should be removed if it still exists.
* Sentry is the exception and follows the upstream self-hosted Sentry installation pattern.
---
@@ -235,7 +242,7 @@ Decision:
* Replace GitHub Actions with self-hosted Gitea Actions.
* Execute package publishing on SilverLinux using the global `silverlinux-runner`.
* Publish internal NuGet packages to BaGet.
* Store the runner registration token in `/srv/secrets/company.env` and publishing credentials in Gitea Actions Secrets.
* Store the runner registration token in Infisical and publishing credentials in Gitea Actions Secrets.
* Use `[Package]` in commit messages to request commit-driven package publishing.
Reason:
@@ -262,15 +269,15 @@ Reason:
* Simplicity during initial deployment.
Future Plan:
Current Plan:
Move the API key into the centralized SilverLinux secrets management system located at:
Move the API key into the centralized SilverLinux secrets management system:
```text
/srv/secrets/company.env
Infisical
```
when additional services begin consuming the same secret management approach.
when the BaGet deployment is fully aligned with the standard `slcompose` pattern.
---
@@ -281,7 +288,7 @@ Decision:
* Run Microsoft SQL Server 2022 Express alongside PostgreSQL.
* Attach MSSQL only to the `internal` Docker network.
* Do not publish port `1433` or route MSSQL through the reverse proxy.
* Store `MSSQL_SA_PASSWORD` in `/srv/secrets/company.env`.
* Store `MSSQL_SA_PASSWORD` in Infisical.
Reason:
@@ -312,7 +319,7 @@ Reason:
Follow-up:
Move the DbGate password from the server-side Compose configuration to `/srv/secrets/company.env`.
Move the DbGate password from any legacy server-side Compose configuration to Infisical.
Status:
@@ -447,6 +454,10 @@ Status:
Accepted
```
Current status:
* Sentry is now implemented and documented as the exception to the standard `slcompose` + Infisical service pattern.
---
## 2026-06-25 - Select Prometheus And Grafana Monitoring Stack
@@ -583,6 +594,37 @@ Implemented
---
## 2026-07-08 - Deploy Nextcloud For Private Cloud Storage
Decision:
Deploy Nextcloud as the SilverLinux private cloud storage and file sharing service at `cloud.silveressence.net`.
Implementation:
* Run `nextcloud:29-apache` as the web application container.
* Run `postgres:16` as the stack-local Nextcloud database.
* Run `redis:7-alpine` as the stack-local cache and locking backend.
* Attach only the web container to `proxy`.
* Keep PostgreSQL and Redis on `nextcloud_nextcloud_internal`.
* Persist data in `nextcloud_nextcloud_data` and `nextcloud_nextcloud_db`.
* Manage the stack from `/srv/docker/nextcloud` with `slcompose` and Infisical secret injection.
Reason:
* Provide self-hosted file storage and document sharing.
* Keep user files inside SilverLinux infrastructure.
* Avoid exposing database or cache ports publicly.
* Reuse the standard Nginx Proxy Manager routing model.
Status:
```text
Implemented
```
---
## Future Decisions
Document future decisions using the following template:
docs/domains.md
+42 -2
View File
@@ -9,7 +9,7 @@ All public services are routed through Nginx Proxy Manager.
Verified proxy-host snapshot:
```text
2026-06-24
2026-06-24, with Nextcloud evidence added from 2026-07-08 server output
```
---
@@ -38,6 +38,7 @@ Used for:
| 5 | `team.silveressence.net` | `http://openproject:80` | enabled | enabled | disabled | enabled | none | enabled |
| 6 | `nuget.silveressence.net` | `http://baget:80` | disabled | disabled | disabled | disabled | none | enabled |
| 8 | `dbgate.silveressence.net` | `http://dbgate:3000` | disabled | disabled | disabled | enabled | none | enabled |
| 13 | `cloud.silveressence.net` | `http://nextcloud:80` | disabled | disabled | disabled | enabled | none | enabled |
All listed active inventory hosts have Block Exploits enabled.
@@ -72,9 +73,10 @@ Nginx Proxy Manager findings from the 2026-06-24 snapshot:
* `portainer.silveressence.net` has SSL Force, HTTP/2 and HSTS enabled.
* `team.silveressence.net` has SSL Force and HTTP/2 enabled.
* `git.silveressence.net`, `meet.silveressence.net`, `nuget.silveressence.net` and `dbgate.silveressence.net` do not have SSL Force enabled.
* `git.silveressence.net`, `meet.silveressence.net`, `nuget.silveressence.net`, `dbgate.silveressence.net` and `cloud.silveressence.net` do not have SSL Force enabled.
* No listed proxy host uses an Nginx Proxy Manager access list.
* DbGate is a high-sensitivity database administration interface and should be prioritized for SSL Force and an access restriction policy.
* Nextcloud stores private files and should be prioritized for SSL Force, HTTP/2 and HSTS.
* Plane.so has been removed from containers, Nginx Proxy Manager and server certificate storage.
---
@@ -317,6 +319,44 @@ Active
---
### Nextcloud
Domain:
```text
cloud.silveressence.net
```
Purpose:
* Private cloud storage
* File sharing
* Team document storage
Container:
```text
nextcloud
```
Routing:
```text
Nginx Proxy Manager -> nextcloud:80
```
Status:
```text
Active
```
Runtime note:
Nginx Proxy Manager proxy host 13 is enabled and forwards `cloud.silveressence.net` to `http://nextcloud:80`. The 2026-07-08 database query showed SSL Force disabled, HTTP/2 disabled, HSTS disabled, WebSocket enabled, Block Exploits enabled and no access list.
---
## DNS
DNS records should point to:
docs/email.md
+31 -3
View File
@@ -68,7 +68,7 @@ Login
SMTP credentials are stored in:
```text
/srv/secrets/company.env
Infisical
```
Variables:
@@ -147,6 +147,34 @@ Configured and validated
---
### Nextcloud
Purpose:
* User notifications
* File sharing notifications
* Password and account emails where enabled
Sender:
```text
noreply@silveressence.net
```
Observed runtime settings:
```text
smtp.gmail.com
port 465
ssl
```
Status:
Configured
---
### Alertmanager
Purpose:
@@ -221,7 +249,7 @@ docker logs gitea
Verify:
* App password is valid
* SMTP credentials match company.env
* SMTP credentials match the Infisical values injected by `slcompose`
* STARTTLS is enabled
* Port 587 is used
@@ -240,7 +268,7 @@ Verify:
* Use Gmail App Passwords.
* Never use personal Gmail passwords.
* Store SMTP credentials only in company.env.
* Store SMTP credentials only in Infisical.
* Rotate credentials if they become exposed.
---
docs/network.md
+36 -1
View File
@@ -13,7 +13,7 @@ Current model:
Verified runtime snapshot:
```text
2026-06-24 10:15 CEST
2026-06-24 10:15 CEST, with Nextcloud evidence added from 2026-07-08 13:21:13 +02:00
```
---
@@ -73,6 +73,7 @@ Public services:
* Xray
* Jitsi Web
* BaGet
* Nextcloud
Internal monitoring services:
@@ -223,6 +224,30 @@ Validated:
* Grafana connects to Prometheus
* Alertmanager routes monitoring alerts
#### nextcloud_nextcloud_internal
Purpose:
* Private Nextcloud application, database and cache traffic
* Keep Nextcloud PostgreSQL and Redis away from the public proxy layer
Services:
* `nextcloud`
* `nextcloud-db`
* `nextcloud-redis`
Public attachment:
* Only the `nextcloud` web container also attaches to `proxy`.
* `nextcloud-db` and `nextcloud-redis` are internal-only.
Verified subnet:
```text
172.27.0.0/16
```
---
## Runtime-Published Ports
@@ -239,6 +264,13 @@ The current Docker runtime includes these host-published ports.
| Jitsi JVB | `10000/udp` | `10000/udp` | Allowed | Required media bridge traffic |
| Xray | `32443` | `8080` | Allowed | Public tunneling endpoint |
Nextcloud runtime exposure from the 2026-07-08 snapshot:
* `nextcloud` exposes `80/tcp` only inside Docker and is routed through Nginx Proxy Manager.
* `nextcloud-db` exposes `5432/tcp` only inside Docker.
* `nextcloud-redis` exposes `6379/tcp` only inside Docker.
* No host-published ports were shown for the Nextcloud stack.
Additional UFW allowed ports with no matching Docker-published service in the 2026-06-24 Docker snapshot:
* `8080/tcp`
@@ -266,6 +298,7 @@ Internet
-> Xray
-> Jitsi Web
-> BaGet
-> Nextcloud
internal network
-> PostgreSQL
@@ -277,6 +310,7 @@ isolated networks
-> xray_default
-> gitea-runner_default
-> monitoring stack network
-> nextcloud_nextcloud_internal
```
---
@@ -310,6 +344,7 @@ Periodically verify:
* UFW-only allowed ports have documented owners
* Prometheus targets remain healthy
* Grafana datasource connection remains healthy
* Nextcloud remains routed through Nginx Proxy Manager without host-published database or Redis ports
* Unused Docker networks are removed only after confirming they are not active dependencies
---
docs/nextcloud.md
+338
View File
@@ -0,0 +1,338 @@
# Nextcloud
## Overview
Nextcloud is deployed on SilverLinux as the private cloud storage and file sharing service for Silver Solutions.
Status:
```text
Operational
```
Public URL:
```text
https://cloud.silveressence.net
```
Verified runtime snapshot:
```text
2026-07-08 13:21:13 +02:00
```
---
## Runtime Stack
Location:
```text
/srv/docker/nextcloud
```
Files present on the server:
```text
/srv/docker/nextcloud/docker-compose.yml
/srv/docker/nextcloud/.env
```
The `.env` file was present in the 2026-07-08 snapshot, but passwords should come from Infisical through `slcompose`. Remove any secret values from this file if they still exist.
Management:
* Docker Compose stack name: `nextcloud`
* Managed by `slcompose`
* Secrets injected at runtime through Infisical
* Restart policy: `unless-stopped`
---
## Containers
| Container | Image | Purpose | Status at snapshot |
| --- | --- | --- | --- |
| `nextcloud` | `nextcloud:29-apache` | Web UI, file storage and application runtime | Up 6 days |
| `nextcloud-db` | `postgres:16` | Nextcloud PostgreSQL database | Up 6 days |
| `nextcloud-redis` | `redis:7-alpine` | Redis cache and locking backend | Up 6 days |
Nextcloud application status:
```text
installed: true
version: 29.0.16
maintenance: false
needsDbUpgrade: false
```
---
## Networking
Networks:
* `proxy`
* `nextcloud_nextcloud_internal`
Network roles:
* `proxy` connects `nextcloud` to Nginx Proxy Manager.
* `nextcloud_nextcloud_internal` connects `nextcloud`, `nextcloud-db` and `nextcloud-redis`.
* `nextcloud-db` and `nextcloud-redis` are internal-only and are not attached to `proxy`.
Verified subnet:
```text
nextcloud_nextcloud_internal: 172.27.0.0/16
```
Port exposure:
* `nextcloud` exposes `80/tcp` only inside Docker.
* `nextcloud-db` exposes `5432/tcp` only inside Docker.
* `nextcloud-redis` exposes `6379/tcp` only inside Docker.
* No Nextcloud stack ports were published to the host in the runtime snapshot.
Routing:
```text
Internet
-> Nginx Proxy Manager
-> proxy network
-> nextcloud:80
```
---
## Domain And Proxy
Domain:
```text
cloud.silveressence.net
```
Nextcloud trusted domain:
```text
cloud.silveressence.net
```
Reverse proxy settings observed in the application configuration:
```text
overwritehost: cloud.silveressence.net
overwriteprotocol: https
trusted_proxies: 172.16.0.0/12
```
Nginx Proxy Manager proxy host 13 forwards requests to `nextcloud`.
Proxy host settings from the 2026-07-08 Nginx Proxy Manager database query:
| Setting | Value |
| --- | --- |
| Forward scheme | `http` |
| Forward host | `nextcloud` |
| Forward port | `80` |
| SSL Force | disabled |
| HTTP/2 | disabled |
| HSTS | disabled |
| HSTS subdomains | disabled |
| Block Exploits | enabled |
| WebSocket | enabled |
| Access List | none |
| Status | enabled |
---
## Persistent Data
Docker volumes:
| Volume | Mount point | Purpose |
| --- | --- | --- |
| `nextcloud_nextcloud_data` | `/var/www/html` | Nextcloud application files, config, apps and user data directory |
| `nextcloud_nextcloud_db` | `/var/lib/next-cloud-postgresDb/data` | PostgreSQL data for Nextcloud |
Host mountpoints:
```text
/var/lib/docker/volumes/nextcloud_nextcloud_data/_data
/var/lib/docker/volumes/nextcloud_nextcloud_db/_data
```
Application data directory:
```text
/var/www/html/data
```
---
## Database
Database type:
```text
pgsql
```
Database host:
```text
nextcloud-db
```
Database image:
```text
postgres:16
```
Operational note:
PostgreSQL is pinned to version 16 for this stack. During initial deployment, the database volume was initialized with PostgreSQL 16 and therefore must not be started with PostgreSQL 17 without a proper PostgreSQL major-version upgrade.
---
## Redis
Redis host:
```text
nextcloud-redis
```
Port:
```text
6379
```
Purpose:
* Cache backend
* File locking support
* Internal application performance support
---
## Email
Nextcloud SMTP is configured.
Observed application mail settings:
```text
mail_smtphost: smtp.gmail.com
mail_smtpport: 465
mail_smtpsecure: ssl
mail_from_address: noreply
mail_domain: silveressence.net
```
Sender:
```text
noreply@silveressence.net
```
Credentials must remain in Infisical and must not be committed.
---
## Secrets
Required secret values include:
* `NEXTCLOUD_ADMIN_USER`
* `NEXTCLOUD_ADMIN_PASSWORD`
* `POSTGRES_DB`
* `POSTGRES_USER`
* `POSTGRES_PASSWORD`
* SMTP credentials if not inherited from shared mail configuration
Security note:
Nextcloud `config.php` contains sensitive values such as `secret`, `passwordsalt`, database credentials and SMTP credentials. Do not paste the raw file into public channels and rotate any exposed credentials.
---
## Backup Requirements
Back up these items:
* `nextcloud_nextcloud_data`
* `nextcloud_nextcloud_db`
* `/srv/docker/nextcloud/docker-compose.yml`
* `/srv/docker/nextcloud/.env` only if it contains non-secret runtime configuration
* Infisical secrets for the `/nextcloud` path
The `nextcloud_nextcloud_data` volume includes the application config and user uploaded files. The `nextcloud_nextcloud_db` volume contains the metadata database and should also be backed up with a logical PostgreSQL dump where possible.
See [docs/backups.md](backups.md) for the backup recipe and restore order.
---
## Operational Commands
Check stack status:
```bash
docker ps --filter "name=nextcloud"
```
Check Nextcloud application status:
```bash
docker exec -u www-data nextcloud php -f /var/www/html/occ status
```
Check selected config values:
```bash
docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get trusted_domains
docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get overwritehost
docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get overwriteprotocol
```
Manage through slcompose:
```bash
slcompose up nextcloud
slcompose restart nextcloud
slcompose logs nextcloud
slcompose logs-tail nextcloud 200
```
---
## Verification Evidence
The 2026-07-08 server output verified:
* Hostname `silverlinux`
* Containers `nextcloud`, `nextcloud-db` and `nextcloud-redis` running
* Compose files present under `/srv/docker/nextcloud`
* Public domain `cloud.silveressence.net`
* Nextcloud version `29.0.16`
* Maintenance mode disabled
* Database upgrade not required
* PostgreSQL backend at `nextcloud-db`
* Redis backend at `nextcloud-redis`
* Docker volumes `nextcloud_nextcloud_data` and `nextcloud_nextcloud_db`
* No host-published ports for the Nextcloud stack
---
## Related Documentation
* [docs/services.md](services.md)
* [docs/domains.md](domains.md)
* [docs/network.md](network.md)
* [docs/security.md](security.md)
* [docs/backups.md](backups.md)
* [docs/secrets.md](secrets.md)
docs/orchestration.md
+1
View File
@@ -60,6 +60,7 @@ Available services:
- postgres
- baget
- dbgate
- nextcloud
```
### Boot All Services
docs/roadmap.md
+15 -2
View File
@@ -23,9 +23,19 @@ Purpose:
Status:
```text
Planned
Completed
```
Deployment:
* Docker Compose project: `nextcloud`
* Management: `slcompose` with Infisical secret injection
* External access: `cloud.silveressence.net` through Nginx Proxy Manager
* Internal networking: `nextcloud_nextcloud_internal`
* Runtime services: `nextcloud`, `nextcloud-db`, `nextcloud-redis`
See [docs/nextcloud.md](nextcloud.md) for complete deployment documentation.
---
### Observability
@@ -335,7 +345,6 @@ Completed:
Items:
* CrowdSec
* Sentry
* Fail2Ban upgrade
* Cloudflare rate limiting and WAF
@@ -343,6 +352,7 @@ Completed:
* Backup v5.3 automation
* Restore validation
* Sentry
---
@@ -353,6 +363,9 @@ Items:
* SonarQube
* Harbor Docker registry
* Backstage portal
Completed:
* Nextcloud
---
docs/secrets.md
+61 -36
View File
@@ -2,9 +2,11 @@
## Overview
SilverLinux uses Infisical for centralized secret management. Secrets are injected into Compose stacks at runtime by `infisical run`.
SilverLinux uses Infisical for centralized secret management. Secrets are injected into standard Compose stacks at runtime by `slcompose`, which wraps `infisical run`.
This repository no longer depends on a local `/srv/secrets/company.env` file for deployed services.
This repository no longer depends on a local `/srv/secrets/company.env` file for deployed services. If that file still exists on the server, remove it after confirming all required values are present in Infisical.
Sentry is the only documented exception to the standard pattern. It follows the upstream self-hosted Sentry installation model because it is a much larger multi-service application.
---
@@ -18,12 +20,12 @@ The Infisical deployment flow provides a single source of truth for:
* OAuth client secrets
* Future API keys
Applications should load secrets using Infisical injection at deployment time.
Applications should load secrets using Infisical injection at deployment time through `slcompose`.
Example:
```bash
infisical run --path=/ --recursive -- docker compose up -d
slcompose up gitea
```
---
@@ -119,6 +121,40 @@ Used by:
---
### Nextcloud
```text
NEXTCLOUD_ADMIN_USER
NEXTCLOUD_ADMIN_PASSWORD
POSTGRES_DB
POSTGRES_USER
POSTGRES_PASSWORD
SMTP_HOST
SMTP_PORT
SMTP_USERNAME
SMTP_PASSWORD
```
Used by:
* Nextcloud
* Nextcloud PostgreSQL
* Nextcloud notification email
Infisical path:
```text
/nextcloud
```
Notes:
* The 2026-07-08 runtime snapshot showed `/srv/docker/nextcloud/.env` present on the server.
* Do not commit the raw `.env` file or `config.php`.
* `config.php` includes high-sensitivity values such as `secret`, `passwordsalt`, database credentials and SMTP credentials.
---
### Future OAuth
```text
@@ -140,22 +176,21 @@ Future use:
---
### DbGate Credential Migration
The running DbGate deployment currently has its login credential in the server-side Compose configuration. Move the password to:
### Sentry Exception
```text
/srv/secrets/company.env
DBGATE_PASSWORD
Sentry self-hosted installer secrets
```
The repository Compose definition already references `DBGATE_PASSWORD` and contains no real password.
Used by:
Status:
* Sentry
```text
Migration pending
```
Notes:
* Sentry does not follow the same simple `slcompose` + Infisical pattern as the other SilverLinux services.
* Keep Sentry secrets out of this repository.
* Document any Sentry-specific backup or restore requirements in [docs/sentry.md](sentry.md).
---
@@ -163,7 +198,7 @@ Migration pending
* Never commit secrets to Git.
* Never store passwords directly in docker-compose files.
* Never share the contents of company.env.
* Never share Infisical exports, tokens or raw service `.env` files.
* Use environment variables whenever possible.
* Use `.env.example` files for documentation.
* Rotate credentials immediately if exposure is suspected.
@@ -172,13 +207,13 @@ Migration pending
## Backup Requirements
The following file must be included in server backups:
Backups must preserve the ability to recover Infisical-managed secrets.
```text
/srv/secrets/company.env
Infisical project data and service secret paths
```
Loss of this file may prevent applications from starting correctly.
Loss of the Infisical secret source may prevent applications from starting correctly.
---
@@ -186,32 +221,22 @@ Loss of this file may prevent applications from starting correctly.
If the server must be rebuilt:
1. Restore `/srv/secrets/company.env`
2. Verify file permissions
3. Deploy Docker stacks
4. Verify services can access required variables
5. Verify SMTP functionality
6. Verify database connectivity
1. Restore or reauthorize Infisical access.
2. Verify `/etc/infisical/token` and any required Infisical domain configuration.
3. Deploy Docker stacks through `slcompose`.
4. Verify services can access required variables.
5. Verify SMTP functionality.
6. Verify database connectivity.
---
## Security Notes
The secrets file contains credentials for multiple services.
Infisical contains credentials for multiple services.
Access should be restricted to system administrators only.
Recommended permissions:
```bash
chmod 600 /srv/secrets/company.env
```
Recommended ownership:
```bash
root:root
```
The local Infisical token under `/etc/infisical/token` must be protected with root-only permissions.
---
docs/security.md
+20 -6
View File
@@ -101,7 +101,7 @@ Planned improvements:
Shared secrets are stored in:
```text
/srv/secrets/company.env
Infisical
```
Examples:
@@ -117,6 +117,7 @@ Rules:
* Never commit secrets to Git
* Never share secrets in documentation
* Never hardcode passwords in Docker Compose files
* Remove `/srv/secrets/company.env` if it still exists after confirming all values are present in Infisical
See:
@@ -149,12 +150,14 @@ Publicly exposed services:
* Xray
* Jitsi Web
* BaGet
* Nextcloud
High-sensitivity exposure:
* DbGate exposes a database administration interface and must always require authentication and HTTPS.
* Xray exposes tunneling capability and must be monitored for abuse, unexpected traffic and unauthorized use.
* Portainer exposes Docker management and must be restricted to trusted administrators.
* Nextcloud exposes private file storage and must require strong user authentication, HTTPS and prompt security updates.
Nginx Proxy Manager findings from the 2026-06-24 proxy-host snapshot:
@@ -164,12 +167,14 @@ Nginx Proxy Manager findings from the 2026-06-24 proxy-host snapshot:
* Plane.so has been removed from containers, Nginx Proxy Manager and server certificate storage.
* `cicd.silveressence.net` is intentionally enabled as a frequently changing prototype deployment endpoint.
* `exactsyncer.silveressence.net` is intentionally enabled as a client-facing Exact Online syncer demo endpoint.
* `cloud.silveressence.net` is enabled for Nextcloud with WebSocket and Block Exploits enabled, but SSL Force, HTTP/2 and HSTS disabled and no access list.
Priority hardening:
1. Enable SSL Force for all HTTPS public service routes unless there is a documented exception.
2. Add an access list or equivalent restriction for DbGate and Portainer.
3. Define explicit exposure and authentication expectations for prototype and demo endpoints.
2. Enable SSL Force, HTTP/2 and HSTS for Nextcloud unless there is a documented exception.
3. Add an access list or equivalent restriction for DbGate and Portainer.
4. Define explicit exposure and authentication expectations for prototype and demo endpoints.
---
@@ -180,7 +185,7 @@ Outgoing email is provided through Gmail SMTP.
Credentials are stored in:
```text
/srv/secrets/company.env
Infisical
```
Requirements:
@@ -214,7 +219,7 @@ Future OAuth providers:
Requirements:
* Store client secrets in company.env
* Store client secrets in Infisical
* Use least-privilege scopes
* Disable unused authentication providers
@@ -259,6 +264,10 @@ Applications and DbGate communicate with the database containers through the `in
DbGate is the public administration entry point and must require authentication and HTTPS. Its web interface is routed through Nginx Proxy Manager; database ports `5432` and `1433` remain private.
Nextcloud uses a stack-local PostgreSQL container named `nextcloud-db` on `nextcloud_nextcloud_internal`. Its `5432/tcp` port is not published to the host and is not routed through Nginx Proxy Manager.
Nextcloud Redis uses `nextcloud-redis` on `nextcloud_nextcloud_internal`. Its `6379/tcp` port is not published to the host.
---
## Connectivity Layer Security
@@ -292,6 +301,7 @@ Networks:
* jitsi-docker-jitsi-meet-aa76415_meet.jitsi
* xray_default
* gitea-runner_default
* nextcloud_nextcloud_internal
Network model:
@@ -299,6 +309,7 @@ Network model:
* `proxy` is for public HTTP and HTTPS services controlled by Nginx Proxy Manager.
* Isolated stack networks are used for Jitsi, Xray and CI/CD runner separation.
* `xray_default` currently exists without a running container attached; the active `xray` container is attached to `proxy`.
* `nextcloud_nextcloud_internal` isolates Nextcloud database and Redis traffic from the public proxy layer.
---
@@ -345,6 +356,9 @@ Periodically verify:
* DbGate login is enforced
* DbGate proxy route has SSL Force and an access restriction policy
* Xray exposure policy is still valid
* Nextcloud security advisories are reviewed and the image is updated promptly
* Nextcloud database and Redis ports remain internal-only
* Nextcloud proxy route uses HTTPS with SSL Force, HTTP/2 and HSTS enabled unless there is a documented exception
* Public services are still routed only through Nginx Proxy Manager
* Removed proxy hosts and unused certificates stay removed unless explicitly approved
* Prototype and demo proxy hosts have documented owners and exposure expectations
@@ -362,7 +376,7 @@ Periodically verify:
If a credential is exposed:
1. Rotate the credential immediately.
2. Update `/srv/secrets/company.env`.
2. Rotate or update the value in Infisical.
3. Restart affected services.
4. Review logs for unauthorized access.
5. Update documentation if required.
docs/server.md
+36 -3
View File
@@ -168,6 +168,7 @@ Examples:
* Grafana
* Node Exporter
* cAdvisor
* Nextcloud
---
@@ -194,6 +195,7 @@ Contains:
/srv/docker/dbgate
/srv/docker/xray
/srv/docker/monitoring
/srv/docker/nextcloud
```
---
@@ -201,7 +203,7 @@ Contains:
### Shared Secrets
```text
/srv/secrets/company.env
Infisical
```
Contains:
@@ -210,9 +212,13 @@ Contains:
* Database passwords
* Application secrets
* MSSQL SA password
* Future DbGate password
* DbGate password
* Future OAuth credentials
Legacy note:
* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists.
---
### Backups
@@ -342,6 +348,31 @@ The `xray_default` network exists, but the running `xray` container was attached
---
### Nextcloud
```text
/srv/docker/nextcloud
```
Volumes:
```text
nextcloud_nextcloud_data
nextcloud_nextcloud_db
```
Domain:
```text
cloud.silveressence.net
```
Runtime note:
The 2026-07-08 runtime snapshot showed `nextcloud`, `nextcloud-db` and `nextcloud-redis` running with no host-published ports. The web container is routed through Nginx Proxy Manager on the `proxy` network; PostgreSQL and Redis stay on `nextcloud_nextcloud_internal`.
---
### Monitoring Stack
```text
@@ -390,6 +421,7 @@ Implemented:
* SSL certificates managed through Nginx Proxy Manager
* PostgreSQL not exposed publicly
* MSSQL port 1433 not exposed publicly
* Nextcloud PostgreSQL and Redis not exposed publicly
* Database administration is available only through authenticated HTTPS access to DbGate
* Xray is not attached to the private database network and is monitored as a tunneling endpoint
* OpenID disabled in Gitea
@@ -407,13 +439,14 @@ noreply@silveressence.net
SMTP credentials are stored in:
```text
/srv/secrets/company.env
Infisical
```
Used by:
* Gitea
* OpenProject
* Nextcloud
---
docs/services.md
+53 -3
View File
@@ -461,6 +461,53 @@ Operational
---
### Nextcloud
URL:
```text
https://cloud.silveressence.net
```
Purpose:
* Private cloud storage
* File sharing
* Team document storage
* Nextcloud notification email
Runtime:
* `nextcloud` using `nextcloud:29-apache`
* `nextcloud-db` using `postgres:16`
* `nextcloud-redis` using `redis:7-alpine`
Networks:
* `proxy` for Nginx Proxy Manager access to the web container
* `nextcloud_nextcloud_internal` for private Nextcloud, PostgreSQL and Redis traffic
Storage:
* `nextcloud_nextcloud_data`
* `nextcloud_nextcloud_db`
Exposure:
* Routed through Nginx Proxy Manager
* No Nextcloud stack ports were published to the host in the 2026-07-08 runtime snapshot
* Database and Redis containers are internal-only
Status:
```text
Operational
```
See [docs/nextcloud.md](nextcloud.md) for complete deployment documentation.
---
### Sentry
URL:
@@ -712,10 +759,10 @@ Running
### Shared Secrets
Location:
Source:
```text
/srv/secrets/company.env
Infisical
```
Purpose:
@@ -730,6 +777,10 @@ Status:
Active
```
Legacy note:
* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists.
---
## Removed Services
@@ -760,7 +811,6 @@ Phase 3:
* SonarQube
* Harbor
* Backstage
* Nextcloud
---