Document Nextcloud deployment and Infisical secrets
This commit is contained in:
+20
-6
@@ -101,7 +101,7 @@ Planned improvements:
|
||||
Shared secrets are stored in:
|
||||
|
||||
```text
|
||||
/srv/secrets/company.env
|
||||
Infisical
|
||||
```
|
||||
|
||||
Examples:
|
||||
@@ -117,6 +117,7 @@ Rules:
|
||||
* Never commit secrets to Git
|
||||
* Never share secrets in documentation
|
||||
* Never hardcode passwords in Docker Compose files
|
||||
* Remove `/srv/secrets/company.env` if it still exists after confirming all values are present in Infisical
|
||||
|
||||
See:
|
||||
|
||||
@@ -149,12 +150,14 @@ Publicly exposed services:
|
||||
* Xray
|
||||
* Jitsi Web
|
||||
* BaGet
|
||||
* Nextcloud
|
||||
|
||||
High-sensitivity exposure:
|
||||
|
||||
* DbGate exposes a database administration interface and must always require authentication and HTTPS.
|
||||
* Xray exposes tunneling capability and must be monitored for abuse, unexpected traffic and unauthorized use.
|
||||
* Portainer exposes Docker management and must be restricted to trusted administrators.
|
||||
* Nextcloud exposes private file storage and must require strong user authentication, HTTPS and prompt security updates.
|
||||
|
||||
Nginx Proxy Manager findings from the 2026-06-24 proxy-host snapshot:
|
||||
|
||||
@@ -164,12 +167,14 @@ Nginx Proxy Manager findings from the 2026-06-24 proxy-host snapshot:
|
||||
* Plane.so has been removed from containers, Nginx Proxy Manager and server certificate storage.
|
||||
* `cicd.silveressence.net` is intentionally enabled as a frequently changing prototype deployment endpoint.
|
||||
* `exactsyncer.silveressence.net` is intentionally enabled as a client-facing Exact Online syncer demo endpoint.
|
||||
* `cloud.silveressence.net` is enabled for Nextcloud with WebSocket and Block Exploits enabled, but SSL Force, HTTP/2 and HSTS disabled and no access list.
|
||||
|
||||
Priority hardening:
|
||||
|
||||
1. Enable SSL Force for all HTTPS public service routes unless there is a documented exception.
|
||||
2. Add an access list or equivalent restriction for DbGate and Portainer.
|
||||
3. Define explicit exposure and authentication expectations for prototype and demo endpoints.
|
||||
2. Enable SSL Force, HTTP/2 and HSTS for Nextcloud unless there is a documented exception.
|
||||
3. Add an access list or equivalent restriction for DbGate and Portainer.
|
||||
4. Define explicit exposure and authentication expectations for prototype and demo endpoints.
|
||||
|
||||
---
|
||||
|
||||
@@ -180,7 +185,7 @@ Outgoing email is provided through Gmail SMTP.
|
||||
Credentials are stored in:
|
||||
|
||||
```text
|
||||
/srv/secrets/company.env
|
||||
Infisical
|
||||
```
|
||||
|
||||
Requirements:
|
||||
@@ -214,7 +219,7 @@ Future OAuth providers:
|
||||
|
||||
Requirements:
|
||||
|
||||
* Store client secrets in company.env
|
||||
* Store client secrets in Infisical
|
||||
* Use least-privilege scopes
|
||||
* Disable unused authentication providers
|
||||
|
||||
@@ -259,6 +264,10 @@ Applications and DbGate communicate with the database containers through the `in
|
||||
|
||||
DbGate is the public administration entry point and must require authentication and HTTPS. Its web interface is routed through Nginx Proxy Manager; database ports `5432` and `1433` remain private.
|
||||
|
||||
Nextcloud uses a stack-local PostgreSQL container named `nextcloud-db` on `nextcloud_nextcloud_internal`. Its `5432/tcp` port is not published to the host and is not routed through Nginx Proxy Manager.
|
||||
|
||||
Nextcloud Redis uses `nextcloud-redis` on `nextcloud_nextcloud_internal`. Its `6379/tcp` port is not published to the host.
|
||||
|
||||
---
|
||||
|
||||
## Connectivity Layer Security
|
||||
@@ -292,6 +301,7 @@ Networks:
|
||||
* jitsi-docker-jitsi-meet-aa76415_meet.jitsi
|
||||
* xray_default
|
||||
* gitea-runner_default
|
||||
* nextcloud_nextcloud_internal
|
||||
|
||||
Network model:
|
||||
|
||||
@@ -299,6 +309,7 @@ Network model:
|
||||
* `proxy` is for public HTTP and HTTPS services controlled by Nginx Proxy Manager.
|
||||
* Isolated stack networks are used for Jitsi, Xray and CI/CD runner separation.
|
||||
* `xray_default` currently exists without a running container attached; the active `xray` container is attached to `proxy`.
|
||||
* `nextcloud_nextcloud_internal` isolates Nextcloud database and Redis traffic from the public proxy layer.
|
||||
|
||||
---
|
||||
|
||||
@@ -345,6 +356,9 @@ Periodically verify:
|
||||
* DbGate login is enforced
|
||||
* DbGate proxy route has SSL Force and an access restriction policy
|
||||
* Xray exposure policy is still valid
|
||||
* Nextcloud security advisories are reviewed and the image is updated promptly
|
||||
* Nextcloud database and Redis ports remain internal-only
|
||||
* Nextcloud proxy route uses HTTPS with SSL Force, HTTP/2 and HSTS enabled unless there is a documented exception
|
||||
* Public services are still routed only through Nginx Proxy Manager
|
||||
* Removed proxy hosts and unused certificates stay removed unless explicitly approved
|
||||
* Prototype and demo proxy hosts have documented owners and exposure expectations
|
||||
@@ -362,7 +376,7 @@ Periodically verify:
|
||||
If a credential is exposed:
|
||||
|
||||
1. Rotate the credential immediately.
|
||||
2. Update `/srv/secrets/company.env`.
|
||||
2. Rotate or update the value in Infisical.
|
||||
3. Restart affected services.
|
||||
4. Review logs for unauthorized access.
|
||||
5. Update documentation if required.
|
||||
|
||||
Reference in New Issue
Block a user