docs: update infrastructure state and roadmap

2026-06-25 12:10:56 +03:30
parent db42baa33e
commit 4cf06da0a8
12 changed files with 1842 additions and 40 deletions
@@ -322,6 +322,229 @@ Implemented

 ---

+## 2026-06-24 - Formalize Multi-Network Segmentation
+
+Decision:
+
+* Treat SilverLinux as a three-layer Docker network architecture.
+* Use `internal` for private databases and backend service traffic.
+* Use `proxy` for public HTTP and HTTPS services routed through Nginx Proxy Manager.
+* Use isolated stack networks for Jitsi, Xray and CI/CD runner traffic where the active runtime attachments support it.
+
+Reason:
+
+* Keep databases private while allowing selected web interfaces to be public.
+* Reduce unnecessary cross-service connectivity.
+* Make specialized infrastructure stacks easier to reason about and audit.
+
+Status:
+
+```text
+Accepted
+```
+
+---
+
+## 2026-06-24 - Confirm Nginx Proxy Manager as the Single Reverse Proxy
+
+Decision:
+
+Use Nginx Proxy Manager as the sole reverse proxy and SSL termination layer for SilverLinux HTTP and HTTPS services.
+
+Reason:
+
+* The active platform uses Nginx Proxy Manager for domain routing.
+* No Traefik or alternate reverse proxy is active.
+* A single proxy layer keeps exposure and certificate management centralized.
+
+Status:
+
+```text
+Confirmed
+```
+
+---
+
+## 2026-06-24 - Add Xray Connectivity Layer
+
+Decision:
+
+* Classify Xray as a network tunneling and connectivity layer.
+* Attach Xray to the `proxy` network for public endpoint access.
+* Keep `xray_default` documented as the Compose-created Xray stack network.
+* Monitor the service as an exposed connectivity endpoint rather than as an application backend.
+
+Reason:
+
+* Improve connectivity stability to SilverLinux.
+* Support secure long-distance connection paths.
+* Keep tunneling concerns separate from application and database services.
+
+Status:
+
+```text
+Accepted
+```
+
+Runtime Note:
+
+The 2026-06-24 Docker snapshot showed the running `xray` container attached to `proxy` only. The `xray_default` network existed but had no running containers attached.
+
+---
+
+## 2026-06-24 - Confirm Jitsi Meet Is Fully Deployed
+
+Decision:
+
+Treat the Jitsi Meet stack as an operational isolated collaboration stack.
+
+Components:
+
+* jitsi-web
+* jitsi-jvb
+* jitsi-jicofo
+* jitsi-prosody
+
+Networks:
+
+* `proxy`
+* `jitsi-docker-jitsi-meet-aa76415_meet.jitsi`
+
+Reason:
+
+* Jitsi Web is expected to be public.
+* Internal Jitsi components should remain isolated inside the Jitsi stack network.
+
+Status:
+
+```text
+Confirmed
+```
+
+---
+
+## 2026-06-24 - Adopt Phased Infrastructure Roadmap
+
+Decision:
+
+Use a phased roadmap for planned SilverLinux platform improvements.
+
+Phases:
+
+* Phase 1: Grafana, Prometheus, Loki, Redis and Authelia.
+* Phase 2: CrowdSec, Sentry, Restic, Fail2Ban upgrade and Cloudflare rate limiting/WAF.
+* Phase 3: SonarQube, Harbor, Backstage and Nextcloud.
+
+Reason:
+
+* Prioritize observability, access control and shared runtime foundations first.
+* Add security and backup maturity before larger platform expansion.
+* Keep enterprise developer-platform tools grouped together.
+
+Status:
+
+```text
+Accepted
+```
+
+---
+
+## 2026-06-25 - Select Prometheus And Grafana Monitoring Stack
+
+Decision:
+
+Deploy a dedicated monitoring Docker stack using:
+
+* Prometheus for metrics collection
+* Grafana for visualization
+* Node Exporter for host metrics
+* cAdvisor for Docker metrics
+
+Reason:
+
+* Prometheus provides a standard pull-based metrics system.
+* Grafana provides flexible dashboards and datasource integration.
+* Node Exporter provides host CPU, memory and disk visibility.
+* cAdvisor provides Docker container visibility.
+
+Status:
+
+```text
+Implemented
+```
+
+Validation:
+
+* Prometheus UI validated
+* Prometheus targets validated
+* Grafana datasource connected to Prometheus
+* Initial monitoring dashboards created and validated
+
+---
+
+## 2026-06-25 - Export Backup Metrics Through Node Exporter
+
+Decision:
+
+Export SilverLinux backup metrics through the Node Exporter Textfile Collector.
+
+Metrics:
+
+* Backup success
+* Backup duration
+* Backup size
+
+Reason:
+
+* Keep backup status visible in the same monitoring stack as host and container metrics.
+* Avoid a separate metrics service for backup scripts.
+* Allow Grafana dashboards to show backup health.
+
+Status:
+
+```text
+Implemented
+```
+
+---
+
+## 2026-06-25 - Validate Backup v2 And Restore Workflow
+
+Decision:
+
+Treat Backup v2 as the operational SilverLinux backup system.
+
+Implemented:
+
+* HTML backup reports
+* Email notifications
+* Automatic archive creation
+* Backup logging
+* Restore validation
+* MSSQL data inclusion fix
+* Backup metrics
+* Automatic low disk space cleanup
+* Daily cron execution
+
+Validation:
+
+* Dry-run restore completed
+* Full archive validation completed
+* PostgreSQL restore coverage verified
+* MSSQL backup integrity verified
+* Gitea backup verified
+* BaGet backup verified
+* OpenProject assets verified
+* Docker configuration verified
+
+Status:
+
+```text
+Implemented
+```
+
+---
+
 ## Future Decisions

 Document future decisions using the following template: