SilverSolutions/silverlinux-infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document Nextcloud deployment and Infisical secrets

Browse Source
This commit is contained in:
Saeed Asgari
2026-07-08 15:13:17 +03:30
parent a81aa80161
commit 3f94ced9ea
23 changed files with 895 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/AI_CONTEXT.md
+16 -4
View File
@@ -35,6 +35,7 @@ Public IP: 51.255.83.140
* Node Exporter
* cAdvisor
* Alertmanager
* Nextcloud
## Domains
@@ -52,13 +53,19 @@ dbgate.silveressence.net -> DbGate (through Nginx Proxy Manager)
sentry.silveressence.net -> Sentry (through Nginx Proxy Manager)
cloud.silveressence.net -> Nextcloud (through Nginx Proxy Manager)
Xray -> Public tunneling endpoint through proxy network
## Secrets
Secrets are stored in Infisical and injected at runtime via the **slcompose orchestrator**.
Never hardcode credentials. All services receive environment variables through Infisical's secret injection at container startup.
Never hardcode credentials. Standard SilverLinux services receive environment variables through Infisical's secret injection at container startup.
Sentry is the exception because it is a much larger upstream self-hosted application and follows the default Sentry installation pattern.
Legacy note: `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists on the server.
### Secret Injection Flow
@@ -99,6 +106,8 @@ gitea-runner_default
MSSQL is attached only to `internal`. DbGate is attached to both `internal` and `proxy`.
Nextcloud is attached to `proxy` and `nextcloud_nextcloud_internal`. Its PostgreSQL and Redis containers are attached only to `nextcloud_nextcloud_internal`.
Jitsi uses `jitsi-docker-jitsi-meet-aa76415_meet.jitsi` for its internal cluster and `proxy` for web access. Xray is currently attached to `proxy`; `xray_default` exists but had no running containers attached in the 2026-06-24 runtime snapshot.
## Authentication
@@ -122,7 +131,7 @@ The global self-hosted runner is operational at `/srv/docker/gitea-runner` with
Silver 2.0 uses `.gitea/workflows/package.yml` to publish NuGet packages to BaGet when a push to `net-8-version` has a commit message containing `[Package]`.
The runner registration token is stored in `/srv/secrets/company.env`. The BaGet publishing key is stored as the repository Actions secret `BAGET_API_KEY`.
The runner registration token is stored in Infisical. The BaGet publishing key is stored as the repository Actions secret `BAGET_API_KEY`.
## Databases
@@ -207,8 +216,10 @@ Roadmap:
* Phase 1 completed: Grafana, Prometheus, Node Exporter, cAdvisor, Alertmanager, backup metrics integration, incident intelligence
* Phase 1 remaining: Loki, Redis, Authelia
* Phase 2 completed: Backup v5.3 automation, restore validation
* Phase 2 remaining: CrowdSec, Sentry, Fail2Ban upgrade, Cloudflare rate limiting and WAF
* Phase 3: SonarQube, Harbor, Backstage, Nextcloud
* Phase 2 completed: Sentry
* Phase 2 remaining: CrowdSec, Fail2Ban upgrade, Cloudflare rate limiting and WAF
* Phase 3 completed: Nextcloud
* Phase 3 remaining: SonarQube, Harbor, Backstage
See:
@@ -229,3 +240,4 @@ docs/roadmap.md
* DbGate selected as the database administration portal
* Xray introduced as a tunneling and connectivity layer
* Multi-network segmentation formalized: internal, proxy and isolated infrastructure networks
* Nextcloud deployed as the private cloud storage service at cloud.silveressence.net