Document Nextcloud deployment and Infisical secrets

docs/server.md

@@ -168,6 +168,7 @@ Examples:
 * Grafana
 * Node Exporter
 * cAdvisor
+* Nextcloud
 
 ---
 
@@ -194,6 +195,7 @@ Contains:
 /srv/docker/dbgate
 /srv/docker/xray
 /srv/docker/monitoring
+/srv/docker/nextcloud
 ```
 
 ---
@@ -201,7 +203,7 @@ Contains:
 ### Shared Secrets
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Contains:
@@ -210,9 +212,13 @@ Contains:
 * Database passwords
 * Application secrets
 * MSSQL SA password
-* Future DbGate password
+* DbGate password
 * Future OAuth credentials
 
+Legacy note:
+
+* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists.
+
 ---
 
 ### Backups
@@ -342,6 +348,31 @@ The `xray_default` network exists, but the running `xray` container was attached
 
 ---
 
+### Nextcloud
+
+```text
+/srv/docker/nextcloud
+```
+
+Volumes:
+
+```text
+nextcloud_nextcloud_data
+nextcloud_nextcloud_db
+```
+
+Domain:
+
+```text
+cloud.silveressence.net
+```
+
+Runtime note:
+
+The 2026-07-08 runtime snapshot showed `nextcloud`, `nextcloud-db` and `nextcloud-redis` running with no host-published ports. The web container is routed through Nginx Proxy Manager on the `proxy` network; PostgreSQL and Redis stay on `nextcloud_nextcloud_internal`.
+
+---
+
 ### Monitoring Stack
 
 ```text
@@ -390,6 +421,7 @@ Implemented:
 * SSL certificates managed through Nginx Proxy Manager
 * PostgreSQL not exposed publicly
 * MSSQL port 1433 not exposed publicly
+* Nextcloud PostgreSQL and Redis not exposed publicly
 * Database administration is available only through authenticated HTTPS access to DbGate
 * Xray is not attached to the private database network and is monitored as a tunneling endpoint
 * OpenID disabled in Gitea
@@ -407,13 +439,14 @@ noreply@silveressence.net
 SMTP credentials are stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Used by:
 
 * Gitea
 * OpenProject
+* Nextcloud
 
 ---