docs: update infrastructure state and roadmap

2026-06-25 12:10:56 +03:30
parent db42baa33e
commit 4cf06da0a8
12 changed files with 1842 additions and 40 deletions
@@ -4,6 +4,12 @@

 This document lists all services running on SilverLinux and their purpose.

+Generated state reference:
+
+```text
+2026-06-25 infrastructure review
+```
+
 ---

 ## Running Services
@@ -12,7 +18,7 @@ This document lists all services running on SilverLinux and their purpose.

 Purpose:

-* Shared database platform
+* Primary shared database platform
 * Application data storage

 Used by:
@@ -28,6 +34,40 @@ Running

 ---

+### Microsoft SQL Server Express
+
+Purpose:
+
+* Secondary database platform for SQL Server compatibility
+* Support future applications requiring Microsoft SQL Server
+* Extend the platform beyond PostgreSQL-only workloads
+
+Image:
+
+```text
+mcr.microsoft.com/mssql/server:2022-latest
+```
+
+Network:
+
+```text
+internal
+```
+
+Exposure:
+
+* Port 1433 is not published
+* Not routed through Nginx Proxy Manager
+* Private database access only
+
+Status:
+
+```text
+Operational
+```
+
+---
+
 ### Gitea

 URL:
@@ -135,34 +175,82 @@ Running

 ---

-### Microsoft SQL Server Express
+### Prometheus

 Purpose:

-* Support applications requiring Microsoft SQL Server
-* Run alongside PostgreSQL as a private database platform
+* Metrics collection
+* Monitoring data storage
+* Scrape targets for system, Docker and backup metrics

-Image:
+Scrapes:

-```text
-mcr.microsoft.com/mssql/server:2022-latest
-```
-
-Network:
-
-```text
-internal
-```
-
-Exposure:
-
-* Port 1433 is not published
-* Not routed through Nginx Proxy Manager
+* Prometheus
+* Node Exporter
+* cAdvisor
+* SilverLinux backup metrics

 Status:

 ```text
-Operational
+Running
+```
+
+---
+
+### Grafana
+
+Purpose:
+
+* Monitoring dashboards
+* Metrics visualization
+* Prometheus datasource frontend
+
+Dashboards:
+
+* Custom backup dashboard
+* Custom system dashboard
+* Docker monitoring dashboard
+
+Note:
+
+The imported Prometheus 2.0 Overview dashboard is not compatible with the installed Prometheus version `3.5.4`. This is a third-party dashboard compatibility issue, not an infrastructure problem.
+
+Status:
+
+```text
+Running
+```
+
+---
+
+### Node Exporter
+
+Purpose:
+
+* Host metrics collection
+* CPU, memory and disk metrics
+* Textfile Collector endpoint for SilverLinux backup metrics
+
+Status:
+
+```text
+Running
+```
+
+---
+
+### cAdvisor
+
+Purpose:
+
+* Docker container metrics
+* Container CPU, memory and runtime visibility
+
+Status:
+
+```text
+Running
 ```

 ---
@@ -244,8 +332,9 @@ https://dbgate.silveressence.net

 Purpose:

-* Browser-based MSSQL administration
 * Browser-based PostgreSQL administration
+* Browser-based MSSQL administration
+* Database explorer and debugging interface

 Networks:

@@ -254,8 +343,10 @@ Networks:

 Security:

+* Publicly reachable through the proxy layer
 * HTTPS enforced
 * DbGate username and password required
+* Authentication must remain hardened and periodically verified
 * Database ports remain private

 Status:
@@ -266,6 +357,54 @@ Operational

 ---

+### Xray
+
+Purpose:
+
+* Connectivity and tunneling layer
+* Improve long-distance connectivity stability to SilverLinux
+* Maintain secure routing paths when direct connectivity is limited
+
+Classification:
+
+```text
+Network tunneling / connectivity layer
+```
+
+Networks:
+
+* `proxy`
+
+Runtime ports:
+
+```text
+0.0.0.0:32443 -> 8080/tcp
+```
+
+Image:
+
+```text
+ghcr.io/xtls/xray-core:latest
+```
+
+Runtime note:
+
+* The `xray_default` network exists, but the running `xray` container was attached only to `proxy` in the 2026-06-24 runtime snapshot.
+
+Security:
+
+* Public tunneling endpoint exposure must be monitored
+* Access policy and abuse monitoring must be reviewed regularly
+* Not classified as an application backend service
+
+Status:
+
+```text
+Operational
+```
+
+---
+
 ## Shared Infrastructure

 ### Docker
@@ -297,6 +436,42 @@ Running

 ---

+### Proxy Docker Network
+
+Purpose:
+
+* HTTP and HTTPS service exposure through Nginx Proxy Manager
+* Shared public routing layer for web-facing services
+
+Status:
+
+```text
+Running
+```
+
+---
+
+### Isolated Docker Networks
+
+Purpose:
+
+* Keep specialized infrastructure stacks isolated from application backends
+* Separate Jitsi, Xray and CI/CD runner traffic from shared database traffic
+
+Networks:
+
+* `jitsi-docker-jitsi-meet-aa76415_meet.jitsi`
+* `xray_default`
+* `gitea-runner_default`
+
+Status:
+
+```text
+Running
+```
+
+---
+
 ### Shared Secrets

 Location:
@@ -321,11 +496,42 @@ Active

 ## Removed Services

+## Planned Services
+
+See:
+
+```text
+docs/roadmap.md
+```
+
+Phase 1:
+
+* Loki
+* Redis
+* Authelia
+
+Phase 2:
+
+* CrowdSec
+* Sentry
+* Restic
+* Fail2Ban upgrade
+* Cloudflare rate limiting and WAF
+
+Phase 3:
+
+* SonarQube
+* Harbor
+* Backstage
+* Nextcloud
+
+---
+
 ### Plane.so

 Reason:

-OpenProject was selected as the primary project management platform.
+OpenProject was selected as the primary project management platform. Plane.so is not used and will not be used.

 Status:

@@ -333,11 +539,19 @@ Status:
 Removed
 ```

+Cleanup:
+
+* Containers removed
+* Nginx Proxy Manager route removed
+* Unused SSL certificate removed from the server
+
 ---

 ## Related Documentation

 * docs/server.md
+* docs/network.md
+* docs/roadmap.md
 * docs/domains.md
 * docs/security.md
 * docs/backups.md