Document Nextcloud deployment and Infisical secrets
This commit is contained in:
@@ -0,0 +1,338 @@
|
||||
# Nextcloud
|
||||
|
||||
## Overview
|
||||
|
||||
Nextcloud is deployed on SilverLinux as the private cloud storage and file sharing service for Silver Solutions.
|
||||
|
||||
Status:
|
||||
|
||||
```text
|
||||
Operational
|
||||
```
|
||||
|
||||
Public URL:
|
||||
|
||||
```text
|
||||
https://cloud.silveressence.net
|
||||
```
|
||||
|
||||
Verified runtime snapshot:
|
||||
|
||||
```text
|
||||
2026-07-08 13:21:13 +02:00
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Runtime Stack
|
||||
|
||||
Location:
|
||||
|
||||
```text
|
||||
/srv/docker/nextcloud
|
||||
```
|
||||
|
||||
Files present on the server:
|
||||
|
||||
```text
|
||||
/srv/docker/nextcloud/docker-compose.yml
|
||||
/srv/docker/nextcloud/.env
|
||||
```
|
||||
|
||||
The `.env` file was present in the 2026-07-08 snapshot, but passwords should come from Infisical through `slcompose`. Remove any secret values from this file if they still exist.
|
||||
|
||||
Management:
|
||||
|
||||
* Docker Compose stack name: `nextcloud`
|
||||
* Managed by `slcompose`
|
||||
* Secrets injected at runtime through Infisical
|
||||
* Restart policy: `unless-stopped`
|
||||
|
||||
---
|
||||
|
||||
## Containers
|
||||
|
||||
| Container | Image | Purpose | Status at snapshot |
|
||||
| --- | --- | --- | --- |
|
||||
| `nextcloud` | `nextcloud:29-apache` | Web UI, file storage and application runtime | Up 6 days |
|
||||
| `nextcloud-db` | `postgres:16` | Nextcloud PostgreSQL database | Up 6 days |
|
||||
| `nextcloud-redis` | `redis:7-alpine` | Redis cache and locking backend | Up 6 days |
|
||||
|
||||
Nextcloud application status:
|
||||
|
||||
```text
|
||||
installed: true
|
||||
version: 29.0.16
|
||||
maintenance: false
|
||||
needsDbUpgrade: false
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Networking
|
||||
|
||||
Networks:
|
||||
|
||||
* `proxy`
|
||||
* `nextcloud_nextcloud_internal`
|
||||
|
||||
Network roles:
|
||||
|
||||
* `proxy` connects `nextcloud` to Nginx Proxy Manager.
|
||||
* `nextcloud_nextcloud_internal` connects `nextcloud`, `nextcloud-db` and `nextcloud-redis`.
|
||||
* `nextcloud-db` and `nextcloud-redis` are internal-only and are not attached to `proxy`.
|
||||
|
||||
Verified subnet:
|
||||
|
||||
```text
|
||||
nextcloud_nextcloud_internal: 172.27.0.0/16
|
||||
```
|
||||
|
||||
Port exposure:
|
||||
|
||||
* `nextcloud` exposes `80/tcp` only inside Docker.
|
||||
* `nextcloud-db` exposes `5432/tcp` only inside Docker.
|
||||
* `nextcloud-redis` exposes `6379/tcp` only inside Docker.
|
||||
* No Nextcloud stack ports were published to the host in the runtime snapshot.
|
||||
|
||||
Routing:
|
||||
|
||||
```text
|
||||
Internet
|
||||
-> Nginx Proxy Manager
|
||||
-> proxy network
|
||||
-> nextcloud:80
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Domain And Proxy
|
||||
|
||||
Domain:
|
||||
|
||||
```text
|
||||
cloud.silveressence.net
|
||||
```
|
||||
|
||||
Nextcloud trusted domain:
|
||||
|
||||
```text
|
||||
cloud.silveressence.net
|
||||
```
|
||||
|
||||
Reverse proxy settings observed in the application configuration:
|
||||
|
||||
```text
|
||||
overwritehost: cloud.silveressence.net
|
||||
overwriteprotocol: https
|
||||
trusted_proxies: 172.16.0.0/12
|
||||
```
|
||||
|
||||
Nginx Proxy Manager proxy host 13 forwards requests to `nextcloud`.
|
||||
|
||||
Proxy host settings from the 2026-07-08 Nginx Proxy Manager database query:
|
||||
|
||||
| Setting | Value |
|
||||
| --- | --- |
|
||||
| Forward scheme | `http` |
|
||||
| Forward host | `nextcloud` |
|
||||
| Forward port | `80` |
|
||||
| SSL Force | disabled |
|
||||
| HTTP/2 | disabled |
|
||||
| HSTS | disabled |
|
||||
| HSTS subdomains | disabled |
|
||||
| Block Exploits | enabled |
|
||||
| WebSocket | enabled |
|
||||
| Access List | none |
|
||||
| Status | enabled |
|
||||
|
||||
---
|
||||
|
||||
## Persistent Data
|
||||
|
||||
Docker volumes:
|
||||
|
||||
| Volume | Mount point | Purpose |
|
||||
| --- | --- | --- |
|
||||
| `nextcloud_nextcloud_data` | `/var/www/html` | Nextcloud application files, config, apps and user data directory |
|
||||
| `nextcloud_nextcloud_db` | `/var/lib/next-cloud-postgresDb/data` | PostgreSQL data for Nextcloud |
|
||||
|
||||
Host mountpoints:
|
||||
|
||||
```text
|
||||
/var/lib/docker/volumes/nextcloud_nextcloud_data/_data
|
||||
/var/lib/docker/volumes/nextcloud_nextcloud_db/_data
|
||||
```
|
||||
|
||||
Application data directory:
|
||||
|
||||
```text
|
||||
/var/www/html/data
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Database
|
||||
|
||||
Database type:
|
||||
|
||||
```text
|
||||
pgsql
|
||||
```
|
||||
|
||||
Database host:
|
||||
|
||||
```text
|
||||
nextcloud-db
|
||||
```
|
||||
|
||||
Database image:
|
||||
|
||||
```text
|
||||
postgres:16
|
||||
```
|
||||
|
||||
Operational note:
|
||||
|
||||
PostgreSQL is pinned to version 16 for this stack. During initial deployment, the database volume was initialized with PostgreSQL 16 and therefore must not be started with PostgreSQL 17 without a proper PostgreSQL major-version upgrade.
|
||||
|
||||
---
|
||||
|
||||
## Redis
|
||||
|
||||
Redis host:
|
||||
|
||||
```text
|
||||
nextcloud-redis
|
||||
```
|
||||
|
||||
Port:
|
||||
|
||||
```text
|
||||
6379
|
||||
```
|
||||
|
||||
Purpose:
|
||||
|
||||
* Cache backend
|
||||
* File locking support
|
||||
* Internal application performance support
|
||||
|
||||
---
|
||||
|
||||
## Email
|
||||
|
||||
Nextcloud SMTP is configured.
|
||||
|
||||
Observed application mail settings:
|
||||
|
||||
```text
|
||||
mail_smtphost: smtp.gmail.com
|
||||
mail_smtpport: 465
|
||||
mail_smtpsecure: ssl
|
||||
mail_from_address: noreply
|
||||
mail_domain: silveressence.net
|
||||
```
|
||||
|
||||
Sender:
|
||||
|
||||
```text
|
||||
noreply@silveressence.net
|
||||
```
|
||||
|
||||
Credentials must remain in Infisical and must not be committed.
|
||||
|
||||
---
|
||||
|
||||
## Secrets
|
||||
|
||||
Required secret values include:
|
||||
|
||||
* `NEXTCLOUD_ADMIN_USER`
|
||||
* `NEXTCLOUD_ADMIN_PASSWORD`
|
||||
* `POSTGRES_DB`
|
||||
* `POSTGRES_USER`
|
||||
* `POSTGRES_PASSWORD`
|
||||
* SMTP credentials if not inherited from shared mail configuration
|
||||
|
||||
Security note:
|
||||
|
||||
Nextcloud `config.php` contains sensitive values such as `secret`, `passwordsalt`, database credentials and SMTP credentials. Do not paste the raw file into public channels and rotate any exposed credentials.
|
||||
|
||||
---
|
||||
|
||||
## Backup Requirements
|
||||
|
||||
Back up these items:
|
||||
|
||||
* `nextcloud_nextcloud_data`
|
||||
* `nextcloud_nextcloud_db`
|
||||
* `/srv/docker/nextcloud/docker-compose.yml`
|
||||
* `/srv/docker/nextcloud/.env` only if it contains non-secret runtime configuration
|
||||
* Infisical secrets for the `/nextcloud` path
|
||||
|
||||
The `nextcloud_nextcloud_data` volume includes the application config and user uploaded files. The `nextcloud_nextcloud_db` volume contains the metadata database and should also be backed up with a logical PostgreSQL dump where possible.
|
||||
|
||||
See [docs/backups.md](backups.md) for the backup recipe and restore order.
|
||||
|
||||
---
|
||||
|
||||
## Operational Commands
|
||||
|
||||
Check stack status:
|
||||
|
||||
```bash
|
||||
docker ps --filter "name=nextcloud"
|
||||
```
|
||||
|
||||
Check Nextcloud application status:
|
||||
|
||||
```bash
|
||||
docker exec -u www-data nextcloud php -f /var/www/html/occ status
|
||||
```
|
||||
|
||||
Check selected config values:
|
||||
|
||||
```bash
|
||||
docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get trusted_domains
|
||||
docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get overwritehost
|
||||
docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get overwriteprotocol
|
||||
```
|
||||
|
||||
Manage through slcompose:
|
||||
|
||||
```bash
|
||||
slcompose up nextcloud
|
||||
slcompose restart nextcloud
|
||||
slcompose logs nextcloud
|
||||
slcompose logs-tail nextcloud 200
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Verification Evidence
|
||||
|
||||
The 2026-07-08 server output verified:
|
||||
|
||||
* Hostname `silverlinux`
|
||||
* Containers `nextcloud`, `nextcloud-db` and `nextcloud-redis` running
|
||||
* Compose files present under `/srv/docker/nextcloud`
|
||||
* Public domain `cloud.silveressence.net`
|
||||
* Nextcloud version `29.0.16`
|
||||
* Maintenance mode disabled
|
||||
* Database upgrade not required
|
||||
* PostgreSQL backend at `nextcloud-db`
|
||||
* Redis backend at `nextcloud-redis`
|
||||
* Docker volumes `nextcloud_nextcloud_data` and `nextcloud_nextcloud_db`
|
||||
* No host-published ports for the Nextcloud stack
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
* [docs/services.md](services.md)
|
||||
* [docs/domains.md](domains.md)
|
||||
* [docs/network.md](network.md)
|
||||
* [docs/security.md](security.md)
|
||||
* [docs/backups.md](backups.md)
|
||||
* [docs/secrets.md](secrets.md)
|
||||
Reference in New Issue
Block a user