From a8e23d303674af42e511f9d8a1847e52467c39bc Mon Sep 17 00:00:00 2001 From: Saeed Asgari Date: Sun, 21 Jun 2026 13:35:59 +0330 Subject: [PATCH] updating the documentation of the SilverLinux Insftracture --- README.md | 103 ++++- SUMMARY.md | 229 +++++------ nginx/README.md => baget/.env.example | 0 .../README.md | 0 {nginx => baget}/docker-compose.yml | 0 docs/backups.md | 274 ++++++++++++++ docs/cicd.md | 247 ++++++++++++ docs/decisions.md | 243 ++++++++++++ docs/domains.md | 204 ++++++++++ docs/email.md | 205 ++++++++++ docs/secrets.md | 181 +++++++++ docs/security.md | 262 +++++++++++++ docs/server.md | 275 ++++++++++++++ docs/services.md | 185 ++++++++- gitea/.env.example | 30 ++ gitea/README.md | 358 ++++++++++++++++++ gitea/docker-compose.yml | 30 ++ jitsi/.env.example | 19 + jitsi/README.md | 74 ++++ .../docker-compose.yml | 0 nginx-proxy-manager/README.md | 204 ++++++++++ .../conf.d/git.silveressence.net.conf | 0 .../conf.d/nuget.silveressence.net.conf | 0 .../conf.d/portainer.silveressence.net.conf | 0 nginx-proxy-manager/docker-compose.yml | 21 + openproject/.env.example | 37 ++ openproject/README.md | 269 +++++++++++++ openproject/docker-compose.yml | 37 ++ portainer/README.md | 153 ++++++++ portainer/docker-compose.yml | 20 + postgres/.env.example | 50 +++ postgres/README.md | 287 ++++++++++++++ postgres/docker-compose.yml | 50 +++ 33 files changed, 3894 insertions(+), 153 deletions(-) rename nginx/README.md => baget/.env.example (100%) rename nginx/conf.d/git.silveressence.net.conf => baget/README.md (100%) rename {nginx => baget}/docker-compose.yml (100%) create mode 100644 docs/decisions.md create mode 100644 docs/secrets.md create mode 100644 docs/security.md create mode 100644 docs/server.md create mode 100644 jitsi/.env.example create mode 100644 jitsi/README.md rename nginx/conf.d/nuget.silveressence.net.conf => jitsi/docker-compose.yml (100%) create mode 100644 nginx-proxy-manager/README.md rename nginx/conf.d/plane.silveressence.net.conf => nginx-proxy-manager/conf.d/git.silveressence.net.conf (100%) rename nginx/conf.d/portainer.silveressence.net.conf => nginx-proxy-manager/conf.d/nuget.silveressence.net.conf (100%) create mode 100644 nginx-proxy-manager/conf.d/portainer.silveressence.net.conf create mode 100644 nginx-proxy-manager/docker-compose.yml create mode 100644 openproject/.env.example create mode 100644 openproject/README.md create mode 100644 openproject/docker-compose.yml create mode 100644 postgres/.env.example create mode 100644 postgres/README.md create mode 100644 postgres/docker-compose.yml diff --git a/README.md b/README.md index a7be70c..77adeea 100644 --- a/README.md +++ b/README.md @@ -1,45 +1,122 @@ # SilverLinux Infrastructure -This repository contains the infrastructure configuration and documentation for the SilverLinux server. +This repository contains the infrastructure configuration, deployment files and operational documentation for the SilverLinux server. -## Services +SilverLinux is the primary self-hosted platform for Silver Solutions and hosts source control, project management, collaboration, communication and future CI/CD services. + +--- + +## Server Information + +| Property | Value | +| ---------------- | ----------------------- | +| Hostname | silverlinux | +| Provider | OVH | +| Operating System | Ubuntu Server 24.04 LTS | +| Public IP | 51.255.83.140 | +| CPU | Intel Xeon-D 1520 | +| Memory | 32 GB RAM | +| Storage | 2 × 480 GB SSD RAID1 | + +--- + +## Core Services ### Running +* PostgreSQL * Gitea +* OpenProject +* Jitsi Meet * Portainer -* Nginx Reverse Proxy +* Nginx Proxy Manager ### Planned * BaGet -* Plane.so +* Sentry +* CI/CD Runners +* Nextcloud + +### Removed + +* Plane.so (replaced by OpenProject) + +--- + +## Shared Infrastructure + +The following components are shared across multiple services: + +* Docker +* Docker Compose +* Internal Docker Network +* Proxy Docker Network +* Shared Secrets Management + +Secrets are stored outside the repository: + +```text +/srv/secrets/company.env +``` + +--- + +## Repository Structure + +```text +docs/ +gitea/ +jitsi/ +nginx-proxy-manager/ +openproject/ +portainer/ +postgres/ +scripts/ +``` + +Each service folder contains: + +* docker-compose.yml +* README.md +* .env.example + +--- ## Purpose This repository serves as the single source of truth for rebuilding and maintaining the SilverLinux environment. -Infrastructure documentation, Docker Compose files, reverse proxy configuration, backup procedures, and deployment notes are stored here. +Infrastructure documentation, Docker Compose files, backup procedures, deployment notes and operational decisions are stored here. -## Server +The goal is that the entire environment can be rebuilt from this repository and the documented backup files. -* Hostname: silverlinux -* OS: Ubuntu Server 24.04 LTS -* Provider: OVH +--- -## Important +## Security -Do not commit: +Never commit: * Passwords * API Keys * SMTP Credentials +* OAuth Secrets * SSL Private Keys * Database Credentials * Real `.env` files +* `/srv/secrets/company.env` -Use `.env.example` files instead. +Use example files whenever possible. + +--- ## Disaster Recovery -This repository should contain enough configuration and documentation to rebuild the SilverLinux environment from scratch. \ No newline at end of file +This repository should contain enough information to rebuild the entire SilverLinux environment from scratch. + +See: + +* docs/server.md +* docs/backups.md +* docs/security.md +* docs/secrets.md diff --git a/SUMMARY.md b/SUMMARY.md index f044f40..5804b02 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -4,57 +4,20 @@ Last Updated: 2026-06-21 ## Overview -SilverLinux is the primary self-hosted infrastructure server for Silver Solutions. +SilverLinux is the primary infrastructure server for Silver Solutions. -The server hosts development and collaboration services used for software development, source control, package management, project management and future CI/CD automation. - -## Server Information - -### Host - -| Property | Value | -| ---------------- | ----------------------- | -| Name | SilverLinux | -| Provider | OVH | -| Operating System | Ubuntu Server 24.04 LTS | -| Public IP | 51.255.83.140 | - -### Hardware - -| Resource | Value | -| -------- | ------------------- | -| CPU | Intel Xeon-D 1520 | -| Memory | 32 GB RAM | -| Storage | 2 × 480 GB SSD RAID | +The platform hosts source control, project management, video conferencing, container management and supporting infrastructure services. --- -## Security +## Public Services -### SSH - -* SSH key authentication enabled -* Root login disabled - -### Firewall - -* UFW enabled - -### Protection - -* Fail2Ban enabled - ---- - -## Container Platform - -### Docker - -All application services are deployed using Docker containers. - -### Docker Compose - -Docker Compose is used for service deployment and management. +| Service | URL | +| ----------- | ----------------------------------- | +| Gitea | https://git.silveressence.net | +| OpenProject | https://team.silveressence.net | +| Portainer | https://portainer.silveressence.net | +| Jitsi Meet | https://meet.silveressence.net | --- @@ -64,31 +27,64 @@ Docker Compose is used for service deployment and management. Purpose: -* Source control +* Git repositories * Pull requests * Issue tracking -* Git hosting - -URL: - -```text -https://git.silveressence.net -``` +* Future CI/CD integration Authentication: * Local accounts +* Planned Google OAuth2 +* Planned GitHub OAuth2 -Future considerations: +Email: -- Google OAuth (optional) -- GitHub OAuth (optional) +* SMTP configured +* Password reset supported -Current focus: +--- -* Disable OpenID -* Enable 2FA -* Configure backups +### OpenProject + +Purpose: + +* Project management +* Sprint planning +* Time tracking +* Roadmaps +* Team collaboration + +Email: + +* SMTP configured +* Notifications enabled + +--- + +### Jitsi Meet + +Purpose: + +* Video conferencing +* Screen sharing +* Team meetings + +Authentication: + +* Internal authentication +* Guest access enabled + +--- + +### PostgreSQL + +Purpose: + +* Shared database platform +* OpenProject database +* Gitea database +* Future application databases --- @@ -96,91 +92,73 @@ Current focus: Purpose: -* Docker management -* Container monitoring +* Docker administration * Stack deployment - -URL: - -```text -https://portainer.silveressence.net -``` +* Container monitoring --- -### Nginx +### Nginx Proxy Manager Purpose: * Reverse proxy -* SSL termination +* SSL certificate management * Domain routing --- -## Email +## Shared Infrastructure -Sender address: +### Docker + +Purpose: + +* Container hosting +* Service isolation + +### Internal Network + +Purpose: + +* Private communication between services + +### Shared Secrets + +Location: ```text -noreply@silveressence.net +/srv/secrets/company.env ``` -Purpose: +Contains: -* Password reset emails -* Service notifications -* Future CI/CD notifications +* SMTP credentials +* PostgreSQL passwords +* OpenProject secrets +* Future OAuth secrets + +This file must never be committed to Git. --- -## Domains +## Architecture Decisions -| Domain | Purpose | -| --------------------------- | ------------ | -| git.silveressence.net | Gitea | -| portainer.silveressence.net | Portainer | -| nuget.silveressence.net | Future BaGet | -| plane.silveressence.net | Future Plane | +### OpenProject Selected ---- +OpenProject is the primary project management platform. -## Planned Services +### Plane.so Removed -### BaGet +Plane.so was removed to reduce maintenance complexity and duplicate functionality. -Purpose: +### Centralized Secrets -* Private NuGet package hosting +All shared credentials are stored in: -Status: - -* Planned - -### Plane.so - -Purpose: - -* Project management -* Sprint planning -* Issue tracking - -Status: - -* Planned - ---- - -## Backup Priorities - -Critical data: - -* Gitea repositories -* Gitea database -* Gitea configuration -* Docker Compose files -* Nginx configuration -* SSL certificates +```text +/srv/secrets/company.env +``` --- @@ -188,27 +166,26 @@ Critical data: ### Phase 1 -* Verify email configuration -* Disable OpenID -* Enable Gitea 2FA -* Configure backups +* Enable Google OAuth2 +* Enable GitHub OAuth2 +* Configure automated backups ### Phase 2 * Deploy BaGet -* Configure private package feeds +* Configure private NuGet feeds ### Phase 3 -* Deploy Plane.so +* Deploy Sentry ### Phase 4 * Implement CI/CD pipelines -* Deploy directly from Gitea to IIS servers +* Automated deployment to Windows IIS servers --- ## Mission -Provide a reliable, secure and self-hosted platform for development, deployment and collaboration within Silver Solutions. +Provide a secure, reliable and self-hosted platform for software development and business operations within Silver Solutions. diff --git a/nginx/README.md b/baget/.env.example similarity index 100% rename from nginx/README.md rename to baget/.env.example diff --git a/nginx/conf.d/git.silveressence.net.conf b/baget/README.md similarity index 100% rename from nginx/conf.d/git.silveressence.net.conf rename to baget/README.md diff --git a/nginx/docker-compose.yml b/baget/docker-compose.yml similarity index 100% rename from nginx/docker-compose.yml rename to baget/docker-compose.yml diff --git a/docs/backups.md b/docs/backups.md index e69de29..398fc2d 100644 --- a/docs/backups.md +++ b/docs/backups.md @@ -0,0 +1,274 @@ +# Backups + +## Overview + +This document describes the backup strategy for SilverLinux. + +The goal is to ensure that all critical services can be restored after hardware failure, accidental deletion, corruption, or disaster recovery scenarios. + +--- + +## Backup Priorities + +### Critical + +These items must always be backed up. + +#### PostgreSQL + +Contains: + +* OpenProject database +* Gitea database +* Future application databases + +Importance: + +Critical + +--- + +#### Gitea Data + +Location: + +```text +/srv/docker/gitea/data +``` + +Contains: + +* Git repositories +* Attachments +* Configuration +* User data + +Importance: + +Critical + +--- + +#### OpenProject Assets + +Location: + +```text +/srv/docker/openproject/assets +``` + +Contains: + +* Attachments +* Uploaded files +* User generated content + +Importance: + +Critical + +--- + +#### Shared Secrets + +Location: + +```text +/srv/secrets/company.env +``` + +Contains: + +* SMTP credentials +* PostgreSQL passwords +* OpenProject secrets +* Future OAuth secrets + +Importance: + +Critical + +Without this file applications may not start correctly. + +--- + +#### Nginx Proxy Manager + +Locations: + +```text +/srv/docker/nginx-proxy-manager/data +/srv/docker/nginx-proxy-manager/letsencrypt +``` + +Contains: + +* Proxy configuration +* SSL certificates +* Domain routing + +Importance: + +Critical + +--- + +### Medium Priority + +#### Portainer + +Volume: + +```text +portainer_portainer_data +``` + +Contains: + +* Portainer users +* Portainer configuration +* Stack definitions + +Importance: + +Medium + +Can be recreated if necessary. + +--- + +#### Jitsi Configuration + +Location: + +```text +/srv/docker/jitsi +``` + +Contains: + +* Jitsi configuration +* Internal authentication configuration + +Importance: + +Medium + +--- + +## Backup Storage + +Current Location: + +```text +/srv/backups +``` + +Suggested Structure: + +```text +/srv/backups/ +├── daily +├── weekly +└── monthly +``` + +--- + +## Retention Policy + +### Daily + +Keep: + +```text +7 days +``` + +### Weekly + +Keep: + +```text +4 weeks +``` + +### Monthly + +Keep: + +```text +12 months +``` + +--- + +## Restore Priorities + +Restore order: + +1. PostgreSQL +2. Shared secrets +3. Nginx Proxy Manager +4. Gitea +5. OpenProject +6. Portainer +7. Jitsi + +--- + +## Disaster Recovery Checklist + +### Step 1 + +Install: + +* Ubuntu Server +* Docker +* Docker Compose + +### Step 2 + +Restore: + +```text +/srv/secrets/company.env +``` + +### Step 3 + +Restore: + +```text +/srv/docker +``` + +data directories. + +### Step 4 + +Restore PostgreSQL databases. + +### Step 5 + +Deploy Docker stacks. + +### Step 6 + +Verify: + +* DNS +* SSL certificates +* Email delivery +* Application access + +--- + +## Related Documentation + +* docs/server.md +* docs/security.md +* docs/secrets.md +* postgres/README.md +* gitea/README.md +* openproject/README.md diff --git a/docs/cicd.md b/docs/cicd.md index e69de29..10780fd 100644 --- a/docs/cicd.md +++ b/docs/cicd.md @@ -0,0 +1,247 @@ +# CI/CD + +## Overview + +The goal of SilverLinux is to become the central deployment platform for Silver Solutions applications. + +Source code is managed through Gitea and future deployments should be automated through CI/CD pipelines. + +--- + +## Current Situation + +Application deployments are currently performed manually. + +Typical process: + +1. Developer commits code. +2. Developer publishes application. +3. Files are deployed manually. +4. IIS application is restarted if necessary. + +Status: + +```text +Manual +``` + +--- + +## Future Goal + +Automate deployments from Gitea repositories to target servers. + +Examples: + +* Windows IIS servers +* Application servers +* Test environments +* Future Linux deployments + +--- + +## Planned Architecture + +```text +Developer + ↓ +Git Commit + ↓ +Gitea + ↓ +Gitea Actions + ↓ +Build + ↓ +Test + ↓ +Deploy + ↓ +Target Server +``` + +--- + +## Deployment Targets + +### Windows IIS + +Purpose: + +Deploy: + +* ASP.NET Core +* Blazor Server +* Blazor Web App + +Method: + +```text +Publish +→ Copy Files +→ Restart IIS Site +``` + +Status: + +Planned + +--- + +### Linux Containers + +Purpose: + +Future Docker deployments. + +Method: + +```text +Build Docker Image +→ Push Image +→ Deploy Stack +``` + +Status: + +Future + +--- + +## Planned Tooling + +### Gitea Actions + +Purpose: + +* Build automation +* Testing +* Deployment automation + +Status: + +Planned + +--- + +### Self-Hosted Runner + +Purpose: + +Execute build pipelines. + +Potential Location: + +```text +SilverLinux +``` + +Status: + +Planned + +--- + +## Pipeline Stages + +### Build + +Examples: + +* Restore NuGet packages +* Build solution +* Publish application + +--- + +### Test + +Examples: + +* Unit tests +* Integration tests +* Build validation + +--- + +### Deploy + +Examples: + +* IIS deployment +* Docker deployment +* Environment updates + +--- + +## Notifications + +Future CI/CD notifications should use: + +```text +noreply@silveressence.net +``` + +Examples: + +* Build succeeded +* Build failed +* Deployment completed +* Deployment failed + +--- + +## Security + +Deployment credentials should never be stored in repositories. + +Store credentials in: + +```text +/ srv/secrets/company.env +``` + +or platform-specific secret stores. + +--- + +## Initial Target + +First automated deployment target: + +```text +Gitea + → +Windows Server IIS + → +Blazor Applications +``` + +This provides the highest immediate value. + +--- + +## Future Enhancements + +* Automatic testing +* Automatic deployment +* Release pipelines +* Docker image registry +* BaGet integration +* Multi-environment deployments + +--- + +## Related Services + +* Gitea +* Portainer +* Nginx Proxy Manager + +--- + +## Related Documentation + +* gitea/README.md +* docs/server.md +* docs/security.md diff --git a/docs/decisions.md b/docs/decisions.md new file mode 100644 index 0000000..0aec5e3 --- /dev/null +++ b/docs/decisions.md @@ -0,0 +1,243 @@ +# Architecture Decisions + +## Purpose + +This document records important architectural and operational decisions made for SilverLinux. + +The goal is to document not only what was implemented, but also why the decision was made. + +--- + +## 2026-06-17 + +### Ubuntu 24.04 LTS Selected + +Decision: + +Use Ubuntu Server 24.04 LTS as the operating system. + +Reason: + +* Long-term support +* Large community +* Excellent Docker support +* Familiar administration tools + +Status: + +Implemented + +--- + +## 2026-06-17 + +### Docker Standardization + +Decision: + +All services should run in Docker containers whenever possible. + +Reason: + +* Consistent deployment +* Easier backups +* Easier migrations +* Better isolation + +Status: + +Implemented + +--- + +## 2026-06-17 + +### Nginx Proxy Manager Selected + +Decision: + +Use Nginx Proxy Manager as the reverse proxy solution. + +Reason: + +* Easy SSL management +* Simple administration +* User-friendly interface +* Fast deployment + +Status: + +Implemented + +--- + +## 2026-06-17 + +### Gitea Selected + +Decision: + +Use Gitea for source control. + +Reason: + +* Self-hosted +* Lightweight +* GitHub-like experience +* Excellent Docker support + +Status: + +Implemented + +--- + +## 2026-06-17 + +### PostgreSQL Selected + +Decision: + +Use PostgreSQL as the central database platform. + +Reason: + +* Reliability +* Mature ecosystem +* Supports multiple applications +* Strong backup tooling + +Status: + +Implemented + +--- + +## 2026-06-17 + +### OpenProject Selected + +Decision: + +Use OpenProject for project management. + +Reason: + +* Mature platform +* Open source +* Strong planning features +* Work package management +* Time tracking + +Status: + +Implemented + +--- + +## 2026-06-21 + +### Plane.so Removed + +Decision: + +Do not deploy Plane.so. + +Reason: + +* OpenProject fully satisfies requirements +* Reduces maintenance burden +* Avoids duplicate functionality + +Status: + +Implemented + +--- + +## 2026-06-21 + +### Centralized Secrets Management + +Decision: + +Store shared credentials in a single secrets file. + +Location: + +```text +/srv/secrets/company.env +``` + +Reason: + +* Avoid secrets in Docker Compose files +* Easier credential rotation +* Easier disaster recovery +* Reduced risk of accidental exposure + +Status: + +Implemented + +--- + +## 2026-06-21 + +### OpenID Disabled in Gitea + +Decision: + +Disable OpenID authentication. + +Reason: + +* Not required +* Reduces attack surface +* Simplifies authentication model + +Status: + +Implemented + +--- + +## 2026-06-21 + +### Gmail SMTP Selected + +Decision: + +Use Gmail SMTP for outbound email. + +Sender: + +```text +noreply@silveressence.net +``` + +Reason: + +* Reliable delivery +* Easy setup +* Supports application notifications + +Status: + +Implemented + +--- + +## Future Decisions + +Document future decisions using the following template: + +Date: + +Decision: + +Reason: + +Alternatives Considered: + +Status: diff --git a/docs/domains.md b/docs/domains.md index e69de29..3a3de1a 100644 --- a/docs/domains.md +++ b/docs/domains.md @@ -0,0 +1,204 @@ +# Domains + +## Overview + +This document contains the public domains used by SilverLinux and the services they expose. + +All public services are routed through Nginx Proxy Manager. + +--- + +## Primary Domain + +```text +silveressence.net +``` + +Used for: + +* Public services +* Subdomains +* SSL certificates + +--- + +## Active Domains + +### Gitea + +Domain: + +```text +git.silveressence.net +``` + +Purpose: + +* Source control +* Git repositories +* Pull requests +* Issue tracking + +Container: + +```text +gitea +``` + +--- + +### OpenProject + +Domain: + +```text +team.silveressence.net +``` + +Purpose: + +* Project management +* Work packages +* Time tracking +* Team collaboration + +Container: + +```text +openproject +``` + +--- + +### Jitsi Meet + +Domain: + +```text +meet.silveressence.net +``` + +Purpose: + +* Video conferencing +* Team meetings +* Customer meetings + +Container Stack: + +```text +jitsi +``` + +--- + +### Portainer + +Domain: + +```text +portainer.silveressence.net +``` + +Purpose: + +* Docker management +* Infrastructure administration + +Container: + +```text +portainer +``` + +--- + +## Planned Domains + +### BaGet + +Domain: + +```text +nuget.silveressence.net +``` + +Purpose: + +* Private NuGet package hosting + +Status: + +```text +Planned +``` + +--- + +## DNS + +DNS records should point to: + +```text +51.255.83.140 +``` + +Server: + +```text +SilverLinux +``` + +--- + +## SSL Certificates + +SSL certificates are managed through: + +```text +Nginx Proxy Manager +``` + +Certificate data location: + +```text +/srv/docker/nginx-proxy-manager/letsencrypt +``` + +--- + +## Routing + +Internet +↓ +Nginx Proxy Manager +↓ +Service Container + +Examples: + +```text +git.silveressence.net + ↓ +gitea + +team.silveressence.net + ↓ +openproject + +meet.silveressence.net + ↓ +jitsi + +portainer.silveressence.net + ↓ +portainer +``` + +--- + +## Related Documentation + +* docs/server.md +* docs/security.md +* nginx-proxy-manager/README.md diff --git a/docs/email.md b/docs/email.md index e69de29..2e43e48 100644 --- a/docs/email.md +++ b/docs/email.md @@ -0,0 +1,205 @@ +# Email Configuration + +## Overview + +SilverLinux uses a centralized SMTP configuration for application email delivery. + +Email is used for: + +* Password resets +* User invitations +* Notifications +* System alerts +* Future CI/CD notifications + +--- + +## Sender Address + +```text +noreply@silveressence.net +``` + +Purpose: + +* Automated emails +* Application notifications +* No inbound processing required + +--- + +## SMTP Provider + +Provider: + +```text +Gmail SMTP +``` + +Server: + +```text +smtp.gmail.com +``` + +Port: + +```text +587 +``` + +Security: + +```text +STARTTLS +``` + +Authentication: + +```text +Login +``` + +--- + +## Secret Storage + +SMTP credentials are stored in: + +```text +/srv/secrets/company.env +``` + +Variables: + +```text +SMTP_HOST +SMTP_PORT +SMTP_USERNAME +SMTP_PASSWORD +``` + +These values must never be committed to Git repositories. + +--- + +## Applications Using Email + +### OpenProject + +Purpose: + +* Password reset emails +* Work package notifications +* Mention notifications +* User invitations + +Sender: + +```text +noreply@silveressence.net +``` + +Status: + +Configured + +--- + +### Gitea + +Purpose: + +* Password reset emails +* Repository notifications +* User invitations + +Sender: + +```text +noreply@silveressence.net +``` + +Status: + +Configured + +--- + +## Future Applications + +Future services should use the centralized SMTP configuration whenever possible. + +Examples: + +* BaGet +* CI/CD notifications +* Monitoring systems +* Alerting systems + +--- + +## Testing + +### OpenProject + +Test by: + +1. Creating a user. +2. Triggering a password reset. +3. Verifying email delivery. + +### Gitea + +Test by: + +1. Opening "Forgot Password". +2. Requesting a password reset. +3. Verifying email delivery. + +--- + +## Troubleshooting + +### OpenProject + +View logs: + +```bash +docker logs openproject +``` + +### Gitea + +View logs: + +```bash +docker logs gitea +``` + +### Gmail Authentication + +Verify: + +* App password is valid +* SMTP credentials match company.env +* STARTTLS is enabled +* Port 587 is used + +--- + +## Security Notes + +* Use Gmail App Passwords. +* Never use personal Gmail passwords. +* Store SMTP credentials only in company.env. +* Rotate credentials if they become exposed. + +--- + +## Related Documentation + +* docs/secrets.md +* docs/security.md +* openproject/README.md +* gitea/README.md diff --git a/docs/secrets.md b/docs/secrets.md new file mode 100644 index 0000000..4d6d86e --- /dev/null +++ b/docs/secrets.md @@ -0,0 +1,181 @@ +# Secrets Management + +## Overview + +SilverLinux uses a centralized secrets file for shared credentials and sensitive configuration. + +Location: + +```text +/srv/secrets/company.env +``` + +This file is stored on the server and is never committed to Git. + +--- + +## Purpose + +The secrets file provides a single location for: + +* SMTP credentials +* Database passwords +* Application secrets +* OAuth client secrets +* Future API keys + +Applications should load secrets using: + +```yaml +env_file: + - /srv/secrets/company.env +``` + +--- + +## Current Variables + +### Email + +```text +SMTP_HOST +SMTP_PORT +SMTP_USERNAME +SMTP_PASSWORD +``` + +Used by: + +* Gitea +* OpenProject +* Future services + +--- + +### PostgreSQL + +```text +POSTGRES_ROOT_PASSWORD +POSTGRES_OPENPROJECT_PASSWORD +``` + +Used by: + +* PostgreSQL +* OpenProject +* Gitea + +--- + +### OpenProject + +```text +OPENPROJECT_SECRET_KEY_BASE +``` + +Used by: + +* OpenProject + +--- + +### Jitsi + +```text +JICOFO_AUTH_PASSWORD +JVB_AUTH_PASSWORD +JIBRI_XMPP_PASSWORD +JIBRI_RECORDER_PASSWORD +JIGASI_XMPP_PASSWORD +JIGASI_TRANSCRIBER_PASSWORD +``` + +Used by: + +* Jitsi Meet + +--- + +### Future OAuth + +```text +GOOGLE_CLIENT_ID +GOOGLE_CLIENT_SECRET + +GITHUB_CLIENT_ID +GITHUB_CLIENT_SECRET + +MICROSOFT_CLIENT_ID +MICROSOFT_CLIENT_SECRET +``` + +Future use: + +* Gitea +* OpenProject +* Other applications + +--- + +## Rules + +* Never commit secrets to Git. +* Never store passwords directly in docker-compose files. +* Never share the contents of company.env. +* Use environment variables whenever possible. +* Use `.env.example` files for documentation. +* Rotate credentials immediately if exposure is suspected. + +--- + +## Backup Requirements + +The following file must be included in server backups: + +```text +/srv/secrets/company.env +``` + +Loss of this file may prevent applications from starting correctly. + +--- + +## Recovery Procedure + +If the server must be rebuilt: + +1. Restore `/srv/secrets/company.env` +2. Verify file permissions +3. Deploy Docker stacks +4. Verify services can access required variables +5. Verify SMTP functionality +6. Verify database connectivity + +--- + +## Security Notes + +The secrets file contains credentials for multiple services. + +Access should be restricted to system administrators only. + +Recommended permissions: + +```bash +chmod 600 /srv/secrets/company.env +``` + +Recommended ownership: + +```bash +root:root +``` + +--- + +## Related Documents + +* docs/email.md +* docs/security.md +* docs/server.md +* docs/backups.md diff --git a/docs/security.md b/docs/security.md new file mode 100644 index 0000000..382128d --- /dev/null +++ b/docs/security.md @@ -0,0 +1,262 @@ +# Security + +## Overview + +SilverLinux hosts critical infrastructure for Silver Solutions. + +This document describes the security measures implemented on the server and operational security requirements. + +--- + +## Access Control + +### SSH Access + +SSH access is limited to authorized administrators. + +Authentication: + +* SSH key authentication +* Password login discouraged +* Root login disabled + +Primary user: + +```text +ubuntu +``` + +--- + +## Firewall + +### UFW + +UFW is enabled and used as the primary host firewall. + +Allowed ports: + +| Port | Purpose | +| ---- | ------- | +| 22 | SSH | +| 80 | HTTP | +| 443 | HTTPS | + +All other ports should remain blocked unless explicitly required. + +--- + +## Intrusion Protection + +### Fail2Ban + +Fail2Ban is enabled. + +Purpose: + +* Detect brute-force attacks +* Automatically block malicious IP addresses +* Protect SSH access + +--- + +## Secrets Management + +Shared secrets are stored in: + +```text +/srv/secrets/company.env +``` + +Examples: + +* SMTP credentials +* PostgreSQL passwords +* OpenProject secrets +* Future OAuth secrets + +Rules: + +* Never commit secrets to Git +* Never share secrets in documentation +* Never hardcode passwords in Docker Compose files + +See: + +```text +docs/secrets.md +``` + +--- + +## SSL Certificates + +SSL certificates are managed through Nginx Proxy Manager. + +Certificates are automatically renewed. + +All public services should be accessible through HTTPS only. + +--- + +## Email Security + +Outgoing email is provided through Gmail SMTP. + +Credentials are stored in: + +```text +/srv/secrets/company.env +``` + +Requirements: + +* Use Gmail App Passwords only +* Never store personal account passwords +* Rotate credentials if exposure is suspected + +Sender address: + +```text +noreply@silveressence.net +``` + +--- + +## Authentication + +### Current + +* Local user accounts +* Strong passwords + +### Planned + +Future OAuth providers: + +* Google OAuth2 +* GitHub OAuth2 + +Requirements: + +* Store client secrets in company.env +* Use least-privilege scopes +* Disable unused authentication providers + +### Disabled + +* OpenID authentication + +Reason: + +OpenID is not required and increases attack surface. + +--- + +## Two-Factor Authentication + +Where supported: + +* Enable 2FA for administrator accounts +* Encourage 2FA for all users + +Priority: + +1. Gitea administrators +2. OpenProject administrators + +--- + +## Database Security + +PostgreSQL is not exposed publicly. + +Database access is restricted to Docker internal networks. + +Applications communicate with PostgreSQL through the internal Docker network. + +--- + +## Docker Security + +Services are isolated through Docker containers. + +Principles: + +* Public services should be exposed only through Nginx Proxy Manager +* Internal services should not expose ports publicly +* Services should communicate through Docker networks +* Containers should run with the minimum required privileges + +Networks: + +* proxy +* internal + +--- + +## System Updates + +The operating system and containers should be updated regularly. + +Recommendations: + +* Apply Ubuntu security updates +* Update Docker images periodically +* Remove unused containers and images +* Review security advisories for critical services + +--- + +## Backup Security + +Backups must include: + +* Configuration files +* Docker Compose files +* Application data +* PostgreSQL databases +* Shared secrets + +Backups must never be stored inside public repositories. + +--- + +## Security Review Checklist + +Periodically verify: + +* SSH keys are current +* Unused accounts are removed +* Fail2Ban is active +* UFW is active +* SSL certificates are valid +* Secrets are not stored in repositories +* Backups are functioning +* Administrator accounts have 2FA enabled +* Review application logs +* Review Docker logs +* Review authentication failures +* Review Fail2Ban bans + +--- + +## Incident Response + +If a credential is exposed: + +1. Rotate the credential immediately. +2. Update `/srv/secrets/company.env`. +3. Restart affected services. +4. Review logs for unauthorized access. +5. Update documentation if required. + +--- + +## Related Documentation + +* docs/server.md +* docs/secrets.md +* docs/backups.md +* docs/email.md +* nginx-proxy-manager/README.md diff --git a/docs/server.md b/docs/server.md new file mode 100644 index 0000000..f615248 --- /dev/null +++ b/docs/server.md @@ -0,0 +1,275 @@ +# Server Information + +## Overview + +SilverLinux is the primary self-hosted infrastructure server for Silver Solutions. + +The server hosts source control, project management, collaboration, communication and supporting infrastructure services. + +--- + +## Host Information + +| Property | Value | +| ---------------- | ----------------------- | +| Hostname | silverlinux | +| Provider | OVH | +| Operating System | Ubuntu Server 24.04 LTS | +| Public IP | 51.255.83.140 | + +--- + +## Hardware + +| Resource | Value | +| -------- | -------------------- | +| CPU | Intel Xeon-D 1520 | +| Memory | 32 GB RAM | +| Storage | 2 × 480 GB SSD RAID1 | + +--- + +## Installed Software + +### Docker + +Purpose: + +* Container hosting +* Service isolation +* Deployment management + +### Docker Compose + +Purpose: + +* Multi-container application deployment +* Service management + +### PostgreSQL + +Purpose: + +* Shared database platform + +### Fail2Ban + +Purpose: + +* SSH brute-force protection + +### UFW + +Purpose: + +* Firewall management + +--- + +## Docker Networks + +### internal + +Purpose: + +Private communication between services. + +Examples: + +* Gitea → PostgreSQL +* OpenProject → PostgreSQL + +--- + +### proxy + +Purpose: + +Public-facing services behind Nginx Proxy Manager. + +Examples: + +* Gitea +* OpenProject +* Jitsi Meet +* Portainer + +--- + +## Running Services + +* PostgreSQL +* Gitea +* OpenProject +* Jitsi Meet +* Portainer +* Nginx Proxy Manager + +--- + +## Directory Structure + +### Docker Services + +```text +/srv/docker +``` + +Contains: + +```text +/srv/docker/gitea +/srv/docker/openproject +/srv/docker/postgres +/srv/docker/jitsi +/srv/docker/portainer +/srv/docker/nginx-proxy-manager +``` + +--- + +### Shared Secrets + +```text +/srv/secrets/company.env +``` + +Contains: + +* SMTP credentials +* Database passwords +* Application secrets +* Future OAuth credentials + +--- + +### Backups + +```text +/srv/backups +``` + +Suggested structure: + +```text +/srv/backups/daily +/srv/backups/weekly +/srv/backups/monthly +``` + +--- + +## Service Data Locations + +### Gitea + +```text +/srv/docker/gitea/data +``` + +--- + +### OpenProject + +```text +/srv/docker/openproject/assets +``` + +--- + +### PostgreSQL + +```text +/srv/docker/postgres/data +``` + +--- + +### Nginx Proxy Manager + +```text +/srv/docker/nginx-proxy-manager/data +/srv/docker/nginx-proxy-manager/letsencrypt +``` + +--- + +### Jitsi + +```text +/srv/docker/jitsi +``` + +--- + +## SSH Access + +Primary user: + +```text +ubuntu +``` + +Authentication: + +* SSH key authentication +* Root login disabled + +--- + +## Security + +Implemented: + +* UFW enabled +* Fail2Ban enabled +* Shared secrets stored outside Git repositories +* SSL certificates managed through Nginx Proxy Manager +* PostgreSQL not exposed publicly +* OpenID disabled in Gitea + +--- + +## Email + +Sender address: + +```text +noreply@silveressence.net +``` + +SMTP credentials are stored in: + +```text +/srv/secrets/company.env +``` + +Used by: + +* Gitea +* OpenProject + +--- + +## Disaster Recovery + +This repository should contain enough information to rebuild the SilverLinux environment from scratch. + +Recovery priorities: + +1. Restore secrets +2. Restore PostgreSQL +3. Restore Nginx Proxy Manager +4. Restore Gitea +5. Restore OpenProject +6. Restore remaining services + +--- + +## Related Documentation + +* docs/secrets.md +* docs/security.md +* docs/backups.md +* docs/services.md +* docs/domains.md diff --git a/docs/services.md b/docs/services.md index d69d9e3..6a92fd8 100644 --- a/docs/services.md +++ b/docs/services.md @@ -1,7 +1,33 @@ # Services +## Overview + +This document lists all services running on SilverLinux and their purpose. + +--- + ## Running Services +### PostgreSQL + +Purpose: + +* Shared database platform +* Application data storage + +Used by: + +* Gitea +* OpenProject + +Status: + +```text +Running +``` + +--- + ### Gitea URL: @@ -12,13 +38,61 @@ https://git.silveressence.net Purpose: +* Source control * Git repositories * Pull requests -* Source control +* Issue tracking Status: -* Running +```text +Running +``` + +--- + +### OpenProject + +URL: + +```text +https://team.silveressence.net +``` + +Purpose: + +* Project management +* Work packages +* Time tracking +* Team collaboration + +Status: + +```text +Running +``` + +--- + +### Jitsi Meet + +URL: + +```text +https://meet.silveressence.net +``` + +Purpose: + +* Video conferencing +* Team meetings +* Customer meetings + +Status: + +```text +Running +``` --- @@ -34,44 +108,127 @@ Purpose: * Docker administration * Stack deployment +* Container monitoring Status: -* Running +```text +Running +``` --- -### Nginx +### Nginx Proxy Manager Purpose: -- Reverse proxy -- SSL termination -- Domain routing +* Reverse proxy +* SSL termination +* Domain routing +* Certificate management Status: -- Running -- Docker hosted +```text +Running +``` + +--- + +## Shared Infrastructure + +### Docker + +Purpose: + +* Container hosting +* Service isolation + +Status: + +```text +Running +``` + +--- + +### Internal Docker Network + +Purpose: + +* Private communication between services + +Status: + +```text +Running +``` + +--- + +### Shared Secrets + +Location: + +```text +/srv/secrets/company.env +``` + +Purpose: + +* SMTP credentials +* Database passwords +* Application secrets + +Status: + +```text +Active +``` + +--- ## Planned Services ### BaGet +URL: + +```text +https://nuget.silveressence.net +``` + Purpose: -* Private NuGet feed +* Private NuGet package hosting Status: -* Planned +```text +Planned +``` + +--- + +## Removed Services ### Plane.so -Purpose: +Reason: -* Project management +OpenProject was selected as the primary project management platform. Status: -* Planned +```text +Removed +``` + +--- + +## Related Documentation + +* docs/server.md +* docs/domains.md +* docs/security.md +* docs/backups.md diff --git a/gitea/.env.example b/gitea/.env.example index e69de29..9af5ae2 100644 --- a/gitea/.env.example +++ b/gitea/.env.example @@ -0,0 +1,30 @@ +services: + gitea: + image: gitea/gitea:latest + container_name: gitea + restart: unless-stopped + environment: + USER_UID: 1000 + USER_GID: 1000 + GITEA__database__DB_TYPE: postgres + GITEA__database__HOST: postgres:5432 + GITEA__database__NAME: gitea + GITEA__database__USER: postgres + GITEA__database__PASSWD: Saeed123! + GITEA__server__DOMAIN: git.silveressence.net + GITEA__server__ROOT_URL: https://git.silveressence.net/ + GITEA__server__SSH_DOMAIN: git.silveressence.net + GITEA__server__SSH_PORT: 2222 + volumes: + - /srv/docker/gitea/data:/data + ports: + - "2222:22" + networks: + - proxy + - internal + +networks: + proxy: + external: true + internal: + external: true \ No newline at end of file diff --git a/gitea/README.md b/gitea/README.md index e69de29..88bc0ae 100644 --- a/gitea/README.md +++ b/gitea/README.md @@ -0,0 +1,358 @@ +# Gitea + +## Overview + +Gitea is the self-hosted Git platform used by Silver Solutions. + +It provides: + +* Git repository hosting +* Pull requests +* Issue tracking +* Wiki support +* Releases +* CI/CD integration +* Package registry support + +Gitea serves as the central source control platform for SilverLinux infrastructure and application development. + +--- + +## Service Information + +### URL + +```text +https://git.silveressence.net +``` + +### Container Name + +```text +gitea +``` + +### Image + +```text +gitea/gitea:latest +``` + +### Docker Networks + +```text +proxy +internal +``` + +--- + +## Purpose + +Gitea is used for: + +* Source control +* Infrastructure repositories +* Application repositories +* Pull requests +* Issue management +* Release management +* Future CI/CD pipelines + +--- + +## Database + +Database: + +```text +gitea +``` + +Database Host: + +```text +postgres +``` + +Database User: + +```text +postgres +``` + +Current password source: + +```text +POSTGRES_ROOT_PASSWORD +``` + +Stored in: + +```text +/srv/secrets/company.env +``` + +Future improvement: + +Create a dedicated Gitea database user and password. + +--- + +## Email Configuration + +Sender Address: + +```text +noreply@silveressence.net +``` + +Purpose: + +* Password reset emails +* Account notifications +* Repository notifications +* User invitations + +SMTP configuration is loaded from: + +```text +/srv/secrets/company.env +``` + +Variables: + +```text +SMTP_HOST +SMTP_PORT +SMTP_USERNAME +SMTP_PASSWORD +``` + +--- + +## Authentication + +### Current + +* Local user accounts +* Email login +* Password login + +### Disabled + +OpenID authentication is disabled. + +Reason: + +OpenID is not required and increases the attack surface. + +### Planned + +Future authentication providers: + +* Google OAuth2 +* GitHub OAuth2 + +Purpose: + +* Easier onboarding of freelancers +* Easier onboarding of external collaborators +* Reduced password management + +--- + +## SSH Access + +SSH Domain: + +```text +git.silveressence.net +``` + +SSH Port: + +```text +2222 +``` + +Clone example: + +```bash +git clone ssh://git@git.silveressence.net:2222/username/repository.git +``` + +--- + +## Data Storage + +Application Data: + +```text +/srv/docker/gitea/data +``` + +Contains: + +* Repositories +* Attachments +* Configuration +* Actions data +* Package registry data +* User information + +This directory is critical and must be included in backups. + +--- + +## Secrets + +The following secrets are loaded from: + +```text +/srv/secrets/company.env +``` + +Variables: + +```text +POSTGRES_ROOT_PASSWORD + +SMTP_HOST +SMTP_PORT +SMTP_USERNAME +SMTP_PASSWORD +``` + +Future variables: + +```text +GOOGLE_CLIENT_ID +GOOGLE_CLIENT_SECRET + +GITHUB_CLIENT_ID +GITHUB_CLIENT_SECRET +``` + +--- + +## Docker Configuration + +Volume Mapping: + +```text +/srv/docker/gitea/data:/data +``` + +Port Mapping: + +```text +2222:22 +``` + +Networks: + +```text +proxy +internal +``` + +HTTP traffic is routed through Nginx Proxy Manager. + +--- + +## Administration + +View Logs: + +```bash +docker logs gitea +``` + +Restart Service: + +```bash +docker restart gitea +``` + +Open Shell: + +```bash +docker exec -it gitea bash +``` + +--- + +## Backup Requirements + +The following items must be backed up: + +### Database + +```text +gitea +``` + +### Application Data + +```text +/srv/docker/gitea/data +``` + +### Secrets + +```text +/srv/secrets/company.env +``` + +Without these items, a complete restoration is not possible. + +--- + +## Recovery Checklist + +To restore Gitea: + +1. Restore PostgreSQL database. +2. Restore Gitea data directory. +3. Restore company.env secrets. +4. Deploy Docker Compose stack. +5. Verify SMTP configuration. +6. Verify SSH access. +7. Verify access through Nginx Proxy Manager. + +--- + +## Future Roadmap + +### Short Term + +* Enable 2FA for administrator accounts +* Configure backup automation +* Configure Google OAuth2 +* Configure GitHub OAuth2 + +### Long Term + +* Implement CI/CD pipelines +* Deploy applications directly from Gitea +* Host private NuGet packages through BaGet + +--- + +## Related Services + +* PostgreSQL +* Nginx Proxy Manager +* OpenProject +* Portainer + +--- + +## Related Documentation + +* docs/server.md +* docs/security.md +* docs/secrets.md +* docs/backups.md +* postgres/README.md diff --git a/gitea/docker-compose.yml b/gitea/docker-compose.yml index e69de29..9af5ae2 100644 --- a/gitea/docker-compose.yml +++ b/gitea/docker-compose.yml @@ -0,0 +1,30 @@ +services: + gitea: + image: gitea/gitea:latest + container_name: gitea + restart: unless-stopped + environment: + USER_UID: 1000 + USER_GID: 1000 + GITEA__database__DB_TYPE: postgres + GITEA__database__HOST: postgres:5432 + GITEA__database__NAME: gitea + GITEA__database__USER: postgres + GITEA__database__PASSWD: Saeed123! + GITEA__server__DOMAIN: git.silveressence.net + GITEA__server__ROOT_URL: https://git.silveressence.net/ + GITEA__server__SSH_DOMAIN: git.silveressence.net + GITEA__server__SSH_PORT: 2222 + volumes: + - /srv/docker/gitea/data:/data + ports: + - "2222:22" + networks: + - proxy + - internal + +networks: + proxy: + external: true + internal: + external: true \ No newline at end of file diff --git a/jitsi/.env.example b/jitsi/.env.example new file mode 100644 index 0000000..14e3d2f --- /dev/null +++ b/jitsi/.env.example @@ -0,0 +1,19 @@ +PUBLIC_URL=https://meet.silveressence.net + +HTTP_PORT=8000 +HTTPS_PORT=8443 + +TZ=Europe/Amsterdam + +ENABLE_AUTH=1 +ENABLE_GUESTS=1 +AUTH_TYPE=internal + +JVB_ADVERTISE_IPS=51.255.83.140 + +JICOFO_AUTH_PASSWORD= +JVB_AUTH_PASSWORD= +JIBRI_XMPP_PASSWORD= +JIBRI_RECORDER_PASSWORD= +JIGASI_XMPP_PASSWORD= +JIGASI_TRANSCRIBER_PASSWORD= \ No newline at end of file diff --git a/jitsi/README.md b/jitsi/README.md new file mode 100644 index 0000000..222a596 --- /dev/null +++ b/jitsi/README.md @@ -0,0 +1,74 @@ +# Jitsi Meet + +## Overview + +Jitsi Meet provides video conferencing capabilities for Silver Solutions. + +URL: + +https://meet.silveressence.net + +--- + +## Purpose + +- Team meetings +- Customer meetings +- Screen sharing +- Browser-based conferencing + +--- + +## Authentication + +Current configuration: + +- Internal authentication enabled +- Guest access enabled + +Configuration stored in: + +/srv/docker/jitsi/jitsi-docker-jitsi-meet-aa76415/.env + +--- + +## Important Secrets + +Stored in: + +/srv/secrets/company.env + +Variables: + +- JICOFO_AUTH_PASSWORD +- JVB_AUTH_PASSWORD +- JIBRI_XMPP_PASSWORD +- JIBRI_RECORDER_PASSWORD +- JIGASI_XMPP_PASSWORD +- JIGASI_TRANSCRIBER_PASSWORD + +--- + +## Ports + +| Port | Purpose | +|--------|---------| +| 80 | HTTP | +| 443 | HTTPS | +| 10000/UDP | Media Traffic | + +--- + +## Data Location + +Configuration: + +/srv/docker/jitsi + +--- + +## Related Documentation + +- docs/server.md +- docs/security.md +- docs/secrets.md \ No newline at end of file diff --git a/nginx/conf.d/nuget.silveressence.net.conf b/jitsi/docker-compose.yml similarity index 100% rename from nginx/conf.d/nuget.silveressence.net.conf rename to jitsi/docker-compose.yml diff --git a/nginx-proxy-manager/README.md b/nginx-proxy-manager/README.md new file mode 100644 index 0000000..1192557 --- /dev/null +++ b/nginx-proxy-manager/README.md @@ -0,0 +1,204 @@ +# Nginx Proxy Manager + +## Overview + +Nginx Proxy Manager (NPM) is the public entry point for all internet-facing services hosted on SilverLinux. + +It provides: + +* Reverse proxy routing +* SSL certificate management +* HTTPS termination +* Domain forwarding +* Centralized access to services + +All public services should be exposed through Nginx Proxy Manager instead of directly exposing application ports. + +--- + +## Service Information + +Container Name: + +```text +nginx-proxy-manager +``` + +Image: + +```text +jc21/nginx-proxy-manager:latest +``` + +Docker Network: + +```text +proxy +``` + +--- + +## Ports + +| Port | Purpose | +| ---- | ---------------------------------- | +| 80 | HTTP | +| 81 | Nginx Proxy Manager Administration | +| 443 | HTTPS | + +--- + +## Data Storage + +### Application Data + +```text +/srv/docker/nginx-proxy-manager/data +``` + +Contains: + +* Proxy host configuration +* Access lists +* Users +* Application settings +* SSL metadata + +--- + +### SSL Certificates + +```text +/srv/docker/nginx-proxy-manager/letsencrypt +``` + +Contains: + +* Let's Encrypt certificates +* Private keys +* Renewal information + +This folder is critical for disaster recovery. + +--- + +## Responsibilities + +Nginx Proxy Manager is responsible for: + +### Reverse Proxy + +Routing incoming requests to Docker containers. + +Examples: + +| Domain | Target Service | +| --------------------------- | -------------- | +| git.silveressence.net | Gitea | +| team.silveressence.net | OpenProject | +| meet.silveressence.net | Jitsi | +| portainer.silveressence.net | Portainer | + +--- + +### SSL Certificates + +Provides: + +* HTTPS encryption +* Certificate renewal +* Certificate management + +All public services should use HTTPS. + +--- + +### Domain Management + +Centralized management for: + +* Domains +* Subdomains +* SSL certificates +* Proxy routing + +--- + +## Docker Configuration + +Volumes: + +```text +/srv/docker/nginx-proxy-manager/data:/data +/srv/docker/nginx-proxy-manager/letsencrypt:/etc/letsencrypt +``` + +Network: + +```text +proxy +``` + +Applications exposed through NPM must be connected to the proxy network. + +--- + +## Administration + +Web Interface: + +```text +https://portainer.silveressence.net +``` + +Nginx Proxy Manager Admin: + +```text +http://SERVER-IP:81 +``` + +or through the configured domain if one exists. + +--- + +## Backup Requirements + +The following directories must be backed up: + +```text +/srv/docker/nginx-proxy-manager/data +/srv/docker/nginx-proxy-manager/letsencrypt +``` + +Without these directories: + +* SSL certificates are lost +* Proxy configurations are lost +* Domain mappings must be recreated + +--- + +## Security Notes + +* Only ports 80 and 443 should be exposed publicly. +* Administrative access should be restricted. +* SSL certificates should be renewed automatically. +* Services should never be exposed directly to the internet when NPM can proxy them. + +--- + +## Related Services + +* Gitea +* OpenProject +* Jitsi Meet +* Portainer + +--- + +## Related Documentation + +* docs/server.md +* docs/security.md +* docs/domains.md +* docs/backups.md diff --git a/nginx/conf.d/plane.silveressence.net.conf b/nginx-proxy-manager/conf.d/git.silveressence.net.conf similarity index 100% rename from nginx/conf.d/plane.silveressence.net.conf rename to nginx-proxy-manager/conf.d/git.silveressence.net.conf diff --git a/nginx/conf.d/portainer.silveressence.net.conf b/nginx-proxy-manager/conf.d/nuget.silveressence.net.conf similarity index 100% rename from nginx/conf.d/portainer.silveressence.net.conf rename to nginx-proxy-manager/conf.d/nuget.silveressence.net.conf diff --git a/nginx-proxy-manager/conf.d/portainer.silveressence.net.conf b/nginx-proxy-manager/conf.d/portainer.silveressence.net.conf new file mode 100644 index 0000000..e69de29 diff --git a/nginx-proxy-manager/docker-compose.yml b/nginx-proxy-manager/docker-compose.yml new file mode 100644 index 0000000..365c9c9 --- /dev/null +++ b/nginx-proxy-manager/docker-compose.yml @@ -0,0 +1,21 @@ +services: + nginx-proxy-manager: + image: jc21/nginx-proxy-manager:latest + container_name: nginx-proxy-manager + restart: unless-stopped + + ports: + - "80:80" + - "81:81" + - "443:443" + + volumes: + - /srv/docker/nginx-proxy-manager/data:/data + - /srv/docker/nginx-proxy-manager/letsencrypt:/etc/letsencrypt + + networks: + - proxy + +networks: + proxy: + external: true \ No newline at end of file diff --git a/openproject/.env.example b/openproject/.env.example new file mode 100644 index 0000000..c82d168 --- /dev/null +++ b/openproject/.env.example @@ -0,0 +1,37 @@ +services: + openproject: + image: openproject/openproject:17 + container_name: openproject + restart: unless-stopped + + env_file: + - /srv/secrets/company.env + + environment: + SECRET_KEY_BASE: ${OPENPROJECT_SECRET_KEY_BASE} + OPENPROJECT_HOST__NAME: team.silveressence.net + OPENPROJECT_HTTPS: "true" + + DATABASE_URL: postgres://openproject:${POSTGRES_OPENPROJECT_PASSWORD}@postgres:5432/openproject + + OPENPROJECT_EMAIL__DELIVERY__METHOD: smtp + OPENPROJECT_SMTP__ADDRESS: ${SMTP_HOST} + OPENPROJECT_SMTP__PORT: "${SMTP_PORT}" + OPENPROJECT_SMTP__DOMAIN: silveressence.net + OPENPROJECT_SMTP__AUTHENTICATION: login + OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true" + OPENPROJECT_SMTP__USER__NAME: ${SMTP_USERNAME} + OPENPROJECT_SMTP__PASSWORD: ${SMTP_PASSWORD} + + volumes: + - /srv/docker/openproject/assets:/var/openproject/assets + + ports: + - "8082:80" + + networks: + - internal + +networks: + internal: + external: true \ No newline at end of file diff --git a/openproject/README.md b/openproject/README.md new file mode 100644 index 0000000..265897a --- /dev/null +++ b/openproject/README.md @@ -0,0 +1,269 @@ +# OpenProject + +## Overview + +OpenProject is the project management and collaboration platform used by Silver Solutions. + +It provides: + +* Project management +* Task tracking +* Work packages +* Time tracking +* Roadmaps +* Team collaboration +* Document management + +OpenProject replaces the previously planned Plane.so deployment. + +--- + +## Service Information + +### URL + +```text +https://team.silveressence.net +``` + +### Container Name + +```text +openproject +``` + +### Image + +```text +openproject/openproject:17 +``` + +### Docker Network + +```text +internal +``` + +--- + +## Purpose + +OpenProject is used for: + +* Project planning +* Task management +* Development tracking +* Internal collaboration +* Customer project management +* Team planning + +--- + +## Database + +Database: + +```text +openproject +``` + +Database User: + +```text +openproject +``` + +Database Host: + +```text +postgres +``` + +Database access is provided through the internal Docker network. + +--- + +## Email Configuration + +Sender Address: + +```text +noreply@silveressence.net +``` + +Purpose: + +* Password reset emails +* User notifications +* Work package notifications +* Mention notifications +* Project updates + +SMTP credentials are stored in: + +```text +/srv/secrets/company.env +``` + +--- + +## Data Storage + +Assets Location: + +```text +/srv/docker/openproject/assets +``` + +Contains: + +* Attachments +* Uploaded files +* Application assets +* User generated content + +This directory must be included in backups. + +--- + +## Secrets + +The following values are stored in: + +```text +/srv/secrets/company.env +``` + +Variables: + +```text +POSTGRES_OPENPROJECT_PASSWORD +OPENPROJECT_SECRET_KEY_BASE + +SMTP_HOST +SMTP_PORT +SMTP_USERNAME +SMTP_PASSWORD +``` + +Secrets must never be committed to Git. + +--- + +## Authentication + +Current Authentication: + +* Local accounts + +Future Considerations: + +* Google OAuth2 +* GitHub OAuth2 +* Microsoft Entra ID + +--- + +## Docker Configuration + +Volume Mapping: + +```text +/srv/docker/openproject/assets:/var/openproject/assets +``` + +Port Mapping: + +```text +8082:80 +``` + +Network: + +```text +internal +``` + +OpenProject should not be exposed directly to the internet. + +Access should be routed through Nginx Proxy Manager. + +--- + +## Administration + +View Logs: + +```bash +docker logs openproject +``` + +Restart Service: + +```bash +docker restart openproject +``` + +Open Shell: + +```bash +docker exec -it openproject bash +``` + +--- + +## Backup Requirements + +The following items must be backed up: + +### Database + +```text +openproject +``` + +### Assets + +```text +/srv/docker/openproject/assets +``` + +### Secrets + +```text +/srv/secrets/company.env +``` + +Without these items, a complete restoration is not possible. + +--- + +## Recovery Checklist + +To restore OpenProject: + +1. Restore PostgreSQL database. +2. Restore OpenProject assets directory. +3. Restore company.env secrets. +4. Deploy Docker Compose stack. +5. Verify SMTP configuration. +6. Verify access through Nginx Proxy Manager. + +--- + +## Related Services + +* PostgreSQL +* Nginx Proxy Manager +* Gitea +* Portainer + +--- + +## Related Documentation + +* docs/server.md +* docs/security.md +* docs/secrets.md +* docs/backups.md +* postgres/README.md diff --git a/openproject/docker-compose.yml b/openproject/docker-compose.yml new file mode 100644 index 0000000..c82d168 --- /dev/null +++ b/openproject/docker-compose.yml @@ -0,0 +1,37 @@ +services: + openproject: + image: openproject/openproject:17 + container_name: openproject + restart: unless-stopped + + env_file: + - /srv/secrets/company.env + + environment: + SECRET_KEY_BASE: ${OPENPROJECT_SECRET_KEY_BASE} + OPENPROJECT_HOST__NAME: team.silveressence.net + OPENPROJECT_HTTPS: "true" + + DATABASE_URL: postgres://openproject:${POSTGRES_OPENPROJECT_PASSWORD}@postgres:5432/openproject + + OPENPROJECT_EMAIL__DELIVERY__METHOD: smtp + OPENPROJECT_SMTP__ADDRESS: ${SMTP_HOST} + OPENPROJECT_SMTP__PORT: "${SMTP_PORT}" + OPENPROJECT_SMTP__DOMAIN: silveressence.net + OPENPROJECT_SMTP__AUTHENTICATION: login + OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true" + OPENPROJECT_SMTP__USER__NAME: ${SMTP_USERNAME} + OPENPROJECT_SMTP__PASSWORD: ${SMTP_PASSWORD} + + volumes: + - /srv/docker/openproject/assets:/var/openproject/assets + + ports: + - "8082:80" + + networks: + - internal + +networks: + internal: + external: true \ No newline at end of file diff --git a/portainer/README.md b/portainer/README.md index e69de29..3ff83b9 100644 --- a/portainer/README.md +++ b/portainer/README.md @@ -0,0 +1,153 @@ +# Portainer + +## Overview + +Portainer provides a web-based management interface for Docker on SilverLinux. + +It is used to manage containers, networks, volumes, images and Docker stacks through a graphical interface instead of using the command line. + +--- + +## Service Information + +### URL + +```text +https://portainer.silveressence.net +``` + +### Container Name + +```text +portainer +``` + +### Image + +```text +portainer/portainer-ce:latest +``` + +### Docker Network + +```text +proxy +``` + +--- + +## Purpose + +Portainer is used for: + +* Managing Docker containers +* Managing Docker networks +* Managing Docker volumes +* Viewing logs +* Deploying Docker stacks +* Monitoring running services +* Performing container maintenance + +--- + +## Data Storage + +### Docker Socket + +```text +/var/run/docker.sock +``` + +This allows Portainer to communicate with the Docker engine. + +### Portainer Data + +Docker Volume: + +```text +portainer_portainer_data +``` + +Purpose: + +* User accounts +* Configuration +* Stack definitions +* Environment settings + +--- + +## Security + +Portainer has administrative access to Docker. + +Because Portainer uses the Docker socket, users with Portainer administrator access effectively have administrative access to the server. + +Only trusted administrators should have access. + +--- + +## Backup Requirements + +The following volume should be included in backups: + +```text +portainer_portainer_data +``` + +Loss of this volume will result in: + +* Loss of Portainer users +* Loss of stack definitions +* Loss of Portainer configuration + +Docker containers and application data remain unaffected. + +--- + +## Network Configuration + +Portainer is connected to the Docker proxy network. + +Applications exposed through Nginx Proxy Manager can communicate with Portainer through this network. + +--- + +## Maintenance + +View logs: + +```bash +docker logs portainer +``` + +Restart: + +```bash +docker restart portainer +``` + +Open shell: + +```bash +docker exec -it portainer /bin/sh +``` + +--- + +## Related Services + +* Nginx Proxy Manager +* Docker +* PostgreSQL +* Gitea +* OpenProject +* Jitsi Meet + +--- + +## Related Documentation + +* docs/server.md +* docs/security.md +* docs/backups.md diff --git a/portainer/docker-compose.yml b/portainer/docker-compose.yml index e69de29..3299495 100644 --- a/portainer/docker-compose.yml +++ b/portainer/docker-compose.yml @@ -0,0 +1,20 @@ +services: + portainer: + image: portainer/portainer-ce:latest + container_name: portainer + restart: unless-stopped + + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - portainer_data:/data + + networks: + - proxy + +volumes: + portainer_data: + name: portainer_portainer_data + +networks: + proxy: + external: true \ No newline at end of file diff --git a/postgres/.env.example b/postgres/.env.example new file mode 100644 index 0000000..e0d8372 --- /dev/null +++ b/postgres/.env.example @@ -0,0 +1,50 @@ +services: + gitea: + image: gitea/gitea:latest + container_name: gitea + restart: unless-stopped + + env_file: + - /srv/secrets/company.env + + environment: + USER_UID: "1000" + USER_GID: "1000" + + GITEA__database__DB_TYPE: postgres + GITEA__database__HOST: postgres:5432 + GITEA__database__NAME: gitea + GITEA__database__USER: postgres + GITEA__database__PASSWD: ${POSTGRES_ROOT_PASSWORD} + + GITEA__server__DOMAIN: git.silveressence.net + GITEA__server__ROOT_URL: https://git.silveressence.net/ + GITEA__server__SSH_DOMAIN: git.silveressence.net + GITEA__server__SSH_PORT: "2222" + + GITEA__mailer__ENABLED: "true" + GITEA__mailer__FROM: noreply@silveressence.net + GITEA__mailer__PROTOCOL: smtp+starttls + GITEA__mailer__SMTP_ADDR: ${SMTP_HOST} + GITEA__mailer__SMTP_PORT: "${SMTP_PORT}" + GITEA__mailer__USER: ${SMTP_USERNAME} + GITEA__mailer__PASSWD: ${SMTP_PASSWORD} + + GITEA__openid__ENABLE_OPENID_SIGNIN: "false" + GITEA__openid__ENABLE_OPENID_SIGNUP: "false" + + volumes: + - /srv/docker/gitea/data:/data + + ports: + - "2222:22" + + networks: + - proxy + - internal + +networks: + proxy: + external: true + internal: + external: true \ No newline at end of file diff --git a/postgres/README.md b/postgres/README.md new file mode 100644 index 0000000..c8a3ad9 --- /dev/null +++ b/postgres/README.md @@ -0,0 +1,287 @@ +# PostgreSQL + +## Overview + +PostgreSQL is the central database platform for SilverLinux. + +Multiple applications use the same PostgreSQL instance while maintaining separate databases and database users. + +This approach simplifies: + +* Backup management +* Monitoring +* Security +* Resource utilization + +--- + +## Service Information + +Container Name: + +```text +postgres +``` + +Network: + +```text +internal +``` + +Purpose: + +* Application databases +* Centralized data storage +* Shared database platform + +--- + +## Current Databases + +### gitea + +Owner: + +```text +gitea +``` + +Purpose: + +Source control and repository management. + +Used by: + +```text +gitea +``` + +--- + +### openproject + +Owner: + +```text +openproject +``` + +Purpose: + +Project management and collaboration. + +Used by: + +```text +openproject +``` + +--- + +### postgres + +Owner: + +```text +postgres +``` + +Purpose: + +Administrative database. + +Used for PostgreSQL administration and maintenance. + +--- + +## Database Ownership + +| Database | Owner | +| ----------- | ----------- | +| gitea | gitea | +| openproject | openproject | +| postgres | postgres | + +Each application should use its own dedicated database user whenever possible. + +--- + +## Credentials + +Credentials are stored in: + +```text +/srv/secrets/company.env +``` + +Current variables: + +```text +POSTGRES_ROOT_PASSWORD +POSTGRES_OPENPROJECT_PASSWORD +``` + +Future variables: + +```text +POSTGRES_GITEA_PASSWORD +POSTGRES_BAGET_PASSWORD +``` + +Passwords must never be committed to Git repositories. + +--- + +## Administration + +Open PostgreSQL shell: + +```bash +docker exec -it postgres psql -U postgres +``` + +--- + +### List Databases + +```sql +\l +``` + +--- + +### List Roles + +```sql +\du +``` + +--- + +### List Connections + +```sql +SELECT * FROM pg_stat_activity; +``` + +--- + +## Create Database + +Example: + +```sql +CREATE DATABASE myapp; +``` + +--- + +## Create User + +Example: + +```sql +CREATE USER myapp WITH PASSWORD 'StrongPassword'; +``` + +Grant permissions: + +```sql +GRANT ALL PRIVILEGES ON DATABASE myapp TO myapp; +``` + +--- + +## Backup + +Create database backup: + +```bash +docker exec postgres pg_dump -U postgres openproject > openproject.sql +``` + +Create full cluster backup: + +```bash +docker exec postgres pg_dumpall -U postgres > postgres-full-backup.sql +``` + +--- + +## Restore + +Restore database: + +```bash +docker exec -i postgres psql -U postgres openproject < openproject.sql +``` + +Restore complete cluster: + +```bash +docker exec -i postgres psql -U postgres < postgres-full-backup.sql +``` + +--- + +## Security + +* PostgreSQL is not exposed publicly. +* Database traffic is restricted to Docker internal networks. +* Credentials are stored in `/srv/secrets/company.env`. +* Administrative access should use the `postgres` role only when necessary. +* Applications should use dedicated database users. + +--- + +## Monitoring + +Useful commands: + +Database size: + +```sql +SELECT pg_database.datname, + pg_size_pretty(pg_database_size(pg_database.datname)) +FROM pg_database; +``` + +Current connections: + +```sql +SELECT count(*) FROM pg_stat_activity; +``` + +PostgreSQL version: + +```sql +SELECT version(); +``` + +--- + +## Disaster Recovery + +Minimum requirements for recovery: + +* PostgreSQL container configuration +* Database backups +* `/srv/secrets/company.env` +* Docker network configuration + +Without the secrets file, applications may not be able to reconnect to their databases after restoration. + +--- + +## Related Services + +* Gitea +* OpenProject + +## Related Documentation + +* docs/server.md +* docs/security.md +* docs/secrets.md +* docs/backups.md diff --git a/postgres/docker-compose.yml b/postgres/docker-compose.yml new file mode 100644 index 0000000..e0d8372 --- /dev/null +++ b/postgres/docker-compose.yml @@ -0,0 +1,50 @@ +services: + gitea: + image: gitea/gitea:latest + container_name: gitea + restart: unless-stopped + + env_file: + - /srv/secrets/company.env + + environment: + USER_UID: "1000" + USER_GID: "1000" + + GITEA__database__DB_TYPE: postgres + GITEA__database__HOST: postgres:5432 + GITEA__database__NAME: gitea + GITEA__database__USER: postgres + GITEA__database__PASSWD: ${POSTGRES_ROOT_PASSWORD} + + GITEA__server__DOMAIN: git.silveressence.net + GITEA__server__ROOT_URL: https://git.silveressence.net/ + GITEA__server__SSH_DOMAIN: git.silveressence.net + GITEA__server__SSH_PORT: "2222" + + GITEA__mailer__ENABLED: "true" + GITEA__mailer__FROM: noreply@silveressence.net + GITEA__mailer__PROTOCOL: smtp+starttls + GITEA__mailer__SMTP_ADDR: ${SMTP_HOST} + GITEA__mailer__SMTP_PORT: "${SMTP_PORT}" + GITEA__mailer__USER: ${SMTP_USERNAME} + GITEA__mailer__PASSWD: ${SMTP_PASSWORD} + + GITEA__openid__ENABLE_OPENID_SIGNIN: "false" + GITEA__openid__ENABLE_OPENID_SIGNUP: "false" + + volumes: + - /srv/docker/gitea/data:/data + + ports: + - "2222:22" + + networks: + - proxy + - internal + +networks: + proxy: + external: true + internal: + external: true \ No newline at end of file