Document Nextcloud deployment and Infisical secrets

docs/backups.md

@@ -120,7 +120,7 @@ Required:
 
 * Native SQL Server database backups
 * MSSQL Compose configuration
-* `MSSQL_SA_PASSWORD` from the shared secrets backup
+* `MSSQL_SA_PASSWORD` from Infisical recovery data
 * Runtime MSSQL data included by the v1.5+ backup structure
 
 Importance:
@@ -174,10 +174,10 @@ Critical
 
 #### Shared Secrets
 
-Location:
+Source:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Contains:
@@ -186,14 +186,58 @@ Contains:
 * PostgreSQL passwords
 * MSSQL SA password
 * OpenProject secrets
-* Future DbGate password
+* DbGate password
 * Future OAuth secrets
 
 Importance:
 
 Critical
 
-Without this file applications may not start correctly.
+Without Infisical recovery and `/etc/infisical/token` reauthorization, applications may not start correctly.
+
+Legacy note:
+
+* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists.
+
+---
+
+#### Nextcloud
+
+Volumes:
+
+```text
+nextcloud_nextcloud_data
+nextcloud_nextcloud_db
+```
+
+Compose location:
+
+```text
+/srv/docker/nextcloud
+```
+
+Contains:
+
+* Uploaded files and user data
+* Nextcloud application configuration
+* Installed apps and themes
+* PostgreSQL metadata database
+* Compose configuration and environment references
+
+Required:
+
+* Logical PostgreSQL dump from `nextcloud-db`
+* Archive of `nextcloud_nextcloud_data`
+* Archive or cold snapshot of `nextcloud_nextcloud_db`
+* `/srv/docker/nextcloud/docker-compose.yml`
+* `/srv/docker/nextcloud/.env` only if it contains non-secret runtime configuration
+* Infisical `/nextcloud` secrets
+
+Importance:
+
+Critical
+
+The 2026-07-08 runtime snapshot verified `nextcloud_nextcloud_data` and `nextcloud_nextcloud_db` as Docker-managed named volumes.
 
 ---
 
@@ -293,7 +337,7 @@ Contains:
 * Runner deployment configuration
 * Runner state
 
-The registration token is stored separately in `/srv/secrets/company.env`.
+The registration token is stored in Infisical.
 
 Importance:
 
@@ -393,6 +437,60 @@ Keep:
 7 days
 ```
 
+---
+
+## Nextcloud Backup Recipe
+
+This recipe shows practical commands to back up the operational Nextcloud PostgreSQL database and application data volume. Run these on the host where Docker runs. Adjust paths, filenames and the backup target directory as needed.
+
+1) Backup PostgreSQL (from running `nextcloud-db` container). This creates a compressed SQL dump:
+
+```bash
+# Backup directory on host
+BACKUP_DIR=/srv/backups/nextcloud
+mkdir -p "$BACKUP_DIR"
+docker exec -t nextcloud-db pg_dump -U nextcloud nextcloud | gzip > "$BACKUP_DIR/nextcloud_db_$(date +%F).sql.gz"
+```
+
+If the DB user or DB name differ from the example, use the values from the Nextcloud Infisical path or sanitized Compose config. For a full cluster dump, use `pg_dumpall` with the appropriate PostgreSQL user.
+
+2) Backup application data volume (`nextcloud_nextcloud_data`):
+
+```bash
+BACKUP_DIR=/srv/backups/nextcloud
+mkdir -p "$BACKUP_DIR"
+docker run --rm -v nextcloud_nextcloud_data:/data -v "$BACKUP_DIR":/backup alpine \
+	sh -c "cd /data && tar czf /backup/nextcloud_data_$(date +%F).tar.gz ."
+```
+
+3) Backup `docker-compose.yml` and `.env` if the `.env` file contains only non-secret runtime configuration:
+
+```bash
+cp /srv/docker/nextcloud/docker-compose.yml "$BACKUP_DIR/docker-compose.yml.$(date +%F)"
+if [ -f /srv/docker/nextcloud/.env ]; then
+  cp /srv/docker/nextcloud/.env "$BACKUP_DIR/.env.$(date +%F)"
+fi
+```
+
+Do not preserve plaintext passwords from `.env`; migrate them to Infisical and remove them from the file.
+
+4) Optional: Export Postgres data directory snapshot (cold snapshot required — stop DB or use filesystem snapshot):
+
+```bash
+# Stop DB to take a consistent file-level snapshot (or use LVM/ZFS snapshot instead)
+docker compose -f /srv/docker/nextcloud/docker-compose.yml stop nextcloud-db
+tar czf "$BACKUP_DIR/nextcloud_db_files_$(date +%F).tar.gz" -C /var/lib/docker/volumes/nextcloud_nextcloud_db/_data .
+docker compose -f /srv/docker/nextcloud/docker-compose.yml start nextcloud-db
+```
+
+5) Retention and verification
+
+- Keep backups in `/srv/backups/nextcloud` with rolling retention (e.g., daily 7, weekly 4, monthly 6).
+- Verify SQL dumps by restoring to a staging DB and checking the Nextcloud application with `occ status` and a login test.
+
+Security note: backups contain secrets (DB passwords stored in config, mail credentials in `config.php`). Protect backups with appropriate filesystem permissions and store them encrypted if possible.
+
+
 ### Weekly
 
 Keep:
@@ -427,6 +525,7 @@ Restore order:
 10. Gitea Actions Runner
 11. DbGate
 12. Xray
+13. Nextcloud
 
 ---
 
@@ -449,6 +548,8 @@ Verified:
 * OpenProject assets
 * Docker configuration
 
+Nextcloud restore validation is pending after its 2026-07-08 operational documentation update.
+
 Validation results:
 
 * MSSQL backup integrity verified
@@ -542,10 +643,10 @@ Install:
 
 ### Step 2
 
-Restore:
+Restore or reauthorize:
 
 ```text
-/srv/secrets/company.env
+Infisical access and service secret paths
 ```
 
 ### Step 3