updating the documentation of the SilverLinux Insftracture

README.md

@@ -1,45 +1,122 @@
 # SilverLinux Infrastructure
 
-This repository contains the infrastructure configuration and documentation for the SilverLinux server.
+This repository contains the infrastructure configuration, deployment files and operational documentation for the SilverLinux server.
 
-## Services
+SilverLinux is the primary self-hosted platform for Silver Solutions and hosts source control, project management, collaboration, communication and future CI/CD services.
+
+---
+
+## Server Information
+
+| Property         | Value                   |
+| ---------------- | ----------------------- |
+| Hostname         | silverlinux             |
+| Provider         | OVH                     |
+| Operating System | Ubuntu Server 24.04 LTS |
+| Public IP        | 51.255.83.140           |
+| CPU              | Intel Xeon-D 1520       |
+| Memory           | 32 GB RAM               |
+| Storage          | 2 × 480 GB SSD RAID1    |
+
+---
+
+## Core Services
 
 ### Running
 
+* PostgreSQL
 * Gitea
+* OpenProject
+* Jitsi Meet
 * Portainer
-* Nginx Reverse Proxy
+* Nginx Proxy Manager
 
 ### Planned
 
 * BaGet
-* Plane.so
+* Sentry
+* CI/CD Runners
+* Nextcloud
+
+### Removed
+
+* Plane.so (replaced by OpenProject)
+
+---
+
+## Shared Infrastructure
+
+The following components are shared across multiple services:
+
+* Docker
+* Docker Compose
+* Internal Docker Network
+* Proxy Docker Network
+* Shared Secrets Management
+
+Secrets are stored outside the repository:
+
+```text
+/srv/secrets/company.env
+```
+
+---
+
+## Repository Structure
+
+```text
+docs/
+gitea/
+jitsi/
+nginx-proxy-manager/
+openproject/
+portainer/
+postgres/
+scripts/
+```
+
+Each service folder contains:
+
+* docker-compose.yml
+* README.md
+* .env.example
+
+---
 
 ## Purpose
 
 This repository serves as the single source of truth for rebuilding and maintaining the SilverLinux environment.
 
-Infrastructure documentation, Docker Compose files, reverse proxy configuration, backup procedures, and deployment notes are stored here.
+Infrastructure documentation, Docker Compose files, backup procedures, deployment notes and operational decisions are stored here.
 
-## Server
+The goal is that the entire environment can be rebuilt from this repository and the documented backup files.
 
-* Hostname: silverlinux
-* OS: Ubuntu Server 24.04 LTS
-* Provider: OVH
+---
 
-## Important
+## Security
 
-Do not commit:
+Never commit:
 
 * Passwords
 * API Keys
 * SMTP Credentials
+* OAuth Secrets
 * SSL Private Keys
 * Database Credentials
 * Real `.env` files
+* `/srv/secrets/company.env`
 
-Use `.env.example` files instead.
+Use example files whenever possible.
+
+---
 
 ## Disaster Recovery
 
-This repository should contain enough configuration and documentation to rebuild the SilverLinux environment from scratch.
+This repository should contain enough information to rebuild the entire SilverLinux environment from scratch.
+
+See:
+
+* docs/server.md
+* docs/backups.md
+* docs/security.md
+* docs/secrets.md

SUMMARY.md

@@ -4,57 +4,20 @@ Last Updated: 2026-06-21
 
 ## Overview
 
-SilverLinux is the primary self-hosted infrastructure server for Silver Solutions.
+SilverLinux is the primary infrastructure server for Silver Solutions.
 
-The server hosts development and collaboration services used for software development, source control, package management, project management and future CI/CD automation.
-
-## Server Information
-
-### Host
-
-| Property         | Value                   |
-| ---------------- | ----------------------- |
-| Name             | SilverLinux             |
-| Provider         | OVH                     |
-| Operating System | Ubuntu Server 24.04 LTS |
-| Public IP        | 51.255.83.140           |
-
-### Hardware
-
-| Resource | Value               |
-| -------- | ------------------- |
-| CPU      | Intel Xeon-D 1520   |
-| Memory   | 32 GB RAM           |
-| Storage  | 2 × 480 GB SSD RAID |
+The platform hosts source control, project management, video conferencing, container management and supporting infrastructure services.
 
 ---
 
-## Security
+## Public Services
 
-### SSH
-
-* SSH key authentication enabled
-* Root login disabled
-
-### Firewall
-
-* UFW enabled
-
-### Protection
-
-* Fail2Ban enabled
-
----
-
-## Container Platform
-
-### Docker
-
-All application services are deployed using Docker containers.
-
-### Docker Compose
-
-Docker Compose is used for service deployment and management.
+| Service     | URL                                 |
+| ----------- | ----------------------------------- |
+| Gitea       | https://git.silveressence.net       |
+| OpenProject | https://team.silveressence.net      |
+| Portainer   | https://portainer.silveressence.net |
+| Jitsi Meet  | https://meet.silveressence.net      |
 
 ---
 
@@ -64,31 +27,64 @@ Docker Compose is used for service deployment and management.
 
 Purpose:
 
-* Source control
+* Git repositories
 * Pull requests
 * Issue tracking
-* Git hosting
-
-URL:
-
-```text
-https://git.silveressence.net
-```
+* Future CI/CD integration
 
 Authentication:
 
 * Local accounts
+* Planned Google OAuth2
+* Planned GitHub OAuth2
 
-Future considerations:
+Email:
 
-- Google OAuth (optional)
-- GitHub OAuth (optional)
+* SMTP configured
+* Password reset supported
 
-Current focus:
+---
 
-* Disable OpenID
-* Enable 2FA
-* Configure backups
+### OpenProject
+
+Purpose:
+
+* Project management
+* Sprint planning
+* Time tracking
+* Roadmaps
+* Team collaboration
+
+Email:
+
+* SMTP configured
+* Notifications enabled
+
+---
+
+### Jitsi Meet
+
+Purpose:
+
+* Video conferencing
+* Screen sharing
+* Team meetings
+
+Authentication:
+
+* Internal authentication
+* Guest access enabled
+
+---
+
+### PostgreSQL
+
+Purpose:
+
+* Shared database platform
+* OpenProject database
+* Gitea database
+* Future application databases
 
 ---
 
@@ -96,91 +92,73 @@ Current focus:
 
 Purpose:
 
-* Docker management
-* Container monitoring
+* Docker administration
 * Stack deployment
-
-URL:
-
-```text
-https://portainer.silveressence.net
-```
+* Container monitoring
 
 ---
 
-### Nginx
+### Nginx Proxy Manager
 
 Purpose:
 
 * Reverse proxy
-* SSL termination
+* SSL certificate management
 * Domain routing
 
 ---
 
-## Email
+## Shared Infrastructure
 
-Sender address:
+### Docker
+
+Purpose:
+
+* Container hosting
+* Service isolation
+
+### Internal Network
+
+Purpose:
+
+* Private communication between services
+
+### Shared Secrets
+
+Location:
 
 ```text
-noreply@silveressence.net
+/srv/secrets/company.env
 ```
 
-Purpose:
+Contains:
 
-* Password reset emails
-* Service notifications
-* Future CI/CD notifications
+* SMTP credentials
+* PostgreSQL passwords
+* OpenProject secrets
+* Future OAuth secrets
+
+This file must never be committed to Git.
 
 ---
 
-## Domains
+## Architecture Decisions
 
-| Domain                      | Purpose      |
-| --------------------------- | ------------ |
-| git.silveressence.net       | Gitea        |
-| portainer.silveressence.net | Portainer    |
-| nuget.silveressence.net     | Future BaGet |
-| plane.silveressence.net     | Future Plane |
+### OpenProject Selected
 
----
+OpenProject is the primary project management platform.
 
-## Planned Services
+### Plane.so Removed
 
-### BaGet
+Plane.so was removed to reduce maintenance complexity and duplicate functionality.
 
-Purpose:
+### Centralized Secrets
 
-* Private NuGet package hosting
+All shared credentials are stored in:
 
-Status:
-
-* Planned
-
-### Plane.so
-
-Purpose:
-
-* Project management
-* Sprint planning
-* Issue tracking
-
-Status:
-
-* Planned
-
----
-
-## Backup Priorities
-
-Critical data:
-
-* Gitea repositories
-* Gitea database
-* Gitea configuration
-* Docker Compose files
-* Nginx configuration
-* SSL certificates
+```text
+/srv/secrets/company.env
+```
 
 ---
 
@@ -188,27 +166,26 @@ Critical data:
 
 ### Phase 1
 
-* Verify email configuration
-* Disable OpenID
-* Enable Gitea 2FA
-* Configure backups
+* Enable Google OAuth2
+* Enable GitHub OAuth2
+* Configure automated backups
 
 ### Phase 2
 
 * Deploy BaGet
-* Configure private package feeds
+* Configure private NuGet feeds
 
 ### Phase 3
 
-* Deploy Plane.so
+* Deploy Sentry
 
 ### Phase 4
 
 * Implement CI/CD pipelines
-* Deploy directly from Gitea to IIS servers
+* Automated deployment to Windows IIS servers
 
 ---
 
 ## Mission
 
-Provide a reliable, secure and self-hosted platform for development, deployment and collaboration within Silver Solutions.
+Provide a secure, reliable and self-hosted platform for software development and business operations within Silver Solutions.

docs/backups.md

@@ -0,0 +1,274 @@
+# Backups
+
+## Overview
+
+This document describes the backup strategy for SilverLinux.
+
+The goal is to ensure that all critical services can be restored after hardware failure, accidental deletion, corruption, or disaster recovery scenarios.
+
+---
+
+## Backup Priorities
+
+### Critical
+
+These items must always be backed up.
+
+#### PostgreSQL
+
+Contains:
+
+* OpenProject database
+* Gitea database
+* Future application databases
+
+Importance:
+
+Critical
+
+---
+
+#### Gitea Data
+
+Location:
+
+```text
+/srv/docker/gitea/data
+```
+
+Contains:
+
+* Git repositories
+* Attachments
+* Configuration
+* User data
+
+Importance:
+
+Critical
+
+---
+
+#### OpenProject Assets
+
+Location:
+
+```text
+/srv/docker/openproject/assets
+```
+
+Contains:
+
+* Attachments
+* Uploaded files
+* User generated content
+
+Importance:
+
+Critical
+
+---
+
+#### Shared Secrets
+
+Location:
+
+```text
+/srv/secrets/company.env
+```
+
+Contains:
+
+* SMTP credentials
+* PostgreSQL passwords
+* OpenProject secrets
+* Future OAuth secrets
+
+Importance:
+
+Critical
+
+Without this file applications may not start correctly.
+
+---
+
+#### Nginx Proxy Manager
+
+Locations:
+
+```text
+/srv/docker/nginx-proxy-manager/data
+/srv/docker/nginx-proxy-manager/letsencrypt
+```
+
+Contains:
+
+* Proxy configuration
+* SSL certificates
+* Domain routing
+
+Importance:
+
+Critical
+
+---
+
+### Medium Priority
+
+#### Portainer
+
+Volume:
+
+```text
+portainer_portainer_data
+```
+
+Contains:
+
+* Portainer users
+* Portainer configuration
+* Stack definitions
+
+Importance:
+
+Medium
+
+Can be recreated if necessary.
+
+---
+
+#### Jitsi Configuration
+
+Location:
+
+```text
+/srv/docker/jitsi
+```
+
+Contains:
+
+* Jitsi configuration
+* Internal authentication configuration
+
+Importance:
+
+Medium
+
+---
+
+## Backup Storage
+
+Current Location:
+
+```text
+/srv/backups
+```
+
+Suggested Structure:
+
+```text
+/srv/backups/
+├── daily
+├── weekly
+└── monthly
+```
+
+---
+
+## Retention Policy
+
+### Daily
+
+Keep:
+
+```text
+7 days
+```
+
+### Weekly
+
+Keep:
+
+```text
+4 weeks
+```
+
+### Monthly
+
+Keep:
+
+```text
+12 months
+```
+
+---
+
+## Restore Priorities
+
+Restore order:
+
+1. PostgreSQL
+2. Shared secrets
+3. Nginx Proxy Manager
+4. Gitea
+5. OpenProject
+6. Portainer
+7. Jitsi
+
+---
+
+## Disaster Recovery Checklist
+
+### Step 1
+
+Install:
+
+* Ubuntu Server
+* Docker
+* Docker Compose
+
+### Step 2
+
+Restore:
+
+```text
+/srv/secrets/company.env
+```
+
+### Step 3
+
+Restore:
+
+```text
+/srv/docker
+```
+
+data directories.
+
+### Step 4
+
+Restore PostgreSQL databases.
+
+### Step 5
+
+Deploy Docker stacks.
+
+### Step 6
+
+Verify:
+
+* DNS
+* SSL certificates
+* Email delivery
+* Application access
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/security.md
+* docs/secrets.md
+* postgres/README.md
+* gitea/README.md
+* openproject/README.md

docs/cicd.md

@@ -0,0 +1,247 @@
+# CI/CD
+
+## Overview
+
+The goal of SilverLinux is to become the central deployment platform for Silver Solutions applications.
+
+Source code is managed through Gitea and future deployments should be automated through CI/CD pipelines.
+
+---
+
+## Current Situation
+
+Application deployments are currently performed manually.
+
+Typical process:
+
+1. Developer commits code.
+2. Developer publishes application.
+3. Files are deployed manually.
+4. IIS application is restarted if necessary.
+
+Status:
+
+```text
+Manual
+```
+
+---
+
+## Future Goal
+
+Automate deployments from Gitea repositories to target servers.
+
+Examples:
+
+* Windows IIS servers
+* Application servers
+* Test environments
+* Future Linux deployments
+
+---
+
+## Planned Architecture
+
+```text
+Developer
+    ↓
+Git Commit
+    ↓
+Gitea
+    ↓
+Gitea Actions
+    ↓
+Build
+    ↓
+Test
+    ↓
+Deploy
+    ↓
+Target Server
+```
+
+---
+
+## Deployment Targets
+
+### Windows IIS
+
+Purpose:
+
+Deploy:
+
+* ASP.NET Core
+* Blazor Server
+* Blazor Web App
+
+Method:
+
+```text
+Publish
+→ Copy Files
+→ Restart IIS Site
+```
+
+Status:
+
+Planned
+
+---
+
+### Linux Containers
+
+Purpose:
+
+Future Docker deployments.
+
+Method:
+
+```text
+Build Docker Image
+→ Push Image
+→ Deploy Stack
+```
+
+Status:
+
+Future
+
+---
+
+## Planned Tooling
+
+### Gitea Actions
+
+Purpose:
+
+* Build automation
+* Testing
+* Deployment automation
+
+Status:
+
+Planned
+
+---
+
+### Self-Hosted Runner
+
+Purpose:
+
+Execute build pipelines.
+
+Potential Location:
+
+```text
+SilverLinux
+```
+
+Status:
+
+Planned
+
+---
+
+## Pipeline Stages
+
+### Build
+
+Examples:
+
+* Restore NuGet packages
+* Build solution
+* Publish application
+
+---
+
+### Test
+
+Examples:
+
+* Unit tests
+* Integration tests
+* Build validation
+
+---
+
+### Deploy
+
+Examples:
+
+* IIS deployment
+* Docker deployment
+* Environment updates
+
+---
+
+## Notifications
+
+Future CI/CD notifications should use:
+
+```text
+noreply@silveressence.net
+```
+
+Examples:
+
+* Build succeeded
+* Build failed
+* Deployment completed
+* Deployment failed
+
+---
+
+## Security
+
+Deployment credentials should never be stored in repositories.
+
+Store credentials in:
+
+```text
+/ srv/secrets/company.env
+```
+
+or platform-specific secret stores.
+
+---
+
+## Initial Target
+
+First automated deployment target:
+
+```text
+Gitea
+    →
+Windows Server IIS
+    →
+Blazor Applications
+```
+
+This provides the highest immediate value.
+
+---
+
+## Future Enhancements
+
+* Automatic testing
+* Automatic deployment
+* Release pipelines
+* Docker image registry
+* BaGet integration
+* Multi-environment deployments
+
+---
+
+## Related Services
+
+* Gitea
+* Portainer
+* Nginx Proxy Manager
+
+---
+
+## Related Documentation
+
+* gitea/README.md
+* docs/server.md
+* docs/security.md

docs/decisions.md

@@ -0,0 +1,243 @@
+# Architecture Decisions
+
+## Purpose
+
+This document records important architectural and operational decisions made for SilverLinux.
+
+The goal is to document not only what was implemented, but also why the decision was made.
+
+---
+
+## 2026-06-17
+
+### Ubuntu 24.04 LTS Selected
+
+Decision:
+
+Use Ubuntu Server 24.04 LTS as the operating system.
+
+Reason:
+
+* Long-term support
+* Large community
+* Excellent Docker support
+* Familiar administration tools
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### Docker Standardization
+
+Decision:
+
+All services should run in Docker containers whenever possible.
+
+Reason:
+
+* Consistent deployment
+* Easier backups
+* Easier migrations
+* Better isolation
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### Nginx Proxy Manager Selected
+
+Decision:
+
+Use Nginx Proxy Manager as the reverse proxy solution.
+
+Reason:
+
+* Easy SSL management
+* Simple administration
+* User-friendly interface
+* Fast deployment
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### Gitea Selected
+
+Decision:
+
+Use Gitea for source control.
+
+Reason:
+
+* Self-hosted
+* Lightweight
+* GitHub-like experience
+* Excellent Docker support
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### PostgreSQL Selected
+
+Decision:
+
+Use PostgreSQL as the central database platform.
+
+Reason:
+
+* Reliability
+* Mature ecosystem
+* Supports multiple applications
+* Strong backup tooling
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### OpenProject Selected
+
+Decision:
+
+Use OpenProject for project management.
+
+Reason:
+
+* Mature platform
+* Open source
+* Strong planning features
+* Work package management
+* Time tracking
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-21
+
+### Plane.so Removed
+
+Decision:
+
+Do not deploy Plane.so.
+
+Reason:
+
+* OpenProject fully satisfies requirements
+* Reduces maintenance burden
+* Avoids duplicate functionality
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-21
+
+### Centralized Secrets Management
+
+Decision:
+
+Store shared credentials in a single secrets file.
+
+Location:
+
+```text
+/srv/secrets/company.env
+```
+
+Reason:
+
+* Avoid secrets in Docker Compose files
+* Easier credential rotation
+* Easier disaster recovery
+* Reduced risk of accidental exposure
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-21
+
+### OpenID Disabled in Gitea
+
+Decision:
+
+Disable OpenID authentication.
+
+Reason:
+
+* Not required
+* Reduces attack surface
+* Simplifies authentication model
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-21
+
+### Gmail SMTP Selected
+
+Decision:
+
+Use Gmail SMTP for outbound email.
+
+Sender:
+
+```text
+noreply@silveressence.net
+```
+
+Reason:
+
+* Reliable delivery
+* Easy setup
+* Supports application notifications
+
+Status:
+
+Implemented
+
+---
+
+## Future Decisions
+
+Document future decisions using the following template:
+
+Date:
+
+Decision:
+
+Reason:
+
+Alternatives Considered:
+
+Status:

docs/domains.md

@@ -0,0 +1,204 @@
+# Domains
+
+## Overview
+
+This document contains the public domains used by SilverLinux and the services they expose.
+
+All public services are routed through Nginx Proxy Manager.
+
+---
+
+## Primary Domain
+
+```text
+silveressence.net
+```
+
+Used for:
+
+* Public services
+* Subdomains
+* SSL certificates
+
+---
+
+## Active Domains
+
+### Gitea
+
+Domain:
+
+```text
+git.silveressence.net
+```
+
+Purpose:
+
+* Source control
+* Git repositories
+* Pull requests
+* Issue tracking
+
+Container:
+
+```text
+gitea
+```
+
+---
+
+### OpenProject
+
+Domain:
+
+```text
+team.silveressence.net
+```
+
+Purpose:
+
+* Project management
+* Work packages
+* Time tracking
+* Team collaboration
+
+Container:
+
+```text
+openproject
+```
+
+---
+
+### Jitsi Meet
+
+Domain:
+
+```text
+meet.silveressence.net
+```
+
+Purpose:
+
+* Video conferencing
+* Team meetings
+* Customer meetings
+
+Container Stack:
+
+```text
+jitsi
+```
+
+---
+
+### Portainer
+
+Domain:
+
+```text
+portainer.silveressence.net
+```
+
+Purpose:
+
+* Docker management
+* Infrastructure administration
+
+Container:
+
+```text
+portainer
+```
+
+---
+
+## Planned Domains
+
+### BaGet
+
+Domain:
+
+```text
+nuget.silveressence.net
+```
+
+Purpose:
+
+* Private NuGet package hosting
+
+Status:
+
+```text
+Planned
+```
+
+---
+
+## DNS
+
+DNS records should point to:
+
+```text
+51.255.83.140
+```
+
+Server:
+
+```text
+SilverLinux
+```
+
+---
+
+## SSL Certificates
+
+SSL certificates are managed through:
+
+```text
+Nginx Proxy Manager
+```
+
+Certificate data location:
+
+```text
+/srv/docker/nginx-proxy-manager/letsencrypt
+```
+
+---
+
+## Routing
+
+Internet
+↓
+Nginx Proxy Manager
+↓
+Service Container
+
+Examples:
+
+```text
+git.silveressence.net
+    ↓
+gitea
+
+team.silveressence.net
+    ↓
+openproject
+
+meet.silveressence.net
+    ↓
+jitsi
+
+portainer.silveressence.net
+    ↓
+portainer
+```
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/security.md
+* nginx-proxy-manager/README.md

docs/email.md

@@ -0,0 +1,205 @@
+# Email Configuration
+
+## Overview
+
+SilverLinux uses a centralized SMTP configuration for application email delivery.
+
+Email is used for:
+
+* Password resets
+* User invitations
+* Notifications
+* System alerts
+* Future CI/CD notifications
+
+---
+
+## Sender Address
+
+```text
+noreply@silveressence.net
+```
+
+Purpose:
+
+* Automated emails
+* Application notifications
+* No inbound processing required
+
+---
+
+## SMTP Provider
+
+Provider:
+
+```text
+Gmail SMTP
+```
+
+Server:
+
+```text
+smtp.gmail.com
+```
+
+Port:
+
+```text
+587
+```
+
+Security:
+
+```text
+STARTTLS
+```
+
+Authentication:
+
+```text
+Login
+```
+
+---
+
+## Secret Storage
+
+SMTP credentials are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Variables:
+
+```text
+SMTP_HOST
+SMTP_PORT
+SMTP_USERNAME
+SMTP_PASSWORD
+```
+
+These values must never be committed to Git repositories.
+
+---
+
+## Applications Using Email
+
+### OpenProject
+
+Purpose:
+
+* Password reset emails
+* Work package notifications
+* Mention notifications
+* User invitations
+
+Sender:
+
+```text
+noreply@silveressence.net
+```
+
+Status:
+
+Configured
+
+---
+
+### Gitea
+
+Purpose:
+
+* Password reset emails
+* Repository notifications
+* User invitations
+
+Sender:
+
+```text
+noreply@silveressence.net
+```
+
+Status:
+
+Configured
+
+---
+
+## Future Applications
+
+Future services should use the centralized SMTP configuration whenever possible.
+
+Examples:
+
+* BaGet
+* CI/CD notifications
+* Monitoring systems
+* Alerting systems
+
+---
+
+## Testing
+
+### OpenProject
+
+Test by:
+
+1. Creating a user.
+2. Triggering a password reset.
+3. Verifying email delivery.
+
+### Gitea
+
+Test by:
+
+1. Opening "Forgot Password".
+2. Requesting a password reset.
+3. Verifying email delivery.
+
+---
+
+## Troubleshooting
+
+### OpenProject
+
+View logs:
+
+```bash
+docker logs openproject
+```
+
+### Gitea
+
+View logs:
+
+```bash
+docker logs gitea
+```
+
+### Gmail Authentication
+
+Verify:
+
+* App password is valid
+* SMTP credentials match company.env
+* STARTTLS is enabled
+* Port 587 is used
+
+---
+
+## Security Notes
+
+* Use Gmail App Passwords.
+* Never use personal Gmail passwords.
+* Store SMTP credentials only in company.env.
+* Rotate credentials if they become exposed.
+
+---
+
+## Related Documentation
+
+* docs/secrets.md
+* docs/security.md
+* openproject/README.md
+* gitea/README.md

docs/secrets.md

@@ -0,0 +1,181 @@
+# Secrets Management
+
+## Overview
+
+SilverLinux uses a centralized secrets file for shared credentials and sensitive configuration.
+
+Location:
+
+```text
+/srv/secrets/company.env
+```
+
+This file is stored on the server and is never committed to Git.
+
+---
+
+## Purpose
+
+The secrets file provides a single location for:
+
+* SMTP credentials
+* Database passwords
+* Application secrets
+* OAuth client secrets
+* Future API keys
+
+Applications should load secrets using:
+
+```yaml
+env_file:
+  - /srv/secrets/company.env
+```
+
+---
+
+## Current Variables
+
+### Email
+
+```text
+SMTP_HOST
+SMTP_PORT
+SMTP_USERNAME
+SMTP_PASSWORD
+```
+
+Used by:
+
+* Gitea
+* OpenProject
+* Future services
+
+---
+
+### PostgreSQL
+
+```text
+POSTGRES_ROOT_PASSWORD
+POSTGRES_OPENPROJECT_PASSWORD
+```
+
+Used by:
+
+* PostgreSQL
+* OpenProject
+* Gitea
+
+---
+
+### OpenProject
+
+```text
+OPENPROJECT_SECRET_KEY_BASE
+```
+
+Used by:
+
+* OpenProject
+
+---
+
+### Jitsi
+
+```text
+JICOFO_AUTH_PASSWORD
+JVB_AUTH_PASSWORD
+JIBRI_XMPP_PASSWORD
+JIBRI_RECORDER_PASSWORD
+JIGASI_XMPP_PASSWORD
+JIGASI_TRANSCRIBER_PASSWORD
+```
+
+Used by:
+
+* Jitsi Meet
+
+---
+
+### Future OAuth
+
+```text
+GOOGLE_CLIENT_ID
+GOOGLE_CLIENT_SECRET
+
+GITHUB_CLIENT_ID
+GITHUB_CLIENT_SECRET
+
+MICROSOFT_CLIENT_ID
+MICROSOFT_CLIENT_SECRET
+```
+
+Future use:
+
+* Gitea
+* OpenProject
+* Other applications
+
+---
+
+## Rules
+
+* Never commit secrets to Git.
+* Never store passwords directly in docker-compose files.
+* Never share the contents of company.env.
+* Use environment variables whenever possible.
+* Use `.env.example` files for documentation.
+* Rotate credentials immediately if exposure is suspected.
+
+---
+
+## Backup Requirements
+
+The following file must be included in server backups:
+
+```text
+/srv/secrets/company.env
+```
+
+Loss of this file may prevent applications from starting correctly.
+
+---
+
+## Recovery Procedure
+
+If the server must be rebuilt:
+
+1. Restore `/srv/secrets/company.env`
+2. Verify file permissions
+3. Deploy Docker stacks
+4. Verify services can access required variables
+5. Verify SMTP functionality
+6. Verify database connectivity
+
+---
+
+## Security Notes
+
+The secrets file contains credentials for multiple services.
+
+Access should be restricted to system administrators only.
+
+Recommended permissions:
+
+```bash
+chmod 600 /srv/secrets/company.env
+```
+
+Recommended ownership:
+
+```bash
+root:root
+```
+
+---
+
+## Related Documents
+
+* docs/email.md
+* docs/security.md
+* docs/server.md
+* docs/backups.md

docs/security.md

@@ -0,0 +1,262 @@
+# Security
+
+## Overview
+
+SilverLinux hosts critical infrastructure for Silver Solutions.
+
+This document describes the security measures implemented on the server and operational security requirements.
+
+---
+
+## Access Control
+
+### SSH Access
+
+SSH access is limited to authorized administrators.
+
+Authentication:
+
+* SSH key authentication
+* Password login discouraged
+* Root login disabled
+
+Primary user:
+
+```text
+ubuntu
+```
+
+---
+
+## Firewall
+
+### UFW
+
+UFW is enabled and used as the primary host firewall.
+
+Allowed ports:
+
+| Port | Purpose |
+| ---- | ------- |
+| 22   | SSH     |
+| 80   | HTTP    |
+| 443  | HTTPS   |
+
+All other ports should remain blocked unless explicitly required.
+
+---
+
+## Intrusion Protection
+
+### Fail2Ban
+
+Fail2Ban is enabled.
+
+Purpose:
+
+* Detect brute-force attacks
+* Automatically block malicious IP addresses
+* Protect SSH access
+
+---
+
+## Secrets Management
+
+Shared secrets are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Examples:
+
+* SMTP credentials
+* PostgreSQL passwords
+* OpenProject secrets
+* Future OAuth secrets
+
+Rules:
+
+* Never commit secrets to Git
+* Never share secrets in documentation
+* Never hardcode passwords in Docker Compose files
+
+See:
+
+```text
+docs/secrets.md
+```
+
+---
+
+## SSL Certificates
+
+SSL certificates are managed through Nginx Proxy Manager.
+
+Certificates are automatically renewed.
+
+All public services should be accessible through HTTPS only.
+
+---
+
+## Email Security
+
+Outgoing email is provided through Gmail SMTP.
+
+Credentials are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Requirements:
+
+* Use Gmail App Passwords only
+* Never store personal account passwords
+* Rotate credentials if exposure is suspected
+
+Sender address:
+
+```text
+noreply@silveressence.net
+```
+
+---
+
+## Authentication
+
+### Current
+
+* Local user accounts
+* Strong passwords
+
+### Planned
+
+Future OAuth providers:
+
+* Google OAuth2
+* GitHub OAuth2
+
+Requirements:
+
+* Store client secrets in company.env
+* Use least-privilege scopes
+* Disable unused authentication providers
+
+### Disabled
+
+* OpenID authentication
+
+Reason:
+
+OpenID is not required and increases attack surface.
+
+---
+
+## Two-Factor Authentication
+
+Where supported:
+
+* Enable 2FA for administrator accounts
+* Encourage 2FA for all users
+
+Priority:
+
+1. Gitea administrators
+2. OpenProject administrators
+
+---
+
+## Database Security
+
+PostgreSQL is not exposed publicly.
+
+Database access is restricted to Docker internal networks.
+
+Applications communicate with PostgreSQL through the internal Docker network.
+
+---
+
+## Docker Security
+
+Services are isolated through Docker containers.
+
+Principles:
+
+* Public services should be exposed only through Nginx Proxy Manager
+* Internal services should not expose ports publicly
+* Services should communicate through Docker networks
+* Containers should run with the minimum required privileges
+
+Networks:
+
+* proxy
+* internal
+
+---
+
+## System Updates
+
+The operating system and containers should be updated regularly.
+
+Recommendations:
+
+* Apply Ubuntu security updates
+* Update Docker images periodically
+* Remove unused containers and images
+* Review security advisories for critical services
+
+---
+
+## Backup Security
+
+Backups must include:
+
+* Configuration files
+* Docker Compose files
+* Application data
+* PostgreSQL databases
+* Shared secrets
+
+Backups must never be stored inside public repositories.
+
+---
+
+## Security Review Checklist
+
+Periodically verify:
+
+* SSH keys are current
+* Unused accounts are removed
+* Fail2Ban is active
+* UFW is active
+* SSL certificates are valid
+* Secrets are not stored in repositories
+* Backups are functioning
+* Administrator accounts have 2FA enabled
+* Review application logs
+* Review Docker logs
+* Review authentication failures
+* Review Fail2Ban bans
+
+---
+
+## Incident Response
+
+If a credential is exposed:
+
+1. Rotate the credential immediately.
+2. Update `/srv/secrets/company.env`.
+3. Restart affected services.
+4. Review logs for unauthorized access.
+5. Update documentation if required.
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/secrets.md
+* docs/backups.md
+* docs/email.md
+* nginx-proxy-manager/README.md

docs/server.md

@@ -0,0 +1,275 @@
+# Server Information
+
+## Overview
+
+SilverLinux is the primary self-hosted infrastructure server for Silver Solutions.
+
+The server hosts source control, project management, collaboration, communication and supporting infrastructure services.
+
+---
+
+## Host Information
+
+| Property         | Value                   |
+| ---------------- | ----------------------- |
+| Hostname         | silverlinux             |
+| Provider         | OVH                     |
+| Operating System | Ubuntu Server 24.04 LTS |
+| Public IP        | 51.255.83.140           |
+
+---
+
+## Hardware
+
+| Resource | Value                |
+| -------- | -------------------- |
+| CPU      | Intel Xeon-D 1520    |
+| Memory   | 32 GB RAM            |
+| Storage  | 2 × 480 GB SSD RAID1 |
+
+---
+
+## Installed Software
+
+### Docker
+
+Purpose:
+
+* Container hosting
+* Service isolation
+* Deployment management
+
+### Docker Compose
+
+Purpose:
+
+* Multi-container application deployment
+* Service management
+
+### PostgreSQL
+
+Purpose:
+
+* Shared database platform
+
+### Fail2Ban
+
+Purpose:
+
+* SSH brute-force protection
+
+### UFW
+
+Purpose:
+
+* Firewall management
+
+---
+
+## Docker Networks
+
+### internal
+
+Purpose:
+
+Private communication between services.
+
+Examples:
+
+* Gitea → PostgreSQL
+* OpenProject → PostgreSQL
+
+---
+
+### proxy
+
+Purpose:
+
+Public-facing services behind Nginx Proxy Manager.
+
+Examples:
+
+* Gitea
+* OpenProject
+* Jitsi Meet
+* Portainer
+
+---
+
+## Running Services
+
+* PostgreSQL
+* Gitea
+* OpenProject
+* Jitsi Meet
+* Portainer
+* Nginx Proxy Manager
+
+---
+
+## Directory Structure
+
+### Docker Services
+
+```text
+/srv/docker
+```
+
+Contains:
+
+```text
+/srv/docker/gitea
+/srv/docker/openproject
+/srv/docker/postgres
+/srv/docker/jitsi
+/srv/docker/portainer
+/srv/docker/nginx-proxy-manager
+```
+
+---
+
+### Shared Secrets
+
+```text
+/srv/secrets/company.env
+```
+
+Contains:
+
+* SMTP credentials
+* Database passwords
+* Application secrets
+* Future OAuth credentials
+
+---
+
+### Backups
+
+```text
+/srv/backups
+```
+
+Suggested structure:
+
+```text
+/srv/backups/daily
+/srv/backups/weekly
+/srv/backups/monthly
+```
+
+---
+
+## Service Data Locations
+
+### Gitea
+
+```text
+/srv/docker/gitea/data
+```
+
+---
+
+### OpenProject
+
+```text
+/srv/docker/openproject/assets
+```
+
+---
+
+### PostgreSQL
+
+```text
+/srv/docker/postgres/data
+```
+
+---
+
+### Nginx Proxy Manager
+
+```text
+/srv/docker/nginx-proxy-manager/data
+/srv/docker/nginx-proxy-manager/letsencrypt
+```
+
+---
+
+### Jitsi
+
+```text
+/srv/docker/jitsi
+```
+
+---
+
+## SSH Access
+
+Primary user:
+
+```text
+ubuntu
+```
+
+Authentication:
+
+* SSH key authentication
+* Root login disabled
+
+---
+
+## Security
+
+Implemented:
+
+* UFW enabled
+* Fail2Ban enabled
+* Shared secrets stored outside Git repositories
+* SSL certificates managed through Nginx Proxy Manager
+* PostgreSQL not exposed publicly
+* OpenID disabled in Gitea
+
+---
+
+## Email
+
+Sender address:
+
+```text
+noreply@silveressence.net
+```
+
+SMTP credentials are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Used by:
+
+* Gitea
+* OpenProject
+
+---
+
+## Disaster Recovery
+
+This repository should contain enough information to rebuild the SilverLinux environment from scratch.
+
+Recovery priorities:
+
+1. Restore secrets
+2. Restore PostgreSQL
+3. Restore Nginx Proxy Manager
+4. Restore Gitea
+5. Restore OpenProject
+6. Restore remaining services
+
+---
+
+## Related Documentation
+
+* docs/secrets.md
+* docs/security.md
+* docs/backups.md
+* docs/services.md
+* docs/domains.md

docs/services.md

@@ -1,7 +1,33 @@
 # Services
 
+## Overview
+
+This document lists all services running on SilverLinux and their purpose.
+
+---
+
 ## Running Services
 
+### PostgreSQL
+
+Purpose:
+
+* Shared database platform
+* Application data storage
+
+Used by:
+
+* Gitea
+* OpenProject
+
+Status:
+
+```text
+Running
+```
+
+---
+
 ### Gitea
 
 URL:
@@ -12,13 +38,61 @@ https://git.silveressence.net
 
 Purpose:
 
+* Source control
 * Git repositories
 * Pull requests
-* Source control
+* Issue tracking
 
 Status:
 
-* Running
+```text
+Running
+```
+
+---
+
+### OpenProject
+
+URL:
+
+```text
+https://team.silveressence.net
+```
+
+Purpose:
+
+* Project management
+* Work packages
+* Time tracking
+* Team collaboration
+
+Status:
+
+```text
+Running
+```
+
+---
+
+### Jitsi Meet
+
+URL:
+
+```text
+https://meet.silveressence.net
+```
+
+Purpose:
+
+* Video conferencing
+* Team meetings
+* Customer meetings
+
+Status:
+
+```text
+Running
+```
 
 ---
 
@@ -34,44 +108,127 @@ Purpose:
 
 * Docker administration
 * Stack deployment
+* Container monitoring
 
 Status:
 
-* Running
+```text
+Running
+```
 
 ---
 
-### Nginx
+### Nginx Proxy Manager
 
 Purpose:
 
-- Reverse proxy
-- SSL termination
-- Domain routing
+* Reverse proxy
+* SSL termination
+* Domain routing
+* Certificate management
 
 Status:
 
-- Running
-- Docker hosted
+```text
+Running
+```
+
+---
+
+## Shared Infrastructure
+
+### Docker
+
+Purpose:
+
+* Container hosting
+* Service isolation
+
+Status:
+
+```text
+Running
+```
+
+---
+
+### Internal Docker Network
+
+Purpose:
+
+* Private communication between services
+
+Status:
+
+```text
+Running
+```
+
+---
+
+### Shared Secrets
+
+Location:
+
+```text
+/srv/secrets/company.env
+```
+
+Purpose:
+
+* SMTP credentials
+* Database passwords
+* Application secrets
+
+Status:
+
+```text
+Active
+```
+
+---
 
 ## Planned Services
 
 ### BaGet
 
+URL:
+
+```text
+https://nuget.silveressence.net
+```
+
 Purpose:
 
-* Private NuGet feed
+* Private NuGet package hosting
 
 Status:
 
-* Planned
+```text
+Planned
+```
+
+---
+
+## Removed Services
 
 ### Plane.so
 
-Purpose:
+Reason:
 
-* Project management
+OpenProject was selected as the primary project management platform.
 
 Status:
 
-* Planned
+```text
+Removed
+```
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/domains.md
+* docs/security.md
+* docs/backups.md

gitea/.env.example

@@ -0,0 +1,30 @@
+services:
+  gitea:
+    image: gitea/gitea:latest
+    container_name: gitea
+    restart: unless-stopped
+    environment:
+      USER_UID: 1000
+      USER_GID: 1000
+      GITEA__database__DB_TYPE: postgres
+      GITEA__database__HOST: postgres:5432
+      GITEA__database__NAME: gitea
+      GITEA__database__USER: postgres
+      GITEA__database__PASSWD: Saeed123!
+      GITEA__server__DOMAIN: git.silveressence.net
+      GITEA__server__ROOT_URL: https://git.silveressence.net/
+      GITEA__server__SSH_DOMAIN: git.silveressence.net
+      GITEA__server__SSH_PORT: 2222
+    volumes:
+      - /srv/docker/gitea/data:/data
+    ports:
+      - "2222:22"
+    networks:
+      - proxy
+      - internal
+
+networks:
+  proxy:
+    external: true
+  internal:
+    external: true

gitea/README.md

@@ -0,0 +1,358 @@
+# Gitea
+
+## Overview
+
+Gitea is the self-hosted Git platform used by Silver Solutions.
+
+It provides:
+
+* Git repository hosting
+* Pull requests
+* Issue tracking
+* Wiki support
+* Releases
+* CI/CD integration
+* Package registry support
+
+Gitea serves as the central source control platform for SilverLinux infrastructure and application development.
+
+---
+
+## Service Information
+
+### URL
+
+```text
+https://git.silveressence.net
+```
+
+### Container Name
+
+```text
+gitea
+```
+
+### Image
+
+```text
+gitea/gitea:latest
+```
+
+### Docker Networks
+
+```text
+proxy
+internal
+```
+
+---
+
+## Purpose
+
+Gitea is used for:
+
+* Source control
+* Infrastructure repositories
+* Application repositories
+* Pull requests
+* Issue management
+* Release management
+* Future CI/CD pipelines
+
+---
+
+## Database
+
+Database:
+
+```text
+gitea
+```
+
+Database Host:
+
+```text
+postgres
+```
+
+Database User:
+
+```text
+postgres
+```
+
+Current password source:
+
+```text
+POSTGRES_ROOT_PASSWORD
+```
+
+Stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Future improvement:
+
+Create a dedicated Gitea database user and password.
+
+---
+
+## Email Configuration
+
+Sender Address:
+
+```text
+noreply@silveressence.net
+```
+
+Purpose:
+
+* Password reset emails
+* Account notifications
+* Repository notifications
+* User invitations
+
+SMTP configuration is loaded from:
+
+```text
+/srv/secrets/company.env
+```
+
+Variables:
+
+```text
+SMTP_HOST
+SMTP_PORT
+SMTP_USERNAME
+SMTP_PASSWORD
+```
+
+---
+
+## Authentication
+
+### Current
+
+* Local user accounts
+* Email login
+* Password login
+
+### Disabled
+
+OpenID authentication is disabled.
+
+Reason:
+
+OpenID is not required and increases the attack surface.
+
+### Planned
+
+Future authentication providers:
+
+* Google OAuth2
+* GitHub OAuth2
+
+Purpose:
+
+* Easier onboarding of freelancers
+* Easier onboarding of external collaborators
+* Reduced password management
+
+---
+
+## SSH Access
+
+SSH Domain:
+
+```text
+git.silveressence.net
+```
+
+SSH Port:
+
+```text
+2222
+```
+
+Clone example:
+
+```bash
+git clone ssh://git@git.silveressence.net:2222/username/repository.git
+```
+
+---
+
+## Data Storage
+
+Application Data:
+
+```text
+/srv/docker/gitea/data
+```
+
+Contains:
+
+* Repositories
+* Attachments
+* Configuration
+* Actions data
+* Package registry data
+* User information
+
+This directory is critical and must be included in backups.
+
+---
+
+## Secrets
+
+The following secrets are loaded from:
+
+```text
+/srv/secrets/company.env
+```
+
+Variables:
+
+```text
+POSTGRES_ROOT_PASSWORD
+
+SMTP_HOST
+SMTP_PORT
+SMTP_USERNAME
+SMTP_PASSWORD
+```
+
+Future variables:
+
+```text
+GOOGLE_CLIENT_ID
+GOOGLE_CLIENT_SECRET
+
+GITHUB_CLIENT_ID
+GITHUB_CLIENT_SECRET
+```
+
+---
+
+## Docker Configuration
+
+Volume Mapping:
+
+```text
+/srv/docker/gitea/data:/data
+```
+
+Port Mapping:
+
+```text
+2222:22
+```
+
+Networks:
+
+```text
+proxy
+internal
+```
+
+HTTP traffic is routed through Nginx Proxy Manager.
+
+---
+
+## Administration
+
+View Logs:
+
+```bash
+docker logs gitea
+```
+
+Restart Service:
+
+```bash
+docker restart gitea
+```
+
+Open Shell:
+
+```bash
+docker exec -it gitea bash
+```
+
+---
+
+## Backup Requirements
+
+The following items must be backed up:
+
+### Database
+
+```text
+gitea
+```
+
+### Application Data
+
+```text
+/srv/docker/gitea/data
+```
+
+### Secrets
+
+```text
+/srv/secrets/company.env
+```
+
+Without these items, a complete restoration is not possible.
+
+---
+
+## Recovery Checklist
+
+To restore Gitea:
+
+1. Restore PostgreSQL database.
+2. Restore Gitea data directory.
+3. Restore company.env secrets.
+4. Deploy Docker Compose stack.
+5. Verify SMTP configuration.
+6. Verify SSH access.
+7. Verify access through Nginx Proxy Manager.
+
+---
+
+## Future Roadmap
+
+### Short Term
+
+* Enable 2FA for administrator accounts
+* Configure backup automation
+* Configure Google OAuth2
+* Configure GitHub OAuth2
+
+### Long Term
+
+* Implement CI/CD pipelines
+* Deploy applications directly from Gitea
+* Host private NuGet packages through BaGet
+
+---
+
+## Related Services
+
+* PostgreSQL
+* Nginx Proxy Manager
+* OpenProject
+* Portainer
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/security.md
+* docs/secrets.md
+* docs/backups.md
+* postgres/README.md

gitea/docker-compose.yml

@@ -0,0 +1,30 @@
+services:
+  gitea:
+    image: gitea/gitea:latest
+    container_name: gitea
+    restart: unless-stopped
+    environment:
+      USER_UID: 1000
+      USER_GID: 1000
+      GITEA__database__DB_TYPE: postgres
+      GITEA__database__HOST: postgres:5432
+      GITEA__database__NAME: gitea
+      GITEA__database__USER: postgres
+      GITEA__database__PASSWD: Saeed123!
+      GITEA__server__DOMAIN: git.silveressence.net
+      GITEA__server__ROOT_URL: https://git.silveressence.net/
+      GITEA__server__SSH_DOMAIN: git.silveressence.net
+      GITEA__server__SSH_PORT: 2222
+    volumes:
+      - /srv/docker/gitea/data:/data
+    ports:
+      - "2222:22"
+    networks:
+      - proxy
+      - internal
+
+networks:
+  proxy:
+    external: true
+  internal:
+    external: true

jitsi/.env.example

@@ -0,0 +1,19 @@
+PUBLIC_URL=https://meet.silveressence.net
+
+HTTP_PORT=8000
+HTTPS_PORT=8443
+
+TZ=Europe/Amsterdam
+
+ENABLE_AUTH=1
+ENABLE_GUESTS=1
+AUTH_TYPE=internal
+
+JVB_ADVERTISE_IPS=51.255.83.140
+
+JICOFO_AUTH_PASSWORD=
+JVB_AUTH_PASSWORD=
+JIBRI_XMPP_PASSWORD=
+JIBRI_RECORDER_PASSWORD=
+JIGASI_XMPP_PASSWORD=
+JIGASI_TRANSCRIBER_PASSWORD=

jitsi/README.md

@@ -0,0 +1,74 @@
+# Jitsi Meet
+
+## Overview
+
+Jitsi Meet provides video conferencing capabilities for Silver Solutions.
+
+URL:
+
+https://meet.silveressence.net
+
+---
+
+## Purpose
+
+- Team meetings
+- Customer meetings
+- Screen sharing
+- Browser-based conferencing
+
+---
+
+## Authentication
+
+Current configuration:
+
+- Internal authentication enabled
+- Guest access enabled
+
+Configuration stored in:
+
+/srv/docker/jitsi/jitsi-docker-jitsi-meet-aa76415/.env
+
+---
+
+## Important Secrets
+
+Stored in:
+
+/srv/secrets/company.env
+
+Variables:
+
+- JICOFO_AUTH_PASSWORD
+- JVB_AUTH_PASSWORD
+- JIBRI_XMPP_PASSWORD
+- JIBRI_RECORDER_PASSWORD
+- JIGASI_XMPP_PASSWORD
+- JIGASI_TRANSCRIBER_PASSWORD
+
+---
+
+## Ports
+
+| Port | Purpose |
+|--------|---------|
+| 80 | HTTP |
+| 443 | HTTPS |
+| 10000/UDP | Media Traffic |
+
+---
+
+## Data Location
+
+Configuration:
+
+/srv/docker/jitsi
+
+---
+
+## Related Documentation
+
+- docs/server.md
+- docs/security.md
+- docs/secrets.md

nginx-proxy-manager/README.md

@@ -0,0 +1,204 @@
+# Nginx Proxy Manager
+
+## Overview
+
+Nginx Proxy Manager (NPM) is the public entry point for all internet-facing services hosted on SilverLinux.
+
+It provides:
+
+* Reverse proxy routing
+* SSL certificate management
+* HTTPS termination
+* Domain forwarding
+* Centralized access to services
+
+All public services should be exposed through Nginx Proxy Manager instead of directly exposing application ports.
+
+---
+
+## Service Information
+
+Container Name:
+
+```text
+nginx-proxy-manager
+```
+
+Image:
+
+```text
+jc21/nginx-proxy-manager:latest
+```
+
+Docker Network:
+
+```text
+proxy
+```
+
+---
+
+## Ports
+
+| Port | Purpose                            |
+| ---- | ---------------------------------- |
+| 80   | HTTP                               |
+| 81   | Nginx Proxy Manager Administration |
+| 443  | HTTPS                              |
+
+---
+
+## Data Storage
+
+### Application Data
+
+```text
+/srv/docker/nginx-proxy-manager/data
+```
+
+Contains:
+
+* Proxy host configuration
+* Access lists
+* Users
+* Application settings
+* SSL metadata
+
+---
+
+### SSL Certificates
+
+```text
+/srv/docker/nginx-proxy-manager/letsencrypt
+```
+
+Contains:
+
+* Let's Encrypt certificates
+* Private keys
+* Renewal information
+
+This folder is critical for disaster recovery.
+
+---
+
+## Responsibilities
+
+Nginx Proxy Manager is responsible for:
+
+### Reverse Proxy
+
+Routing incoming requests to Docker containers.
+
+Examples:
+
+| Domain                      | Target Service |
+| --------------------------- | -------------- |
+| git.silveressence.net       | Gitea          |
+| team.silveressence.net      | OpenProject    |
+| meet.silveressence.net      | Jitsi          |
+| portainer.silveressence.net | Portainer      |
+
+---
+
+### SSL Certificates
+
+Provides:
+
+* HTTPS encryption
+* Certificate renewal
+* Certificate management
+
+All public services should use HTTPS.
+
+---
+
+### Domain Management
+
+Centralized management for:
+
+* Domains
+* Subdomains
+* SSL certificates
+* Proxy routing
+
+---
+
+## Docker Configuration
+
+Volumes:
+
+```text
+/srv/docker/nginx-proxy-manager/data:/data
+/srv/docker/nginx-proxy-manager/letsencrypt:/etc/letsencrypt
+```
+
+Network:
+
+```text
+proxy
+```
+
+Applications exposed through NPM must be connected to the proxy network.
+
+---
+
+## Administration
+
+Web Interface:
+
+```text
+https://portainer.silveressence.net
+```
+
+Nginx Proxy Manager Admin:
+
+```text
+http://SERVER-IP:81
+```
+
+or through the configured domain if one exists.
+
+---
+
+## Backup Requirements
+
+The following directories must be backed up:
+
+```text
+/srv/docker/nginx-proxy-manager/data
+/srv/docker/nginx-proxy-manager/letsencrypt
+```
+
+Without these directories:
+
+* SSL certificates are lost
+* Proxy configurations are lost
+* Domain mappings must be recreated
+
+---
+
+## Security Notes
+
+* Only ports 80 and 443 should be exposed publicly.
+* Administrative access should be restricted.
+* SSL certificates should be renewed automatically.
+* Services should never be exposed directly to the internet when NPM can proxy them.
+
+---
+
+## Related Services
+
+* Gitea
+* OpenProject
+* Jitsi Meet
+* Portainer
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/security.md
+* docs/domains.md
+* docs/backups.md

nginx-proxy-manager/docker-compose.yml

@@ -0,0 +1,21 @@
+services:
+  nginx-proxy-manager:
+    image: jc21/nginx-proxy-manager:latest
+    container_name: nginx-proxy-manager
+    restart: unless-stopped
+
+    ports:
+      - "80:80"
+      - "81:81"
+      - "443:443"
+
+    volumes:
+      - /srv/docker/nginx-proxy-manager/data:/data
+      - /srv/docker/nginx-proxy-manager/letsencrypt:/etc/letsencrypt
+
+    networks:
+      - proxy
+
+networks:
+  proxy:
+    external: true

openproject/.env.example

@@ -0,0 +1,37 @@
+services:
+  openproject:
+    image: openproject/openproject:17
+    container_name: openproject
+    restart: unless-stopped
+
+    env_file:
+      - /srv/secrets/company.env
+
+    environment:
+      SECRET_KEY_BASE: ${OPENPROJECT_SECRET_KEY_BASE}
+      OPENPROJECT_HOST__NAME: team.silveressence.net
+      OPENPROJECT_HTTPS: "true"
+
+      DATABASE_URL: postgres://openproject:${POSTGRES_OPENPROJECT_PASSWORD}@postgres:5432/openproject
+
+      OPENPROJECT_EMAIL__DELIVERY__METHOD: smtp
+      OPENPROJECT_SMTP__ADDRESS: ${SMTP_HOST}
+      OPENPROJECT_SMTP__PORT: "${SMTP_PORT}"
+      OPENPROJECT_SMTP__DOMAIN: silveressence.net
+      OPENPROJECT_SMTP__AUTHENTICATION: login
+      OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
+      OPENPROJECT_SMTP__USER__NAME: ${SMTP_USERNAME}
+      OPENPROJECT_SMTP__PASSWORD: ${SMTP_PASSWORD}
+
+    volumes:
+      - /srv/docker/openproject/assets:/var/openproject/assets
+
+    ports:
+      - "8082:80"
+
+    networks:
+      - internal
+
+networks:
+  internal:
+    external: true

openproject/README.md

@@ -0,0 +1,269 @@
+# OpenProject
+
+## Overview
+
+OpenProject is the project management and collaboration platform used by Silver Solutions.
+
+It provides:
+
+* Project management
+* Task tracking
+* Work packages
+* Time tracking
+* Roadmaps
+* Team collaboration
+* Document management
+
+OpenProject replaces the previously planned Plane.so deployment.
+
+---
+
+## Service Information
+
+### URL
+
+```text
+https://team.silveressence.net
+```
+
+### Container Name
+
+```text
+openproject
+```
+
+### Image
+
+```text
+openproject/openproject:17
+```
+
+### Docker Network
+
+```text
+internal
+```
+
+---
+
+## Purpose
+
+OpenProject is used for:
+
+* Project planning
+* Task management
+* Development tracking
+* Internal collaboration
+* Customer project management
+* Team planning
+
+---
+
+## Database
+
+Database:
+
+```text
+openproject
+```
+
+Database User:
+
+```text
+openproject
+```
+
+Database Host:
+
+```text
+postgres
+```
+
+Database access is provided through the internal Docker network.
+
+---
+
+## Email Configuration
+
+Sender Address:
+
+```text
+noreply@silveressence.net
+```
+
+Purpose:
+
+* Password reset emails
+* User notifications
+* Work package notifications
+* Mention notifications
+* Project updates
+
+SMTP credentials are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+---
+
+## Data Storage
+
+Assets Location:
+
+```text
+/srv/docker/openproject/assets
+```
+
+Contains:
+
+* Attachments
+* Uploaded files
+* Application assets
+* User generated content
+
+This directory must be included in backups.
+
+---
+
+## Secrets
+
+The following values are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Variables:
+
+```text
+POSTGRES_OPENPROJECT_PASSWORD
+OPENPROJECT_SECRET_KEY_BASE
+
+SMTP_HOST
+SMTP_PORT
+SMTP_USERNAME
+SMTP_PASSWORD
+```
+
+Secrets must never be committed to Git.
+
+---
+
+## Authentication
+
+Current Authentication:
+
+* Local accounts
+
+Future Considerations:
+
+* Google OAuth2
+* GitHub OAuth2
+* Microsoft Entra ID
+
+---
+
+## Docker Configuration
+
+Volume Mapping:
+
+```text
+/srv/docker/openproject/assets:/var/openproject/assets
+```
+
+Port Mapping:
+
+```text
+8082:80
+```
+
+Network:
+
+```text
+internal
+```
+
+OpenProject should not be exposed directly to the internet.
+
+Access should be routed through Nginx Proxy Manager.
+
+---
+
+## Administration
+
+View Logs:
+
+```bash
+docker logs openproject
+```
+
+Restart Service:
+
+```bash
+docker restart openproject
+```
+
+Open Shell:
+
+```bash
+docker exec -it openproject bash
+```
+
+---
+
+## Backup Requirements
+
+The following items must be backed up:
+
+### Database
+
+```text
+openproject
+```
+
+### Assets
+
+```text
+/srv/docker/openproject/assets
+```
+
+### Secrets
+
+```text
+/srv/secrets/company.env
+```
+
+Without these items, a complete restoration is not possible.
+
+---
+
+## Recovery Checklist
+
+To restore OpenProject:
+
+1. Restore PostgreSQL database.
+2. Restore OpenProject assets directory.
+3. Restore company.env secrets.
+4. Deploy Docker Compose stack.
+5. Verify SMTP configuration.
+6. Verify access through Nginx Proxy Manager.
+
+---
+
+## Related Services
+
+* PostgreSQL
+* Nginx Proxy Manager
+* Gitea
+* Portainer
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/security.md
+* docs/secrets.md
+* docs/backups.md
+* postgres/README.md

openproject/docker-compose.yml

@@ -0,0 +1,37 @@
+services:
+  openproject:
+    image: openproject/openproject:17
+    container_name: openproject
+    restart: unless-stopped
+
+    env_file:
+      - /srv/secrets/company.env
+
+    environment:
+      SECRET_KEY_BASE: ${OPENPROJECT_SECRET_KEY_BASE}
+      OPENPROJECT_HOST__NAME: team.silveressence.net
+      OPENPROJECT_HTTPS: "true"
+
+      DATABASE_URL: postgres://openproject:${POSTGRES_OPENPROJECT_PASSWORD}@postgres:5432/openproject
+
+      OPENPROJECT_EMAIL__DELIVERY__METHOD: smtp
+      OPENPROJECT_SMTP__ADDRESS: ${SMTP_HOST}
+      OPENPROJECT_SMTP__PORT: "${SMTP_PORT}"
+      OPENPROJECT_SMTP__DOMAIN: silveressence.net
+      OPENPROJECT_SMTP__AUTHENTICATION: login
+      OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
+      OPENPROJECT_SMTP__USER__NAME: ${SMTP_USERNAME}
+      OPENPROJECT_SMTP__PASSWORD: ${SMTP_PASSWORD}
+
+    volumes:
+      - /srv/docker/openproject/assets:/var/openproject/assets
+
+    ports:
+      - "8082:80"
+
+    networks:
+      - internal
+
+networks:
+  internal:
+    external: true

portainer/README.md

@@ -0,0 +1,153 @@
+# Portainer
+
+## Overview
+
+Portainer provides a web-based management interface for Docker on SilverLinux.
+
+It is used to manage containers, networks, volumes, images and Docker stacks through a graphical interface instead of using the command line.
+
+---
+
+## Service Information
+
+### URL
+
+```text
+https://portainer.silveressence.net
+```
+
+### Container Name
+
+```text
+portainer
+```
+
+### Image
+
+```text
+portainer/portainer-ce:latest
+```
+
+### Docker Network
+
+```text
+proxy
+```
+
+---
+
+## Purpose
+
+Portainer is used for:
+
+* Managing Docker containers
+* Managing Docker networks
+* Managing Docker volumes
+* Viewing logs
+* Deploying Docker stacks
+* Monitoring running services
+* Performing container maintenance
+
+---
+
+## Data Storage
+
+### Docker Socket
+
+```text
+/var/run/docker.sock
+```
+
+This allows Portainer to communicate with the Docker engine.
+
+### Portainer Data
+
+Docker Volume:
+
+```text
+portainer_portainer_data
+```
+
+Purpose:
+
+* User accounts
+* Configuration
+* Stack definitions
+* Environment settings
+
+---
+
+## Security
+
+Portainer has administrative access to Docker.
+
+Because Portainer uses the Docker socket, users with Portainer administrator access effectively have administrative access to the server.
+
+Only trusted administrators should have access.
+
+---
+
+## Backup Requirements
+
+The following volume should be included in backups:
+
+```text
+portainer_portainer_data
+```
+
+Loss of this volume will result in:
+
+* Loss of Portainer users
+* Loss of stack definitions
+* Loss of Portainer configuration
+
+Docker containers and application data remain unaffected.
+
+---
+
+## Network Configuration
+
+Portainer is connected to the Docker proxy network.
+
+Applications exposed through Nginx Proxy Manager can communicate with Portainer through this network.
+
+---
+
+## Maintenance
+
+View logs:
+
+```bash
+docker logs portainer
+```
+
+Restart:
+
+```bash
+docker restart portainer
+```
+
+Open shell:
+
+```bash
+docker exec -it portainer /bin/sh
+```
+
+---
+
+## Related Services
+
+* Nginx Proxy Manager
+* Docker
+* PostgreSQL
+* Gitea
+* OpenProject
+* Jitsi Meet
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/security.md
+* docs/backups.md

portainer/docker-compose.yml

@@ -0,0 +1,20 @@
+services:
+  portainer:
+    image: portainer/portainer-ce:latest
+    container_name: portainer
+    restart: unless-stopped
+
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - portainer_data:/data
+
+    networks:
+      - proxy
+
+volumes:
+  portainer_data:
+    name: portainer_portainer_data
+
+networks:
+  proxy:
+    external: true

postgres/.env.example

@@ -0,0 +1,50 @@
+services:
+  gitea:
+    image: gitea/gitea:latest
+    container_name: gitea
+    restart: unless-stopped
+
+    env_file:
+      - /srv/secrets/company.env
+
+    environment:
+      USER_UID: "1000"
+      USER_GID: "1000"
+
+      GITEA__database__DB_TYPE: postgres
+      GITEA__database__HOST: postgres:5432
+      GITEA__database__NAME: gitea
+      GITEA__database__USER: postgres
+      GITEA__database__PASSWD: ${POSTGRES_ROOT_PASSWORD}
+
+      GITEA__server__DOMAIN: git.silveressence.net
+      GITEA__server__ROOT_URL: https://git.silveressence.net/
+      GITEA__server__SSH_DOMAIN: git.silveressence.net
+      GITEA__server__SSH_PORT: "2222"
+
+      GITEA__mailer__ENABLED: "true"
+      GITEA__mailer__FROM: noreply@silveressence.net
+      GITEA__mailer__PROTOCOL: smtp+starttls
+      GITEA__mailer__SMTP_ADDR: ${SMTP_HOST}
+      GITEA__mailer__SMTP_PORT: "${SMTP_PORT}"
+      GITEA__mailer__USER: ${SMTP_USERNAME}
+      GITEA__mailer__PASSWD: ${SMTP_PASSWORD}
+
+      GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
+      GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
+
+    volumes:
+      - /srv/docker/gitea/data:/data
+
+    ports:
+      - "2222:22"
+
+    networks:
+      - proxy
+      - internal
+
+networks:
+  proxy:
+    external: true
+  internal:
+    external: true

postgres/README.md

@@ -0,0 +1,287 @@
+# PostgreSQL
+
+## Overview
+
+PostgreSQL is the central database platform for SilverLinux.
+
+Multiple applications use the same PostgreSQL instance while maintaining separate databases and database users.
+
+This approach simplifies:
+
+* Backup management
+* Monitoring
+* Security
+* Resource utilization
+
+---
+
+## Service Information
+
+Container Name:
+
+```text
+postgres
+```
+
+Network:
+
+```text
+internal
+```
+
+Purpose:
+
+* Application databases
+* Centralized data storage
+* Shared database platform
+
+---
+
+## Current Databases
+
+### gitea
+
+Owner:
+
+```text
+gitea
+```
+
+Purpose:
+
+Source control and repository management.
+
+Used by:
+
+```text
+gitea
+```
+
+---
+
+### openproject
+
+Owner:
+
+```text
+openproject
+```
+
+Purpose:
+
+Project management and collaboration.
+
+Used by:
+
+```text
+openproject
+```
+
+---
+
+### postgres
+
+Owner:
+
+```text
+postgres
+```
+
+Purpose:
+
+Administrative database.
+
+Used for PostgreSQL administration and maintenance.
+
+---
+
+## Database Ownership
+
+| Database    | Owner       |
+| ----------- | ----------- |
+| gitea       | gitea       |
+| openproject | openproject |
+| postgres    | postgres    |
+
+Each application should use its own dedicated database user whenever possible.
+
+---
+
+## Credentials
+
+Credentials are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Current variables:
+
+```text
+POSTGRES_ROOT_PASSWORD
+POSTGRES_OPENPROJECT_PASSWORD
+```
+
+Future variables:
+
+```text
+POSTGRES_GITEA_PASSWORD
+POSTGRES_BAGET_PASSWORD
+```
+
+Passwords must never be committed to Git repositories.
+
+---
+
+## Administration
+
+Open PostgreSQL shell:
+
+```bash
+docker exec -it postgres psql -U postgres
+```
+
+---
+
+### List Databases
+
+```sql
+\l
+```
+
+---
+
+### List Roles
+
+```sql
+\du
+```
+
+---
+
+### List Connections
+
+```sql
+SELECT * FROM pg_stat_activity;
+```
+
+---
+
+## Create Database
+
+Example:
+
+```sql
+CREATE DATABASE myapp;
+```
+
+---
+
+## Create User
+
+Example:
+
+```sql
+CREATE USER myapp WITH PASSWORD 'StrongPassword';
+```
+
+Grant permissions:
+
+```sql
+GRANT ALL PRIVILEGES ON DATABASE myapp TO myapp;
+```
+
+---
+
+## Backup
+
+Create database backup:
+
+```bash
+docker exec postgres pg_dump -U postgres openproject > openproject.sql
+```
+
+Create full cluster backup:
+
+```bash
+docker exec postgres pg_dumpall -U postgres > postgres-full-backup.sql
+```
+
+---
+
+## Restore
+
+Restore database:
+
+```bash
+docker exec -i postgres psql -U postgres openproject < openproject.sql
+```
+
+Restore complete cluster:
+
+```bash
+docker exec -i postgres psql -U postgres < postgres-full-backup.sql
+```
+
+---
+
+## Security
+
+* PostgreSQL is not exposed publicly.
+* Database traffic is restricted to Docker internal networks.
+* Credentials are stored in `/srv/secrets/company.env`.
+* Administrative access should use the `postgres` role only when necessary.
+* Applications should use dedicated database users.
+
+---
+
+## Monitoring
+
+Useful commands:
+
+Database size:
+
+```sql
+SELECT pg_database.datname,
+       pg_size_pretty(pg_database_size(pg_database.datname))
+FROM pg_database;
+```
+
+Current connections:
+
+```sql
+SELECT count(*) FROM pg_stat_activity;
+```
+
+PostgreSQL version:
+
+```sql
+SELECT version();
+```
+
+---
+
+## Disaster Recovery
+
+Minimum requirements for recovery:
+
+* PostgreSQL container configuration
+* Database backups
+* `/srv/secrets/company.env`
+* Docker network configuration
+
+Without the secrets file, applications may not be able to reconnect to their databases after restoration.
+
+---
+
+## Related Services
+
+* Gitea
+* OpenProject
+
+## Related Documentation
+
+* docs/server.md
+* docs/security.md
+* docs/secrets.md
+* docs/backups.md

postgres/docker-compose.yml

@@ -0,0 +1,50 @@
+services:
+  gitea:
+    image: gitea/gitea:latest
+    container_name: gitea
+    restart: unless-stopped
+
+    env_file:
+      - /srv/secrets/company.env
+
+    environment:
+      USER_UID: "1000"
+      USER_GID: "1000"
+
+      GITEA__database__DB_TYPE: postgres
+      GITEA__database__HOST: postgres:5432
+      GITEA__database__NAME: gitea
+      GITEA__database__USER: postgres
+      GITEA__database__PASSWD: ${POSTGRES_ROOT_PASSWORD}
+
+      GITEA__server__DOMAIN: git.silveressence.net
+      GITEA__server__ROOT_URL: https://git.silveressence.net/
+      GITEA__server__SSH_DOMAIN: git.silveressence.net
+      GITEA__server__SSH_PORT: "2222"
+
+      GITEA__mailer__ENABLED: "true"
+      GITEA__mailer__FROM: noreply@silveressence.net
+      GITEA__mailer__PROTOCOL: smtp+starttls
+      GITEA__mailer__SMTP_ADDR: ${SMTP_HOST}
+      GITEA__mailer__SMTP_PORT: "${SMTP_PORT}"
+      GITEA__mailer__USER: ${SMTP_USERNAME}
+      GITEA__mailer__PASSWD: ${SMTP_PASSWORD}
+
+      GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
+      GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
+
+    volumes:
+      - /srv/docker/gitea/data:/data
+
+    ports:
+      - "2222:22"
+
+    networks:
+      - proxy
+      - internal
+
+networks:
+  proxy:
+    external: true
+  internal:
+    external: true