Document Nextcloud deployment and Infisical secrets

docs/network.md

@@ -13,7 +13,7 @@ Current model:
 Verified runtime snapshot:
 
 ```text
-2026-06-24 10:15 CEST
+2026-06-24 10:15 CEST, with Nextcloud evidence added from 2026-07-08 13:21:13 +02:00
 ```
 
 ---
@@ -73,6 +73,7 @@ Public services:
 * Xray
 * Jitsi Web
 * BaGet
+* Nextcloud
 
 Internal monitoring services:
 
@@ -223,6 +224,30 @@ Validated:
 * Grafana connects to Prometheus
 * Alertmanager routes monitoring alerts
 
+#### nextcloud_nextcloud_internal
+
+Purpose:
+
+* Private Nextcloud application, database and cache traffic
+* Keep Nextcloud PostgreSQL and Redis away from the public proxy layer
+
+Services:
+
+* `nextcloud`
+* `nextcloud-db`
+* `nextcloud-redis`
+
+Public attachment:
+
+* Only the `nextcloud` web container also attaches to `proxy`.
+* `nextcloud-db` and `nextcloud-redis` are internal-only.
+
+Verified subnet:
+
+```text
+172.27.0.0/16
+```
+
 ---
 
 ## Runtime-Published Ports
@@ -239,6 +264,13 @@ The current Docker runtime includes these host-published ports.
 | Jitsi JVB | `10000/udp` | `10000/udp` | Allowed | Required media bridge traffic |
 | Xray | `32443` | `8080` | Allowed | Public tunneling endpoint |
 
+Nextcloud runtime exposure from the 2026-07-08 snapshot:
+
+* `nextcloud` exposes `80/tcp` only inside Docker and is routed through Nginx Proxy Manager.
+* `nextcloud-db` exposes `5432/tcp` only inside Docker.
+* `nextcloud-redis` exposes `6379/tcp` only inside Docker.
+* No host-published ports were shown for the Nextcloud stack.
+
 Additional UFW allowed ports with no matching Docker-published service in the 2026-06-24 Docker snapshot:
 
 * `8080/tcp`
@@ -266,6 +298,7 @@ Internet
         -> Xray
         -> Jitsi Web
         -> BaGet
+        -> Nextcloud
 
 internal network
   -> PostgreSQL
@@ -277,6 +310,7 @@ isolated networks
   -> xray_default
   -> gitea-runner_default
   -> monitoring stack network
+  -> nextcloud_nextcloud_internal
 ```
 
 ---
@@ -310,6 +344,7 @@ Periodically verify:
 * UFW-only allowed ports have documented owners
 * Prometheus targets remain healthy
 * Grafana datasource connection remains healthy
+* Nextcloud remains routed through Nginx Proxy Manager without host-published database or Redis ports
 * Unused Docker networks are removed only after confirming they are not active dependencies
 
 ---