Document Nextcloud deployment and Infisical secrets

README.md

@@ -41,15 +41,14 @@ SilverLinux is the primary self-hosted platform for Silver Solutions and hosts s
 * Node Exporter
 * cAdvisor
 * Alertmanager
+* Nextcloud
 
 ### Planned
 
-* Nextcloud
 * Loki
 * Redis
 * Authelia
 * CrowdSec
-* Sentry
 * Restic
 * Harbor
 * SonarQube
@@ -129,6 +128,7 @@ Secrets are managed centrally through Infisical and injected at runtime by the s
 baget/
 dbgate/
 docs/
+docs/nextcloud.md
 gitea/
 jitsi/
 mssql/
@@ -176,7 +176,8 @@ Never commit:
 * SSL Private Keys
 * Database Credentials
 * Real `.env` files
-* `/srv/secrets/company.env`
+* Infisical tokens
+* Sentry upstream installer secrets
 
 Use example files whenever possible.
 

SUMMARY.md

@@ -1,6 +1,6 @@
 # SilverLinux Infrastructure Summary
 
-Last Updated: 2026-06-25
+Last Updated: 2026-07-08
 
 ## Overview
 
@@ -22,6 +22,7 @@ Monitoring, alerting, automated backups and restore validation are now productio
 | Jitsi Meet  | https://meet.silveressence.net      |
 | BaGet       | https://nuget.silveressence.net     |
 | DbGate      | https://dbgate.silveressence.net    |
+| Nextcloud   | https://cloud.silveressence.net     |
 | Xray        | Public tunneling endpoint           |
 
 ---
@@ -259,6 +260,34 @@ Status:
 
 ---
 
+### Nextcloud
+
+Purpose:
+
+* Private cloud storage
+* File sharing
+* Team document storage
+
+Access:
+
+* https://cloud.silveressence.net
+* HTTPS through Nginx Proxy Manager
+* Nextcloud user authentication required
+
+Runtime:
+
+* `nextcloud:29-apache`
+* `postgres:16`
+* `redis:7-alpine`
+* Data volume `nextcloud_nextcloud_data`
+* Database volume `nextcloud_nextcloud_db`
+
+Status:
+
+* Operational
+
+---
+
 ### Xray
 
 Purpose:
@@ -307,10 +336,10 @@ Purpose:
 
 ### Shared Secrets
 
-Location:
+Primary source:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Contains:
@@ -319,10 +348,19 @@ Contains:
 * PostgreSQL passwords
 * MSSQL SA password
 * OpenProject secrets
-* Future DbGate password
+* DbGate password
+* Nextcloud secrets
 * Future OAuth secrets
 
-This file must never be committed to Git.
+Secrets are injected into standard SilverLinux Compose stacks at runtime through `slcompose`.
+
+Exception:
+
+* Sentry follows its upstream self-hosted installer pattern because it is a much larger multi-service application.
+
+Legacy note:
+
+* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists on the server.
 
 ---
 
@@ -338,12 +376,14 @@ Plane.so was removed to reduce maintenance complexity and duplicate functionalit
 
 ### Centralized Secrets
 
-All shared credentials are stored in:
+All standard service credentials are stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
+They are injected by `slcompose` at runtime. Sentry is the exception and follows the default self-hosted Sentry installation model.
+
 ### Xray Connectivity Layer
 
 Xray is classified as a tunneling and connectivity layer rather than an application backend.
@@ -380,7 +420,6 @@ Completed:
 ### Phase 2 - Security And Stability
 
 * CrowdSec
-* Sentry
 * Fail2Ban upgrade
 * Cloudflare rate limiting and WAF
 
@@ -388,13 +427,13 @@ Completed:
 
 * Backup v5.3 automation
 * Restore validation
+* Sentry
 
 ### Phase 3 - Scale And Enterprise Services
 
 * SonarQube
 * Harbor Docker registry
 * Backstage portal
-* Nextcloud
 
 ---
 

baget/README.md

@@ -72,12 +72,12 @@ It is stored under **Repository Settings -> Actions -> Secrets** and must never
 
 The end-to-end Gitea Actions to BaGet publishing pipeline is operational.
 
-### Future Improvement
+### Secret Management
 
-BaGet configuration should eventually be migrated to:
+BaGet runtime secrets should be managed through:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
-to centralize secret management across SilverLinux services.
+This keeps BaGet aligned with the standard SilverLinux `slcompose` deployment pattern. The repository must not contain the real BaGet API key.

dbgate/README.md

@@ -55,13 +55,13 @@ Only DbGate is publicly accessible. MSSQL port `1433` and PostgreSQL port `5432`
 
 DbGate requires a username and password before granting access. The initial unauthenticated deployment was corrected by configuring `LOGIN` and `PASSWORD`.
 
-The running server currently stores the DbGate credentials directly in its Compose configuration. The repository intentionally does not contain the password; its Compose definition resolves `DBGATE_PASSWORD` from the deployment environment.
+The DbGate password is supplied through Infisical at runtime. The repository intentionally does not contain the password; its Compose definition resolves `DBGATE_PASSWORD` from the deployment environment.
 
-Planned improvement:
+Operational requirement:
 
-* Add `DBGATE_PASSWORD` to `/srv/secrets/company.env`.
+* Keep `DBGATE_PASSWORD` in the DbGate Infisical path.
-* Deploy with `docker compose --env-file /srv/secrets/company.env up -d`.
+* Deploy through `slcompose` so the value is injected before Docker Compose evaluates the environment.
-* Remove the credential from the server-side Compose file.
+* Remove any legacy plaintext credential from the server-side Compose file if it still exists.
 
 ---
 
@@ -120,7 +120,7 @@ Back up:
 /srv/docker/dbgate/data
 ```
 
-Also retain the Compose definition, Nginx Proxy Manager configuration and DbGate credential through the centralized secrets backup after migration.
+Also retain the Compose definition, Nginx Proxy Manager configuration and DbGate credential through Infisical recovery.
 
 ---
 

docs/AI_CONTEXT.md

@@ -35,6 +35,7 @@ Public IP: 51.255.83.140
 * Node Exporter
 * cAdvisor
 * Alertmanager
+* Nextcloud
 
 ## Domains
 
@@ -52,13 +53,19 @@ dbgate.silveressence.net -> DbGate (through Nginx Proxy Manager)
 
 sentry.silveressence.net -> Sentry (through Nginx Proxy Manager)
 
+cloud.silveressence.net -> Nextcloud (through Nginx Proxy Manager)
+
 Xray -> Public tunneling endpoint through proxy network
 
 ## Secrets
 
 Secrets are stored in Infisical and injected at runtime via the **slcompose orchestrator**.
 
-Never hardcode credentials. All services receive environment variables through Infisical's secret injection at container startup.
+Never hardcode credentials. Standard SilverLinux services receive environment variables through Infisical's secret injection at container startup.
+
+Sentry is the exception because it is a much larger upstream self-hosted application and follows the default Sentry installation pattern.
+
+Legacy note: `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists on the server.
 
 ### Secret Injection Flow
 
@@ -99,6 +106,8 @@ gitea-runner_default
 
 MSSQL is attached only to `internal`. DbGate is attached to both `internal` and `proxy`.
 
+Nextcloud is attached to `proxy` and `nextcloud_nextcloud_internal`. Its PostgreSQL and Redis containers are attached only to `nextcloud_nextcloud_internal`.
+
 Jitsi uses `jitsi-docker-jitsi-meet-aa76415_meet.jitsi` for its internal cluster and `proxy` for web access. Xray is currently attached to `proxy`; `xray_default` exists but had no running containers attached in the 2026-06-24 runtime snapshot.
 
 ## Authentication
@@ -122,7 +131,7 @@ The global self-hosted runner is operational at `/srv/docker/gitea-runner` with
 
 Silver 2.0 uses `.gitea/workflows/package.yml` to publish NuGet packages to BaGet when a push to `net-8-version` has a commit message containing `[Package]`.
 
-The runner registration token is stored in `/srv/secrets/company.env`. The BaGet publishing key is stored as the repository Actions secret `BAGET_API_KEY`.
+The runner registration token is stored in Infisical. The BaGet publishing key is stored as the repository Actions secret `BAGET_API_KEY`.
 
 ## Databases
 
@@ -207,8 +216,10 @@ Roadmap:
 * Phase 1 completed: Grafana, Prometheus, Node Exporter, cAdvisor, Alertmanager, backup metrics integration, incident intelligence
 * Phase 1 remaining: Loki, Redis, Authelia
 * Phase 2 completed: Backup v5.3 automation, restore validation
-* Phase 2 remaining: CrowdSec, Sentry, Fail2Ban upgrade, Cloudflare rate limiting and WAF
+* Phase 2 completed: Sentry
-* Phase 3: SonarQube, Harbor, Backstage, Nextcloud
+* Phase 2 remaining: CrowdSec, Fail2Ban upgrade, Cloudflare rate limiting and WAF
+* Phase 3 completed: Nextcloud
+* Phase 3 remaining: SonarQube, Harbor, Backstage
 
 See:
 
@@ -229,3 +240,4 @@ docs/roadmap.md
 * DbGate selected as the database administration portal
 * Xray introduced as a tunneling and connectivity layer
 * Multi-network segmentation formalized: internal, proxy and isolated infrastructure networks
+* Nextcloud deployed as the private cloud storage service at cloud.silveressence.net

docs/backups.md

@@ -120,7 +120,7 @@ Required:
 
 * Native SQL Server database backups
 * MSSQL Compose configuration
-* `MSSQL_SA_PASSWORD` from the shared secrets backup
+* `MSSQL_SA_PASSWORD` from Infisical recovery data
 * Runtime MSSQL data included by the v1.5+ backup structure
 
 Importance:
@@ -174,10 +174,10 @@ Critical
 
 #### Shared Secrets
 
-Location:
+Source:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Contains:
@@ -186,14 +186,58 @@ Contains:
 * PostgreSQL passwords
 * MSSQL SA password
 * OpenProject secrets
-* Future DbGate password
+* DbGate password
 * Future OAuth secrets
 
 Importance:
 
 Critical
 
-Without this file applications may not start correctly.
+Without Infisical recovery and `/etc/infisical/token` reauthorization, applications may not start correctly.
+
+Legacy note:
+
+* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists.
+
+---
+
+#### Nextcloud
+
+Volumes:
+
+```text
+nextcloud_nextcloud_data
+nextcloud_nextcloud_db
+```
+
+Compose location:
+
+```text
+/srv/docker/nextcloud
+```
+
+Contains:
+
+* Uploaded files and user data
+* Nextcloud application configuration
+* Installed apps and themes
+* PostgreSQL metadata database
+* Compose configuration and environment references
+
+Required:
+
+* Logical PostgreSQL dump from `nextcloud-db`
+* Archive of `nextcloud_nextcloud_data`
+* Archive or cold snapshot of `nextcloud_nextcloud_db`
+* `/srv/docker/nextcloud/docker-compose.yml`
+* `/srv/docker/nextcloud/.env` only if it contains non-secret runtime configuration
+* Infisical `/nextcloud` secrets
+
+Importance:
+
+Critical
+
+The 2026-07-08 runtime snapshot verified `nextcloud_nextcloud_data` and `nextcloud_nextcloud_db` as Docker-managed named volumes.
 
 ---
 
@@ -293,7 +337,7 @@ Contains:
 * Runner deployment configuration
 * Runner state
 
-The registration token is stored separately in `/srv/secrets/company.env`.
+The registration token is stored in Infisical.
 
 Importance:
 
@@ -393,6 +437,60 @@ Keep:
 7 days
 ```
 
+---
+
+## Nextcloud Backup Recipe
+
+This recipe shows practical commands to back up the operational Nextcloud PostgreSQL database and application data volume. Run these on the host where Docker runs. Adjust paths, filenames and the backup target directory as needed.
+
+1) Backup PostgreSQL (from running `nextcloud-db` container). This creates a compressed SQL dump:
+
+```bash
+# Backup directory on host
+BACKUP_DIR=/srv/backups/nextcloud
+mkdir -p "$BACKUP_DIR"
+docker exec -t nextcloud-db pg_dump -U nextcloud nextcloud | gzip > "$BACKUP_DIR/nextcloud_db_$(date +%F).sql.gz"
+```
+
+If the DB user or DB name differ from the example, use the values from the Nextcloud Infisical path or sanitized Compose config. For a full cluster dump, use `pg_dumpall` with the appropriate PostgreSQL user.
+
+2) Backup application data volume (`nextcloud_nextcloud_data`):
+
+```bash
+BACKUP_DIR=/srv/backups/nextcloud
+mkdir -p "$BACKUP_DIR"
+docker run --rm -v nextcloud_nextcloud_data:/data -v "$BACKUP_DIR":/backup alpine \
+	sh -c "cd /data && tar czf /backup/nextcloud_data_$(date +%F).tar.gz ."
+```
+
+3) Backup `docker-compose.yml` and `.env` if the `.env` file contains only non-secret runtime configuration:
+
+```bash
+cp /srv/docker/nextcloud/docker-compose.yml "$BACKUP_DIR/docker-compose.yml.$(date +%F)"
+if [ -f /srv/docker/nextcloud/.env ]; then
+  cp /srv/docker/nextcloud/.env "$BACKUP_DIR/.env.$(date +%F)"
+fi
+```
+
+Do not preserve plaintext passwords from `.env`; migrate them to Infisical and remove them from the file.
+
+4) Optional: Export Postgres data directory snapshot (cold snapshot required — stop DB or use filesystem snapshot):
+
+```bash
+# Stop DB to take a consistent file-level snapshot (or use LVM/ZFS snapshot instead)
+docker compose -f /srv/docker/nextcloud/docker-compose.yml stop nextcloud-db
+tar czf "$BACKUP_DIR/nextcloud_db_files_$(date +%F).tar.gz" -C /var/lib/docker/volumes/nextcloud_nextcloud_db/_data .
+docker compose -f /srv/docker/nextcloud/docker-compose.yml start nextcloud-db
+```
+
+5) Retention and verification
+
+- Keep backups in `/srv/backups/nextcloud` with rolling retention (e.g., daily 7, weekly 4, monthly 6).
+- Verify SQL dumps by restoring to a staging DB and checking the Nextcloud application with `occ status` and a login test.
+
+Security note: backups contain secrets (DB passwords stored in config, mail credentials in `config.php`). Protect backups with appropriate filesystem permissions and store them encrypted if possible.
+
+
 ### Weekly
 
 Keep:
@@ -427,6 +525,7 @@ Restore order:
 10. Gitea Actions Runner
 11. DbGate
 12. Xray
+13. Nextcloud
 
 ---
 
@@ -449,6 +548,8 @@ Verified:
 * OpenProject assets
 * Docker configuration
 
+Nextcloud restore validation is pending after its 2026-07-08 operational documentation update.
+
 Validation results:
 
 * MSSQL backup integrity verified
@@ -542,10 +643,10 @@ Install:
 
 ### Step 2
 
-Restore:
+Restore or reauthorize:
 
 ```text
-/srv/secrets/company.env
+Infisical access and service secret paths
 ```
 
 ### Step 3

docs/cicd.md

@@ -95,10 +95,15 @@ The complete workflow has been tested successfully and is operational.
 Runner registration token:
 
 ```text
-/srv/secrets/company.env
 GITEA_RUNNER_REGISTRATION_TOKEN
 ```
 
+Source:
+
+```text
+Infisical
+```
+
 BaGet publishing credential:
 
 ```text
@@ -106,7 +111,7 @@ Repository Settings -> Actions -> Secrets
 BAGET_API_KEY
 ```
 
-No credentials are stored in repositories. Infrastructure-level secrets belong in `company.env`; repository workflow secrets belong in Gitea Actions Secrets.
+No credentials are stored in repositories. Infrastructure-level secrets belong in Infisical; repository workflow secrets belong in Gitea Actions Secrets.
 
 ---
 

docs/decisions.md

@@ -161,12 +161,12 @@ Implemented
 
 Decision:
 
-Store shared credentials in a single secrets file.
+Originally store shared credentials in a single secrets file.
 
 Location:
 
 ```text
-/srv/secrets/company.env
+Legacy local secrets file
 ```
 
 Reason:
@@ -178,7 +178,14 @@ Reason:
 
 Status:
 
-Implemented
+Superseded by Infisical and `slcompose`
+
+Current state:
+
+* Standard SilverLinux service secrets are stored in Infisical.
+* `slcompose` injects secrets into Compose stacks at runtime.
+* The legacy local secrets file should be removed if it still exists.
+* Sentry is the exception and follows the upstream self-hosted Sentry installation pattern.
 
 ---
 
@@ -235,7 +242,7 @@ Decision:
 * Replace GitHub Actions with self-hosted Gitea Actions.
 * Execute package publishing on SilverLinux using the global `silverlinux-runner`.
 * Publish internal NuGet packages to BaGet.
-* Store the runner registration token in `/srv/secrets/company.env` and publishing credentials in Gitea Actions Secrets.
+* Store the runner registration token in Infisical and publishing credentials in Gitea Actions Secrets.
 * Use `[Package]` in commit messages to request commit-driven package publishing.
 
 Reason:
@@ -262,15 +269,15 @@ Reason:
 
 * Simplicity during initial deployment.
 
-Future Plan:
+Current Plan:
 
-Move the API key into the centralized SilverLinux secrets management system located at:
+Move the API key into the centralized SilverLinux secrets management system:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
-when additional services begin consuming the same secret management approach.
+when the BaGet deployment is fully aligned with the standard `slcompose` pattern.
 
 ---
 
@@ -281,7 +288,7 @@ Decision:
 * Run Microsoft SQL Server 2022 Express alongside PostgreSQL.
 * Attach MSSQL only to the `internal` Docker network.
 * Do not publish port `1433` or route MSSQL through the reverse proxy.
-* Store `MSSQL_SA_PASSWORD` in `/srv/secrets/company.env`.
+* Store `MSSQL_SA_PASSWORD` in Infisical.
 
 Reason:
 
@@ -312,7 +319,7 @@ Reason:
 
 Follow-up:
 
-Move the DbGate password from the server-side Compose configuration to `/srv/secrets/company.env`.
+Move the DbGate password from any legacy server-side Compose configuration to Infisical.
 
 Status:
 
@@ -447,6 +454,10 @@ Status:
 Accepted
 ```
 
+Current status:
+
+* Sentry is now implemented and documented as the exception to the standard `slcompose` + Infisical service pattern.
+
 ---
 
 ## 2026-06-25 - Select Prometheus And Grafana Monitoring Stack
@@ -583,6 +594,37 @@ Implemented
 
 ---
 
+## 2026-07-08 - Deploy Nextcloud For Private Cloud Storage
+
+Decision:
+
+Deploy Nextcloud as the SilverLinux private cloud storage and file sharing service at `cloud.silveressence.net`.
+
+Implementation:
+
+* Run `nextcloud:29-apache` as the web application container.
+* Run `postgres:16` as the stack-local Nextcloud database.
+* Run `redis:7-alpine` as the stack-local cache and locking backend.
+* Attach only the web container to `proxy`.
+* Keep PostgreSQL and Redis on `nextcloud_nextcloud_internal`.
+* Persist data in `nextcloud_nextcloud_data` and `nextcloud_nextcloud_db`.
+* Manage the stack from `/srv/docker/nextcloud` with `slcompose` and Infisical secret injection.
+
+Reason:
+
+* Provide self-hosted file storage and document sharing.
+* Keep user files inside SilverLinux infrastructure.
+* Avoid exposing database or cache ports publicly.
+* Reuse the standard Nginx Proxy Manager routing model.
+
+Status:
+
+```text
+Implemented
+```
+
+---
+
 ## Future Decisions
 
 Document future decisions using the following template:

docs/domains.md

@@ -9,7 +9,7 @@ All public services are routed through Nginx Proxy Manager.
 Verified proxy-host snapshot:
 
 ```text
-2026-06-24
+2026-06-24, with Nextcloud evidence added from 2026-07-08 server output
 ```
 
 ---
@@ -38,6 +38,7 @@ Used for:
 | 5 | `team.silveressence.net` | `http://openproject:80` | enabled | enabled | disabled | enabled | none | enabled |
 | 6 | `nuget.silveressence.net` | `http://baget:80` | disabled | disabled | disabled | disabled | none | enabled |
 | 8 | `dbgate.silveressence.net` | `http://dbgate:3000` | disabled | disabled | disabled | enabled | none | enabled |
+| 13 | `cloud.silveressence.net` | `http://nextcloud:80` | disabled | disabled | disabled | enabled | none | enabled |
 
 All listed active inventory hosts have Block Exploits enabled.
 
@@ -72,9 +73,10 @@ Nginx Proxy Manager findings from the 2026-06-24 snapshot:
 
 * `portainer.silveressence.net` has SSL Force, HTTP/2 and HSTS enabled.
 * `team.silveressence.net` has SSL Force and HTTP/2 enabled.
-* `git.silveressence.net`, `meet.silveressence.net`, `nuget.silveressence.net` and `dbgate.silveressence.net` do not have SSL Force enabled.
+* `git.silveressence.net`, `meet.silveressence.net`, `nuget.silveressence.net`, `dbgate.silveressence.net` and `cloud.silveressence.net` do not have SSL Force enabled.
 * No listed proxy host uses an Nginx Proxy Manager access list.
 * DbGate is a high-sensitivity database administration interface and should be prioritized for SSL Force and an access restriction policy.
+* Nextcloud stores private files and should be prioritized for SSL Force, HTTP/2 and HSTS.
 * Plane.so has been removed from containers, Nginx Proxy Manager and server certificate storage.
 
 ---
@@ -317,6 +319,44 @@ Active
 
 ---
 
+### Nextcloud
+
+Domain:
+
+```text
+cloud.silveressence.net
+```
+
+Purpose:
+
+* Private cloud storage
+* File sharing
+* Team document storage
+
+Container:
+
+```text
+nextcloud
+```
+
+Routing:
+
+```text
+Nginx Proxy Manager -> nextcloud:80
+```
+
+Status:
+
+```text
+Active
+```
+
+Runtime note:
+
+Nginx Proxy Manager proxy host 13 is enabled and forwards `cloud.silveressence.net` to `http://nextcloud:80`. The 2026-07-08 database query showed SSL Force disabled, HTTP/2 disabled, HSTS disabled, WebSocket enabled, Block Exploits enabled and no access list.
+
+---
+
 ## DNS
 
 DNS records should point to:

docs/email.md

@@ -68,7 +68,7 @@ Login
 SMTP credentials are stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Variables:
@@ -147,6 +147,34 @@ Configured and validated
 
 ---
 
+### Nextcloud
+
+Purpose:
+
+* User notifications
+* File sharing notifications
+* Password and account emails where enabled
+
+Sender:
+
+```text
+noreply@silveressence.net
+```
+
+Observed runtime settings:
+
+```text
+smtp.gmail.com
+port 465
+ssl
+```
+
+Status:
+
+Configured
+
+---
+
 ### Alertmanager
 
 Purpose:
@@ -221,7 +249,7 @@ docker logs gitea
 Verify:
 
 * App password is valid
-* SMTP credentials match company.env
+* SMTP credentials match the Infisical values injected by `slcompose`
 * STARTTLS is enabled
 * Port 587 is used
 
@@ -240,7 +268,7 @@ Verify:
 
 * Use Gmail App Passwords.
 * Never use personal Gmail passwords.
-* Store SMTP credentials only in company.env.
+* Store SMTP credentials only in Infisical.
 * Rotate credentials if they become exposed.
 
 ---

docs/network.md

@@ -13,7 +13,7 @@ Current model:
 Verified runtime snapshot:
 
 ```text
-2026-06-24 10:15 CEST
+2026-06-24 10:15 CEST, with Nextcloud evidence added from 2026-07-08 13:21:13 +02:00
 ```
 
 ---
@@ -73,6 +73,7 @@ Public services:
 * Xray
 * Jitsi Web
 * BaGet
+* Nextcloud
 
 Internal monitoring services:
 
@@ -223,6 +224,30 @@ Validated:
 * Grafana connects to Prometheus
 * Alertmanager routes monitoring alerts
 
+#### nextcloud_nextcloud_internal
+
+Purpose:
+
+* Private Nextcloud application, database and cache traffic
+* Keep Nextcloud PostgreSQL and Redis away from the public proxy layer
+
+Services:
+
+* `nextcloud`
+* `nextcloud-db`
+* `nextcloud-redis`
+
+Public attachment:
+
+* Only the `nextcloud` web container also attaches to `proxy`.
+* `nextcloud-db` and `nextcloud-redis` are internal-only.
+
+Verified subnet:
+
+```text
+172.27.0.0/16
+```
+
 ---
 
 ## Runtime-Published Ports
@@ -239,6 +264,13 @@ The current Docker runtime includes these host-published ports.
 | Jitsi JVB | `10000/udp` | `10000/udp` | Allowed | Required media bridge traffic |
 | Xray | `32443` | `8080` | Allowed | Public tunneling endpoint |
 
+Nextcloud runtime exposure from the 2026-07-08 snapshot:
+
+* `nextcloud` exposes `80/tcp` only inside Docker and is routed through Nginx Proxy Manager.
+* `nextcloud-db` exposes `5432/tcp` only inside Docker.
+* `nextcloud-redis` exposes `6379/tcp` only inside Docker.
+* No host-published ports were shown for the Nextcloud stack.
+
 Additional UFW allowed ports with no matching Docker-published service in the 2026-06-24 Docker snapshot:
 
 * `8080/tcp`
@@ -266,6 +298,7 @@ Internet
         -> Xray
         -> Jitsi Web
         -> BaGet
+        -> Nextcloud
 
 internal network
   -> PostgreSQL
@@ -277,6 +310,7 @@ isolated networks
   -> xray_default
   -> gitea-runner_default
   -> monitoring stack network
+  -> nextcloud_nextcloud_internal
 ```
 
 ---
@@ -310,6 +344,7 @@ Periodically verify:
 * UFW-only allowed ports have documented owners
 * Prometheus targets remain healthy
 * Grafana datasource connection remains healthy
+* Nextcloud remains routed through Nginx Proxy Manager without host-published database or Redis ports
 * Unused Docker networks are removed only after confirming they are not active dependencies
 
 ---

docs/nextcloud.md

@@ -0,0 +1,338 @@
+# Nextcloud
+
+## Overview
+
+Nextcloud is deployed on SilverLinux as the private cloud storage and file sharing service for Silver Solutions.
+
+Status:
+
+```text
+Operational
+```
+
+Public URL:
+
+```text
+https://cloud.silveressence.net
+```
+
+Verified runtime snapshot:
+
+```text
+2026-07-08 13:21:13 +02:00
+```
+
+---
+
+## Runtime Stack
+
+Location:
+
+```text
+/srv/docker/nextcloud
+```
+
+Files present on the server:
+
+```text
+/srv/docker/nextcloud/docker-compose.yml
+/srv/docker/nextcloud/.env
+```
+
+The `.env` file was present in the 2026-07-08 snapshot, but passwords should come from Infisical through `slcompose`. Remove any secret values from this file if they still exist.
+
+Management:
+
+* Docker Compose stack name: `nextcloud`
+* Managed by `slcompose`
+* Secrets injected at runtime through Infisical
+* Restart policy: `unless-stopped`
+
+---
+
+## Containers
+
+| Container | Image | Purpose | Status at snapshot |
+| --- | --- | --- | --- |
+| `nextcloud` | `nextcloud:29-apache` | Web UI, file storage and application runtime | Up 6 days |
+| `nextcloud-db` | `postgres:16` | Nextcloud PostgreSQL database | Up 6 days |
+| `nextcloud-redis` | `redis:7-alpine` | Redis cache and locking backend | Up 6 days |
+
+Nextcloud application status:
+
+```text
+installed: true
+version: 29.0.16
+maintenance: false
+needsDbUpgrade: false
+```
+
+---
+
+## Networking
+
+Networks:
+
+* `proxy`
+* `nextcloud_nextcloud_internal`
+
+Network roles:
+
+* `proxy` connects `nextcloud` to Nginx Proxy Manager.
+* `nextcloud_nextcloud_internal` connects `nextcloud`, `nextcloud-db` and `nextcloud-redis`.
+* `nextcloud-db` and `nextcloud-redis` are internal-only and are not attached to `proxy`.
+
+Verified subnet:
+
+```text
+nextcloud_nextcloud_internal: 172.27.0.0/16
+```
+
+Port exposure:
+
+* `nextcloud` exposes `80/tcp` only inside Docker.
+* `nextcloud-db` exposes `5432/tcp` only inside Docker.
+* `nextcloud-redis` exposes `6379/tcp` only inside Docker.
+* No Nextcloud stack ports were published to the host in the runtime snapshot.
+
+Routing:
+
+```text
+Internet
+  -> Nginx Proxy Manager
+  -> proxy network
+  -> nextcloud:80
+```
+
+---
+
+## Domain And Proxy
+
+Domain:
+
+```text
+cloud.silveressence.net
+```
+
+Nextcloud trusted domain:
+
+```text
+cloud.silveressence.net
+```
+
+Reverse proxy settings observed in the application configuration:
+
+```text
+overwritehost: cloud.silveressence.net
+overwriteprotocol: https
+trusted_proxies: 172.16.0.0/12
+```
+
+Nginx Proxy Manager proxy host 13 forwards requests to `nextcloud`.
+
+Proxy host settings from the 2026-07-08 Nginx Proxy Manager database query:
+
+| Setting | Value |
+| --- | --- |
+| Forward scheme | `http` |
+| Forward host | `nextcloud` |
+| Forward port | `80` |
+| SSL Force | disabled |
+| HTTP/2 | disabled |
+| HSTS | disabled |
+| HSTS subdomains | disabled |
+| Block Exploits | enabled |
+| WebSocket | enabled |
+| Access List | none |
+| Status | enabled |
+
+---
+
+## Persistent Data
+
+Docker volumes:
+
+| Volume | Mount point | Purpose |
+| --- | --- | --- |
+| `nextcloud_nextcloud_data` | `/var/www/html` | Nextcloud application files, config, apps and user data directory |
+| `nextcloud_nextcloud_db` | `/var/lib/next-cloud-postgresDb/data` | PostgreSQL data for Nextcloud |
+
+Host mountpoints:
+
+```text
+/var/lib/docker/volumes/nextcloud_nextcloud_data/_data
+/var/lib/docker/volumes/nextcloud_nextcloud_db/_data
+```
+
+Application data directory:
+
+```text
+/var/www/html/data
+```
+
+---
+
+## Database
+
+Database type:
+
+```text
+pgsql
+```
+
+Database host:
+
+```text
+nextcloud-db
+```
+
+Database image:
+
+```text
+postgres:16
+```
+
+Operational note:
+
+PostgreSQL is pinned to version 16 for this stack. During initial deployment, the database volume was initialized with PostgreSQL 16 and therefore must not be started with PostgreSQL 17 without a proper PostgreSQL major-version upgrade.
+
+---
+
+## Redis
+
+Redis host:
+
+```text
+nextcloud-redis
+```
+
+Port:
+
+```text
+6379
+```
+
+Purpose:
+
+* Cache backend
+* File locking support
+* Internal application performance support
+
+---
+
+## Email
+
+Nextcloud SMTP is configured.
+
+Observed application mail settings:
+
+```text
+mail_smtphost: smtp.gmail.com
+mail_smtpport: 465
+mail_smtpsecure: ssl
+mail_from_address: noreply
+mail_domain: silveressence.net
+```
+
+Sender:
+
+```text
+noreply@silveressence.net
+```
+
+Credentials must remain in Infisical and must not be committed.
+
+---
+
+## Secrets
+
+Required secret values include:
+
+* `NEXTCLOUD_ADMIN_USER`
+* `NEXTCLOUD_ADMIN_PASSWORD`
+* `POSTGRES_DB`
+* `POSTGRES_USER`
+* `POSTGRES_PASSWORD`
+* SMTP credentials if not inherited from shared mail configuration
+
+Security note:
+
+Nextcloud `config.php` contains sensitive values such as `secret`, `passwordsalt`, database credentials and SMTP credentials. Do not paste the raw file into public channels and rotate any exposed credentials.
+
+---
+
+## Backup Requirements
+
+Back up these items:
+
+* `nextcloud_nextcloud_data`
+* `nextcloud_nextcloud_db`
+* `/srv/docker/nextcloud/docker-compose.yml`
+* `/srv/docker/nextcloud/.env` only if it contains non-secret runtime configuration
+* Infisical secrets for the `/nextcloud` path
+
+The `nextcloud_nextcloud_data` volume includes the application config and user uploaded files. The `nextcloud_nextcloud_db` volume contains the metadata database and should also be backed up with a logical PostgreSQL dump where possible.
+
+See [docs/backups.md](backups.md) for the backup recipe and restore order.
+
+---
+
+## Operational Commands
+
+Check stack status:
+
+```bash
+docker ps --filter "name=nextcloud"
+```
+
+Check Nextcloud application status:
+
+```bash
+docker exec -u www-data nextcloud php -f /var/www/html/occ status
+```
+
+Check selected config values:
+
+```bash
+docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get trusted_domains
+docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get overwritehost
+docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get overwriteprotocol
+```
+
+Manage through slcompose:
+
+```bash
+slcompose up nextcloud
+slcompose restart nextcloud
+slcompose logs nextcloud
+slcompose logs-tail nextcloud 200
+```
+
+---
+
+## Verification Evidence
+
+The 2026-07-08 server output verified:
+
+* Hostname `silverlinux`
+* Containers `nextcloud`, `nextcloud-db` and `nextcloud-redis` running
+* Compose files present under `/srv/docker/nextcloud`
+* Public domain `cloud.silveressence.net`
+* Nextcloud version `29.0.16`
+* Maintenance mode disabled
+* Database upgrade not required
+* PostgreSQL backend at `nextcloud-db`
+* Redis backend at `nextcloud-redis`
+* Docker volumes `nextcloud_nextcloud_data` and `nextcloud_nextcloud_db`
+* No host-published ports for the Nextcloud stack
+
+---
+
+## Related Documentation
+
+* [docs/services.md](services.md)
+* [docs/domains.md](domains.md)
+* [docs/network.md](network.md)
+* [docs/security.md](security.md)
+* [docs/backups.md](backups.md)
+* [docs/secrets.md](secrets.md)

docs/orchestration.md

@@ -60,6 +60,7 @@ Available services:
   - postgres
   - baget
   - dbgate
+  - nextcloud
 ```
 
 ### Boot All Services

docs/roadmap.md

@@ -23,9 +23,19 @@ Purpose:
 Status:
 
 ```text
-Planned
+Completed
 ```
 
+Deployment:
+
+* Docker Compose project: `nextcloud`
+* Management: `slcompose` with Infisical secret injection
+* External access: `cloud.silveressence.net` through Nginx Proxy Manager
+* Internal networking: `nextcloud_nextcloud_internal`
+* Runtime services: `nextcloud`, `nextcloud-db`, `nextcloud-redis`
+
+See [docs/nextcloud.md](nextcloud.md) for complete deployment documentation.
+
 ---
 
 ### Observability
@@ -335,7 +345,6 @@ Completed:
 Items:
 
 * CrowdSec
-* Sentry
 * Fail2Ban upgrade
 * Cloudflare rate limiting and WAF
 
@@ -343,6 +352,7 @@ Completed:
 
 * Backup v5.3 automation
 * Restore validation
+* Sentry
 
 ---
 
@@ -353,6 +363,9 @@ Items:
 * SonarQube
 * Harbor Docker registry
 * Backstage portal
+
+Completed:
+
 * Nextcloud
 
 ---

docs/secrets.md

@@ -2,9 +2,11 @@
 
 ## Overview
 
-SilverLinux uses Infisical for centralized secret management. Secrets are injected into Compose stacks at runtime by `infisical run`.
+SilverLinux uses Infisical for centralized secret management. Secrets are injected into standard Compose stacks at runtime by `slcompose`, which wraps `infisical run`.
 
-This repository no longer depends on a local `/srv/secrets/company.env` file for deployed services.
+This repository no longer depends on a local `/srv/secrets/company.env` file for deployed services. If that file still exists on the server, remove it after confirming all required values are present in Infisical.
+
+Sentry is the only documented exception to the standard pattern. It follows the upstream self-hosted Sentry installation model because it is a much larger multi-service application.
 
 ---
 
@@ -18,12 +20,12 @@ The Infisical deployment flow provides a single source of truth for:
 * OAuth client secrets
 * Future API keys
 
-Applications should load secrets using Infisical injection at deployment time.
+Applications should load secrets using Infisical injection at deployment time through `slcompose`.
 
 Example:
 
 ```bash
-infisical run --path=/ --recursive -- docker compose up -d
+slcompose up gitea
 ```
 
 ---
@@ -119,6 +121,40 @@ Used by:
 
 ---
 
+### Nextcloud
+
+```text
+NEXTCLOUD_ADMIN_USER
+NEXTCLOUD_ADMIN_PASSWORD
+POSTGRES_DB
+POSTGRES_USER
+POSTGRES_PASSWORD
+SMTP_HOST
+SMTP_PORT
+SMTP_USERNAME
+SMTP_PASSWORD
+```
+
+Used by:
+
+* Nextcloud
+* Nextcloud PostgreSQL
+* Nextcloud notification email
+
+Infisical path:
+
+```text
+/nextcloud
+```
+
+Notes:
+
+* The 2026-07-08 runtime snapshot showed `/srv/docker/nextcloud/.env` present on the server.
+* Do not commit the raw `.env` file or `config.php`.
+* `config.php` includes high-sensitivity values such as `secret`, `passwordsalt`, database credentials and SMTP credentials.
+
+---
+
 ### Future OAuth
 
 ```text
@@ -140,22 +176,21 @@ Future use:
 
 ---
 
-### DbGate Credential Migration
+### Sentry Exception
-
-The running DbGate deployment currently has its login credential in the server-side Compose configuration. Move the password to:
 
 ```text
-/srv/secrets/company.env
+Sentry self-hosted installer secrets
-DBGATE_PASSWORD
 ```
 
-The repository Compose definition already references `DBGATE_PASSWORD` and contains no real password.
+Used by:
 
-Status:
+* Sentry
 
-```text
+Notes:
-Migration pending
+
-```
+* Sentry does not follow the same simple `slcompose` + Infisical pattern as the other SilverLinux services.
+* Keep Sentry secrets out of this repository.
+* Document any Sentry-specific backup or restore requirements in [docs/sentry.md](sentry.md).
 
 ---
 
@@ -163,7 +198,7 @@ Migration pending
 
 * Never commit secrets to Git.
 * Never store passwords directly in docker-compose files.
-* Never share the contents of company.env.
+* Never share Infisical exports, tokens or raw service `.env` files.
 * Use environment variables whenever possible.
 * Use `.env.example` files for documentation.
 * Rotate credentials immediately if exposure is suspected.
@@ -172,13 +207,13 @@ Migration pending
 
 ## Backup Requirements
 
-The following file must be included in server backups:
+Backups must preserve the ability to recover Infisical-managed secrets.
 
 ```text
-/srv/secrets/company.env
+Infisical project data and service secret paths
 ```
 
-Loss of this file may prevent applications from starting correctly.
+Loss of the Infisical secret source may prevent applications from starting correctly.
 
 ---
 
@@ -186,32 +221,22 @@ Loss of this file may prevent applications from starting correctly.
 
 If the server must be rebuilt:
 
-1. Restore `/srv/secrets/company.env`
+1. Restore or reauthorize Infisical access.
-2. Verify file permissions
+2. Verify `/etc/infisical/token` and any required Infisical domain configuration.
-3. Deploy Docker stacks
+3. Deploy Docker stacks through `slcompose`.
-4. Verify services can access required variables
+4. Verify services can access required variables.
-5. Verify SMTP functionality
+5. Verify SMTP functionality.
-6. Verify database connectivity
+6. Verify database connectivity.
 
 ---
 
 ## Security Notes
 
-The secrets file contains credentials for multiple services.
+Infisical contains credentials for multiple services.
 
 Access should be restricted to system administrators only.
 
-Recommended permissions:
+The local Infisical token under `/etc/infisical/token` must be protected with root-only permissions.
-
-```bash
-chmod 600 /srv/secrets/company.env
-```
-
-Recommended ownership:
-
-```bash
-root:root
-```
 
 ---
 

docs/security.md

@@ -101,7 +101,7 @@ Planned improvements:
 Shared secrets are stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Examples:
@@ -117,6 +117,7 @@ Rules:
 * Never commit secrets to Git
 * Never share secrets in documentation
 * Never hardcode passwords in Docker Compose files
+* Remove `/srv/secrets/company.env` if it still exists after confirming all values are present in Infisical
 
 See:
 
@@ -149,12 +150,14 @@ Publicly exposed services:
 * Xray
 * Jitsi Web
 * BaGet
+* Nextcloud
 
 High-sensitivity exposure:
 
 * DbGate exposes a database administration interface and must always require authentication and HTTPS.
 * Xray exposes tunneling capability and must be monitored for abuse, unexpected traffic and unauthorized use.
 * Portainer exposes Docker management and must be restricted to trusted administrators.
+* Nextcloud exposes private file storage and must require strong user authentication, HTTPS and prompt security updates.
 
 Nginx Proxy Manager findings from the 2026-06-24 proxy-host snapshot:
 
@@ -164,12 +167,14 @@ Nginx Proxy Manager findings from the 2026-06-24 proxy-host snapshot:
 * Plane.so has been removed from containers, Nginx Proxy Manager and server certificate storage.
 * `cicd.silveressence.net` is intentionally enabled as a frequently changing prototype deployment endpoint.
 * `exactsyncer.silveressence.net` is intentionally enabled as a client-facing Exact Online syncer demo endpoint.
+* `cloud.silveressence.net` is enabled for Nextcloud with WebSocket and Block Exploits enabled, but SSL Force, HTTP/2 and HSTS disabled and no access list.
 
 Priority hardening:
 
 1. Enable SSL Force for all HTTPS public service routes unless there is a documented exception.
-2. Add an access list or equivalent restriction for DbGate and Portainer.
+2. Enable SSL Force, HTTP/2 and HSTS for Nextcloud unless there is a documented exception.
-3. Define explicit exposure and authentication expectations for prototype and demo endpoints.
+3. Add an access list or equivalent restriction for DbGate and Portainer.
+4. Define explicit exposure and authentication expectations for prototype and demo endpoints.
 
 ---
 
@@ -180,7 +185,7 @@ Outgoing email is provided through Gmail SMTP.
 Credentials are stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Requirements:
@@ -214,7 +219,7 @@ Future OAuth providers:
 
 Requirements:
 
-* Store client secrets in company.env
+* Store client secrets in Infisical
 * Use least-privilege scopes
 * Disable unused authentication providers
 
@@ -259,6 +264,10 @@ Applications and DbGate communicate with the database containers through the `in
 
 DbGate is the public administration entry point and must require authentication and HTTPS. Its web interface is routed through Nginx Proxy Manager; database ports `5432` and `1433` remain private.
 
+Nextcloud uses a stack-local PostgreSQL container named `nextcloud-db` on `nextcloud_nextcloud_internal`. Its `5432/tcp` port is not published to the host and is not routed through Nginx Proxy Manager.
+
+Nextcloud Redis uses `nextcloud-redis` on `nextcloud_nextcloud_internal`. Its `6379/tcp` port is not published to the host.
+
 ---
 
 ## Connectivity Layer Security
@@ -292,6 +301,7 @@ Networks:
 * jitsi-docker-jitsi-meet-aa76415_meet.jitsi
 * xray_default
 * gitea-runner_default
+* nextcloud_nextcloud_internal
 
 Network model:
 
@@ -299,6 +309,7 @@ Network model:
 * `proxy` is for public HTTP and HTTPS services controlled by Nginx Proxy Manager.
 * Isolated stack networks are used for Jitsi, Xray and CI/CD runner separation.
 * `xray_default` currently exists without a running container attached; the active `xray` container is attached to `proxy`.
+* `nextcloud_nextcloud_internal` isolates Nextcloud database and Redis traffic from the public proxy layer.
 
 ---
 
@@ -345,6 +356,9 @@ Periodically verify:
 * DbGate login is enforced
 * DbGate proxy route has SSL Force and an access restriction policy
 * Xray exposure policy is still valid
+* Nextcloud security advisories are reviewed and the image is updated promptly
+* Nextcloud database and Redis ports remain internal-only
+* Nextcloud proxy route uses HTTPS with SSL Force, HTTP/2 and HSTS enabled unless there is a documented exception
 * Public services are still routed only through Nginx Proxy Manager
 * Removed proxy hosts and unused certificates stay removed unless explicitly approved
 * Prototype and demo proxy hosts have documented owners and exposure expectations
@@ -362,7 +376,7 @@ Periodically verify:
 If a credential is exposed:
 
 1. Rotate the credential immediately.
-2. Update `/srv/secrets/company.env`.
+2. Rotate or update the value in Infisical.
 3. Restart affected services.
 4. Review logs for unauthorized access.
 5. Update documentation if required.

docs/server.md

@@ -168,6 +168,7 @@ Examples:
 * Grafana
 * Node Exporter
 * cAdvisor
+* Nextcloud
 
 ---
 
@@ -194,6 +195,7 @@ Contains:
 /srv/docker/dbgate
 /srv/docker/xray
 /srv/docker/monitoring
+/srv/docker/nextcloud
 ```
 
 ---
@@ -201,7 +203,7 @@ Contains:
 ### Shared Secrets
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Contains:
@@ -210,9 +212,13 @@ Contains:
 * Database passwords
 * Application secrets
 * MSSQL SA password
-* Future DbGate password
+* DbGate password
 * Future OAuth credentials
 
+Legacy note:
+
+* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists.
+
 ---
 
 ### Backups
@@ -342,6 +348,31 @@ The `xray_default` network exists, but the running `xray` container was attached
 
 ---
 
+### Nextcloud
+
+```text
+/srv/docker/nextcloud
+```
+
+Volumes:
+
+```text
+nextcloud_nextcloud_data
+nextcloud_nextcloud_db
+```
+
+Domain:
+
+```text
+cloud.silveressence.net
+```
+
+Runtime note:
+
+The 2026-07-08 runtime snapshot showed `nextcloud`, `nextcloud-db` and `nextcloud-redis` running with no host-published ports. The web container is routed through Nginx Proxy Manager on the `proxy` network; PostgreSQL and Redis stay on `nextcloud_nextcloud_internal`.
+
+---
+
 ### Monitoring Stack
 
 ```text
@@ -390,6 +421,7 @@ Implemented:
 * SSL certificates managed through Nginx Proxy Manager
 * PostgreSQL not exposed publicly
 * MSSQL port 1433 not exposed publicly
+* Nextcloud PostgreSQL and Redis not exposed publicly
 * Database administration is available only through authenticated HTTPS access to DbGate
 * Xray is not attached to the private database network and is monitored as a tunneling endpoint
 * OpenID disabled in Gitea
@@ -407,13 +439,14 @@ noreply@silveressence.net
 SMTP credentials are stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Used by:
 
 * Gitea
 * OpenProject
+* Nextcloud
 
 ---
 

docs/services.md

@@ -461,6 +461,53 @@ Operational
 
 ---
 
+### Nextcloud
+
+URL:
+
+```text
+https://cloud.silveressence.net
+```
+
+Purpose:
+
+* Private cloud storage
+* File sharing
+* Team document storage
+* Nextcloud notification email
+
+Runtime:
+
+* `nextcloud` using `nextcloud:29-apache`
+* `nextcloud-db` using `postgres:16`
+* `nextcloud-redis` using `redis:7-alpine`
+
+Networks:
+
+* `proxy` for Nginx Proxy Manager access to the web container
+* `nextcloud_nextcloud_internal` for private Nextcloud, PostgreSQL and Redis traffic
+
+Storage:
+
+* `nextcloud_nextcloud_data`
+* `nextcloud_nextcloud_db`
+
+Exposure:
+
+* Routed through Nginx Proxy Manager
+* No Nextcloud stack ports were published to the host in the 2026-07-08 runtime snapshot
+* Database and Redis containers are internal-only
+
+Status:
+
+```text
+Operational
+```
+
+See [docs/nextcloud.md](nextcloud.md) for complete deployment documentation.
+
+---
+
 ### Sentry
 
 URL:
@@ -712,10 +759,10 @@ Running
 
 ### Shared Secrets
 
-Location:
+Source:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Purpose:
@@ -730,6 +777,10 @@ Status:
 Active
 ```
 
+Legacy note:
+
+* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists.
+
 ---
 
 ## Removed Services
@@ -760,7 +811,6 @@ Phase 3:
 * SonarQube
 * Harbor
 * Backstage
-* Nextcloud
 
 ---
 

gitea/README.md

@@ -90,7 +90,7 @@ POSTGRES_ROOT_PASSWORD
 Stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Future improvement:
@@ -229,7 +229,7 @@ Labels:
 * `ubuntu-24.04`
 * `ubuntu-22.04`
 
-The runner registration token is loaded from `GITEA_RUNNER_REGISTRATION_TOKEN` in `/srv/secrets/company.env`.
+The runner registration token is loaded from `GITEA_RUNNER_REGISTRATION_TOKEN` in Infisical through `slcompose`.
 
 ### Package Publishing
 
@@ -244,7 +244,7 @@ The publishing credential is stored as the repository Actions secret `BAGET_API_
 Gitea and its Actions runner use infrastructure secrets stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Variables:
@@ -340,7 +340,7 @@ gitea
 ### Secrets
 
 ```text
-/srv/secrets/company.env
+Infisical service paths for Gitea and the Gitea runner
 ```
 
 Without these items, a complete restoration is not possible.
@@ -353,7 +353,7 @@ To restore Gitea:
 
 1. Restore PostgreSQL database.
 2. Restore Gitea data directory.
-3. Restore company.env secrets.
+3. Restore or reauthorize Infisical access and service secret paths.
 4. Deploy Docker Compose stack.
 5. Verify SMTP configuration.
 6. Verify SSH access.

jitsi/README.md

@@ -36,7 +36,7 @@ Configuration stored in:
 
 Stored in:
 
-/srv/secrets/company.env
+Infisical
 
 Variables:
 

mssql/README.md

@@ -54,8 +54,7 @@ Never commit the value to Git or place it directly in the Compose file.
 The stack is deployed with Infisical injection instead of a local secrets file:
 
 ```bash
-cd /srv/docker/mssql
+slcompose up mssql
-infisical run --path=/ --recursive -- docker compose up -d
 ```
 
 Secrets are injected into the environment before Docker Compose evaluates variables such as `${MSSQL_SA_PASSWORD}`.
@@ -93,7 +92,7 @@ Do not delete or recreate the directory after databases exist. Removing `/srv/do
 
 ### Variable Is Not Set
 
-If Compose reports that `MSSQL_SA_PASSWORD` is unset and defaults to a blank string, use the required `docker compose --env-file /srv/secrets/company.env up -d` command.
+If Compose reports that `MSSQL_SA_PASSWORD` is unset and defaults to a blank string, run the stack through `slcompose` so Infisical injects the value before Docker Compose evaluates the environment.
 
 ### System Directory Permission Denied
 
@@ -101,7 +100,7 @@ If `[/.system]` cannot be created, verify that `/srv/docker/mssql/data` is owned
 
 ### Password Validation Failed
 
-Confirm that the password meets SQL Server complexity requirements and that Compose resolved `MSSQL_SA_PASSWORD` from the secrets file.
+Confirm that the password meets SQL Server complexity requirements and that Compose resolved `MSSQL_SA_PASSWORD` from Infisical.
 
 ---
 

openproject/README.md

@@ -221,7 +221,7 @@ openproject
 ### Secrets
 
 ```text
-/srv/secrets/company.env
+Infisical service path for OpenProject
 ```
 
 Without these items, a complete restoration is not possible.
@@ -234,7 +234,7 @@ To restore OpenProject:
 
 1. Restore PostgreSQL database.
 2. Restore OpenProject assets directory.
-3. Restore company.env secrets.
+3. Restore or reauthorize Infisical access and the OpenProject secret path.
 4. Deploy Docker Compose stack.
 5. Verify SMTP configuration.
 6. Verify access through Nginx Proxy Manager.

postgres/README.md

@@ -112,7 +112,7 @@ Each application should use its own dedicated database user whenever possible.
 Credentials are stored in:
 
 ```text
-/srv/secrets/company.env
+Infisical
 ```
 
 Current variables:
@@ -229,7 +229,7 @@ docker exec -i postgres psql -U postgres < postgres-full-backup.sql
 
 * PostgreSQL is not exposed publicly.
 * Database traffic is restricted to Docker internal networks.
-* Credentials are stored in `/srv/secrets/company.env`.
+* Credentials are stored in Infisical and injected at runtime by `slcompose`.
 * Administrative access should use the `postgres` role only when necessary.
 * Applications should use dedicated database users.
 
@@ -267,10 +267,10 @@ Minimum requirements for recovery:
 
 * PostgreSQL container configuration
 * Database backups
-* `/srv/secrets/company.env`
+* Infisical access and PostgreSQL service secrets
 * Docker network configuration
 
-Without the secrets file, applications may not be able to reconnect to their databases after restoration.
+Without Infisical recovery, applications may not be able to reconnect to their databases after restoration.
 
 ---