Document Nextcloud deployment and Infisical secrets
This commit is contained in:
+61
-36
@@ -2,9 +2,11 @@
|
||||
|
||||
## Overview
|
||||
|
||||
SilverLinux uses Infisical for centralized secret management. Secrets are injected into Compose stacks at runtime by `infisical run`.
|
||||
SilverLinux uses Infisical for centralized secret management. Secrets are injected into standard Compose stacks at runtime by `slcompose`, which wraps `infisical run`.
|
||||
|
||||
This repository no longer depends on a local `/srv/secrets/company.env` file for deployed services.
|
||||
This repository no longer depends on a local `/srv/secrets/company.env` file for deployed services. If that file still exists on the server, remove it after confirming all required values are present in Infisical.
|
||||
|
||||
Sentry is the only documented exception to the standard pattern. It follows the upstream self-hosted Sentry installation model because it is a much larger multi-service application.
|
||||
|
||||
---
|
||||
|
||||
@@ -18,12 +20,12 @@ The Infisical deployment flow provides a single source of truth for:
|
||||
* OAuth client secrets
|
||||
* Future API keys
|
||||
|
||||
Applications should load secrets using Infisical injection at deployment time.
|
||||
Applications should load secrets using Infisical injection at deployment time through `slcompose`.
|
||||
|
||||
Example:
|
||||
|
||||
```bash
|
||||
infisical run --path=/ --recursive -- docker compose up -d
|
||||
slcompose up gitea
|
||||
```
|
||||
|
||||
---
|
||||
@@ -119,6 +121,40 @@ Used by:
|
||||
|
||||
---
|
||||
|
||||
### Nextcloud
|
||||
|
||||
```text
|
||||
NEXTCLOUD_ADMIN_USER
|
||||
NEXTCLOUD_ADMIN_PASSWORD
|
||||
POSTGRES_DB
|
||||
POSTGRES_USER
|
||||
POSTGRES_PASSWORD
|
||||
SMTP_HOST
|
||||
SMTP_PORT
|
||||
SMTP_USERNAME
|
||||
SMTP_PASSWORD
|
||||
```
|
||||
|
||||
Used by:
|
||||
|
||||
* Nextcloud
|
||||
* Nextcloud PostgreSQL
|
||||
* Nextcloud notification email
|
||||
|
||||
Infisical path:
|
||||
|
||||
```text
|
||||
/nextcloud
|
||||
```
|
||||
|
||||
Notes:
|
||||
|
||||
* The 2026-07-08 runtime snapshot showed `/srv/docker/nextcloud/.env` present on the server.
|
||||
* Do not commit the raw `.env` file or `config.php`.
|
||||
* `config.php` includes high-sensitivity values such as `secret`, `passwordsalt`, database credentials and SMTP credentials.
|
||||
|
||||
---
|
||||
|
||||
### Future OAuth
|
||||
|
||||
```text
|
||||
@@ -140,22 +176,21 @@ Future use:
|
||||
|
||||
---
|
||||
|
||||
### DbGate Credential Migration
|
||||
|
||||
The running DbGate deployment currently has its login credential in the server-side Compose configuration. Move the password to:
|
||||
### Sentry Exception
|
||||
|
||||
```text
|
||||
/srv/secrets/company.env
|
||||
DBGATE_PASSWORD
|
||||
Sentry self-hosted installer secrets
|
||||
```
|
||||
|
||||
The repository Compose definition already references `DBGATE_PASSWORD` and contains no real password.
|
||||
Used by:
|
||||
|
||||
Status:
|
||||
* Sentry
|
||||
|
||||
```text
|
||||
Migration pending
|
||||
```
|
||||
Notes:
|
||||
|
||||
* Sentry does not follow the same simple `slcompose` + Infisical pattern as the other SilverLinux services.
|
||||
* Keep Sentry secrets out of this repository.
|
||||
* Document any Sentry-specific backup or restore requirements in [docs/sentry.md](sentry.md).
|
||||
|
||||
---
|
||||
|
||||
@@ -163,7 +198,7 @@ Migration pending
|
||||
|
||||
* Never commit secrets to Git.
|
||||
* Never store passwords directly in docker-compose files.
|
||||
* Never share the contents of company.env.
|
||||
* Never share Infisical exports, tokens or raw service `.env` files.
|
||||
* Use environment variables whenever possible.
|
||||
* Use `.env.example` files for documentation.
|
||||
* Rotate credentials immediately if exposure is suspected.
|
||||
@@ -172,13 +207,13 @@ Migration pending
|
||||
|
||||
## Backup Requirements
|
||||
|
||||
The following file must be included in server backups:
|
||||
Backups must preserve the ability to recover Infisical-managed secrets.
|
||||
|
||||
```text
|
||||
/srv/secrets/company.env
|
||||
Infisical project data and service secret paths
|
||||
```
|
||||
|
||||
Loss of this file may prevent applications from starting correctly.
|
||||
Loss of the Infisical secret source may prevent applications from starting correctly.
|
||||
|
||||
---
|
||||
|
||||
@@ -186,32 +221,22 @@ Loss of this file may prevent applications from starting correctly.
|
||||
|
||||
If the server must be rebuilt:
|
||||
|
||||
1. Restore `/srv/secrets/company.env`
|
||||
2. Verify file permissions
|
||||
3. Deploy Docker stacks
|
||||
4. Verify services can access required variables
|
||||
5. Verify SMTP functionality
|
||||
6. Verify database connectivity
|
||||
1. Restore or reauthorize Infisical access.
|
||||
2. Verify `/etc/infisical/token` and any required Infisical domain configuration.
|
||||
3. Deploy Docker stacks through `slcompose`.
|
||||
4. Verify services can access required variables.
|
||||
5. Verify SMTP functionality.
|
||||
6. Verify database connectivity.
|
||||
|
||||
---
|
||||
|
||||
## Security Notes
|
||||
|
||||
The secrets file contains credentials for multiple services.
|
||||
Infisical contains credentials for multiple services.
|
||||
|
||||
Access should be restricted to system administrators only.
|
||||
|
||||
Recommended permissions:
|
||||
|
||||
```bash
|
||||
chmod 600 /srv/secrets/company.env
|
||||
```
|
||||
|
||||
Recommended ownership:
|
||||
|
||||
```bash
|
||||
root:root
|
||||
```
|
||||
The local Infisical token under `/etc/infisical/token` must be protected with root-only permissions.
|
||||
|
||||
---
|
||||
|
||||
|
||||
Reference in New Issue
Block a user