Document Nextcloud deployment and Infisical secrets

docs/decisions.md

@@ -161,12 +161,12 @@ Implemented
 
 Decision:
 
-Store shared credentials in a single secrets file.
+Originally store shared credentials in a single secrets file.
 
 Location:
 
 ```text
-/srv/secrets/company.env
+Legacy local secrets file
 ```
 
 Reason:
@@ -178,7 +178,14 @@ Reason:
 
 Status:
 
-Implemented
+Superseded by Infisical and `slcompose`
+
+Current state:
+
+* Standard SilverLinux service secrets are stored in Infisical.
+* `slcompose` injects secrets into Compose stacks at runtime.
+* The legacy local secrets file should be removed if it still exists.
+* Sentry is the exception and follows the upstream self-hosted Sentry installation pattern.
 
 ---
 
@@ -235,7 +242,7 @@ Decision:
 * Replace GitHub Actions with self-hosted Gitea Actions.
 * Execute package publishing on SilverLinux using the global `silverlinux-runner`.
 * Publish internal NuGet packages to BaGet.
-* Store the runner registration token in `/srv/secrets/company.env` and publishing credentials in Gitea Actions Secrets.
+* Store the runner registration token in Infisical and publishing credentials in Gitea Actions Secrets.
 * Use `[Package]` in commit messages to request commit-driven package publishing.
 
 Reason:
@@ -262,15 +269,15 @@ Reason:
 
 * Simplicity during initial deployment.
 
-Future Plan:
+Current Plan:
 
-Move the API key into the centralized SilverLinux secrets management system located at:
+Move the API key into the centralized SilverLinux secrets management system:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
-when additional services begin consuming the same secret management approach.
+when the BaGet deployment is fully aligned with the standard `slcompose` pattern.
 
 ---
 
@@ -281,7 +288,7 @@ Decision:
 * Run Microsoft SQL Server 2022 Express alongside PostgreSQL.
 * Attach MSSQL only to the `internal` Docker network.
 * Do not publish port `1433` or route MSSQL through the reverse proxy.
-* Store `MSSQL_SA_PASSWORD` in `/srv/secrets/company.env`.
+* Store `MSSQL_SA_PASSWORD` in Infisical.
 
 Reason:
 
@@ -312,7 +319,7 @@ Reason:
 
 Follow-up:
 
-Move the DbGate password from the server-side Compose configuration to `/srv/secrets/company.env`.
+Move the DbGate password from any legacy server-side Compose configuration to Infisical.
 
 Status:
 
@@ -447,6 +454,10 @@ Status:
 Accepted
 ```
 
+Current status:
+
+* Sentry is now implemented and documented as the exception to the standard `slcompose` + Infisical service pattern.
+
 ---
 
 ## 2026-06-25 - Select Prometheus And Grafana Monitoring Stack
@@ -583,6 +594,37 @@ Implemented
 
 ---
 
+## 2026-07-08 - Deploy Nextcloud For Private Cloud Storage
+
+Decision:
+
+Deploy Nextcloud as the SilverLinux private cloud storage and file sharing service at `cloud.silveressence.net`.
+
+Implementation:
+
+* Run `nextcloud:29-apache` as the web application container.
+* Run `postgres:16` as the stack-local Nextcloud database.
+* Run `redis:7-alpine` as the stack-local cache and locking backend.
+* Attach only the web container to `proxy`.
+* Keep PostgreSQL and Redis on `nextcloud_nextcloud_internal`.
+* Persist data in `nextcloud_nextcloud_data` and `nextcloud_nextcloud_db`.
+* Manage the stack from `/srv/docker/nextcloud` with `slcompose` and Infisical secret injection.
+
+Reason:
+
+* Provide self-hosted file storage and document sharing.
+* Keep user files inside SilverLinux infrastructure.
+* Avoid exposing database or cache ports publicly.
+* Reuse the standard Nginx Proxy Manager routing model.
+
+Status:
+
+```text
+Implemented
+```
+
+---
+
 ## Future Decisions
 
 Document future decisions using the following template: