updating the documentation of the SilverLinux Insftracture

2026-06-21 13:35:59 +03:30
parent b43f2b790e
commit a8e23d3036
33 changed files with 3894 additions and 153 deletions
@@ -0,0 +1,274 @@
+# Backups
+
+## Overview
+
+This document describes the backup strategy for SilverLinux.
+
+The goal is to ensure that all critical services can be restored after hardware failure, accidental deletion, corruption, or disaster recovery scenarios.
+
+---
+
+## Backup Priorities
+
+### Critical
+
+These items must always be backed up.
+
+#### PostgreSQL
+
+Contains:
+
+* OpenProject database
+* Gitea database
+* Future application databases
+
+Importance:
+
+Critical
+
+---
+
+#### Gitea Data
+
+Location:
+
+```text
+/srv/docker/gitea/data
+```
+
+Contains:
+
+* Git repositories
+* Attachments
+* Configuration
+* User data
+
+Importance:
+
+Critical
+
+---
+
+#### OpenProject Assets
+
+Location:
+
+```text
+/srv/docker/openproject/assets
+```
+
+Contains:
+
+* Attachments
+* Uploaded files
+* User generated content
+
+Importance:
+
+Critical
+
+---
+
+#### Shared Secrets
+
+Location:
+
+```text
+/srv/secrets/company.env
+```
+
+Contains:
+
+* SMTP credentials
+* PostgreSQL passwords
+* OpenProject secrets
+* Future OAuth secrets
+
+Importance:
+
+Critical
+
+Without this file applications may not start correctly.
+
+---
+
+#### Nginx Proxy Manager
+
+Locations:
+
+```text
+/srv/docker/nginx-proxy-manager/data
+/srv/docker/nginx-proxy-manager/letsencrypt
+```
+
+Contains:
+
+* Proxy configuration
+* SSL certificates
+* Domain routing
+
+Importance:
+
+Critical
+
+---
+
+### Medium Priority
+
+#### Portainer
+
+Volume:
+
+```text
+portainer_portainer_data
+```
+
+Contains:
+
+* Portainer users
+* Portainer configuration
+* Stack definitions
+
+Importance:
+
+Medium
+
+Can be recreated if necessary.
+
+---
+
+#### Jitsi Configuration
+
+Location:
+
+```text
+/srv/docker/jitsi
+```
+
+Contains:
+
+* Jitsi configuration
+* Internal authentication configuration
+
+Importance:
+
+Medium
+
+---
+
+## Backup Storage
+
+Current Location:
+
+```text
+/srv/backups
+```
+
+Suggested Structure:
+
+```text
+/srv/backups/
+├── daily
+├── weekly
+└── monthly
+```
+
+---
+
+## Retention Policy
+
+### Daily
+
+Keep:
+
+```text
+7 days
+```
+
+### Weekly
+
+Keep:
+
+```text
+4 weeks
+```
+
+### Monthly
+
+Keep:
+
+```text
+12 months
+```
+
+---
+
+## Restore Priorities
+
+Restore order:
+
+1. PostgreSQL
+2. Shared secrets
+3. Nginx Proxy Manager
+4. Gitea
+5. OpenProject
+6. Portainer
+7. Jitsi
+
+---
+
+## Disaster Recovery Checklist
+
+### Step 1
+
+Install:
+
+* Ubuntu Server
+* Docker
+* Docker Compose
+
+### Step 2
+
+Restore:
+
+```text
+/srv/secrets/company.env
+```
+
+### Step 3
+
+Restore:
+
+```text
+/srv/docker
+```
+
+data directories.
+
+### Step 4
+
+Restore PostgreSQL databases.
+
+### Step 5
+
+Deploy Docker stacks.
+
+### Step 6
+
+Verify:
+
+* DNS
+* SSL certificates
+* Email delivery
+* Application access
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/security.md
+* docs/secrets.md
+* postgres/README.md
+* gitea/README.md
+* openproject/README.md
@@ -0,0 +1,247 @@
+# CI/CD
+
+## Overview
+
+The goal of SilverLinux is to become the central deployment platform for Silver Solutions applications.
+
+Source code is managed through Gitea and future deployments should be automated through CI/CD pipelines.
+
+---
+
+## Current Situation
+
+Application deployments are currently performed manually.
+
+Typical process:
+
+1. Developer commits code.
+2. Developer publishes application.
+3. Files are deployed manually.
+4. IIS application is restarted if necessary.
+
+Status:
+
+```text
+Manual
+```
+
+---
+
+## Future Goal
+
+Automate deployments from Gitea repositories to target servers.
+
+Examples:
+
+* Windows IIS servers
+* Application servers
+* Test environments
+* Future Linux deployments
+
+---
+
+## Planned Architecture
+
+```text
+Developer
+    ↓
+Git Commit
+    ↓
+Gitea
+    ↓
+Gitea Actions
+    ↓
+Build
+    ↓
+Test
+    ↓
+Deploy
+    ↓
+Target Server
+```
+
+---
+
+## Deployment Targets
+
+### Windows IIS
+
+Purpose:
+
+Deploy:
+
+* ASP.NET Core
+* Blazor Server
+* Blazor Web App
+
+Method:
+
+```text
+Publish
+→ Copy Files
+→ Restart IIS Site
+```
+
+Status:
+
+Planned
+
+---
+
+### Linux Containers
+
+Purpose:
+
+Future Docker deployments.
+
+Method:
+
+```text
+Build Docker Image
+→ Push Image
+→ Deploy Stack
+```
+
+Status:
+
+Future
+
+---
+
+## Planned Tooling
+
+### Gitea Actions
+
+Purpose:
+
+* Build automation
+* Testing
+* Deployment automation
+
+Status:
+
+Planned
+
+---
+
+### Self-Hosted Runner
+
+Purpose:
+
+Execute build pipelines.
+
+Potential Location:
+
+```text
+SilverLinux
+```
+
+Status:
+
+Planned
+
+---
+
+## Pipeline Stages
+
+### Build
+
+Examples:
+
+* Restore NuGet packages
+* Build solution
+* Publish application
+
+---
+
+### Test
+
+Examples:
+
+* Unit tests
+* Integration tests
+* Build validation
+
+---
+
+### Deploy
+
+Examples:
+
+* IIS deployment
+* Docker deployment
+* Environment updates
+
+---
+
+## Notifications
+
+Future CI/CD notifications should use:
+
+```text
+noreply@silveressence.net
+```
+
+Examples:
+
+* Build succeeded
+* Build failed
+* Deployment completed
+* Deployment failed
+
+---
+
+## Security
+
+Deployment credentials should never be stored in repositories.
+
+Store credentials in:
+
+```text
+/ srv/secrets/company.env
+```
+
+or platform-specific secret stores.
+
+---
+
+## Initial Target
+
+First automated deployment target:
+
+```text
+Gitea
+    →
+Windows Server IIS
+    →
+Blazor Applications
+```
+
+This provides the highest immediate value.
+
+---
+
+## Future Enhancements
+
+* Automatic testing
+* Automatic deployment
+* Release pipelines
+* Docker image registry
+* BaGet integration
+* Multi-environment deployments
+
+---
+
+## Related Services
+
+* Gitea
+* Portainer
+* Nginx Proxy Manager
+
+---
+
+## Related Documentation
+
+* gitea/README.md
+* docs/server.md
+* docs/security.md
@@ -0,0 +1,243 @@
+# Architecture Decisions
+
+## Purpose
+
+This document records important architectural and operational decisions made for SilverLinux.
+
+The goal is to document not only what was implemented, but also why the decision was made.
+
+---
+
+## 2026-06-17
+
+### Ubuntu 24.04 LTS Selected
+
+Decision:
+
+Use Ubuntu Server 24.04 LTS as the operating system.
+
+Reason:
+
+* Long-term support
+* Large community
+* Excellent Docker support
+* Familiar administration tools
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### Docker Standardization
+
+Decision:
+
+All services should run in Docker containers whenever possible.
+
+Reason:
+
+* Consistent deployment
+* Easier backups
+* Easier migrations
+* Better isolation
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### Nginx Proxy Manager Selected
+
+Decision:
+
+Use Nginx Proxy Manager as the reverse proxy solution.
+
+Reason:
+
+* Easy SSL management
+* Simple administration
+* User-friendly interface
+* Fast deployment
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### Gitea Selected
+
+Decision:
+
+Use Gitea for source control.
+
+Reason:
+
+* Self-hosted
+* Lightweight
+* GitHub-like experience
+* Excellent Docker support
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### PostgreSQL Selected
+
+Decision:
+
+Use PostgreSQL as the central database platform.
+
+Reason:
+
+* Reliability
+* Mature ecosystem
+* Supports multiple applications
+* Strong backup tooling
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-17
+
+### OpenProject Selected
+
+Decision:
+
+Use OpenProject for project management.
+
+Reason:
+
+* Mature platform
+* Open source
+* Strong planning features
+* Work package management
+* Time tracking
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-21
+
+### Plane.so Removed
+
+Decision:
+
+Do not deploy Plane.so.
+
+Reason:
+
+* OpenProject fully satisfies requirements
+* Reduces maintenance burden
+* Avoids duplicate functionality
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-21
+
+### Centralized Secrets Management
+
+Decision:
+
+Store shared credentials in a single secrets file.
+
+Location:
+
+```text
+/srv/secrets/company.env
+```
+
+Reason:
+
+* Avoid secrets in Docker Compose files
+* Easier credential rotation
+* Easier disaster recovery
+* Reduced risk of accidental exposure
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-21
+
+### OpenID Disabled in Gitea
+
+Decision:
+
+Disable OpenID authentication.
+
+Reason:
+
+* Not required
+* Reduces attack surface
+* Simplifies authentication model
+
+Status:
+
+Implemented
+
+---
+
+## 2026-06-21
+
+### Gmail SMTP Selected
+
+Decision:
+
+Use Gmail SMTP for outbound email.
+
+Sender:
+
+```text
+noreply@silveressence.net
+```
+
+Reason:
+
+* Reliable delivery
+* Easy setup
+* Supports application notifications
+
+Status:
+
+Implemented
+
+---
+
+## Future Decisions
+
+Document future decisions using the following template:
+
+Date:
+
+Decision:
+
+Reason:
+
+Alternatives Considered:
+
+Status:
@@ -0,0 +1,204 @@
+# Domains
+
+## Overview
+
+This document contains the public domains used by SilverLinux and the services they expose.
+
+All public services are routed through Nginx Proxy Manager.
+
+---
+
+## Primary Domain
+
+```text
+silveressence.net
+```
+
+Used for:
+
+* Public services
+* Subdomains
+* SSL certificates
+
+---
+
+## Active Domains
+
+### Gitea
+
+Domain:
+
+```text
+git.silveressence.net
+```
+
+Purpose:
+
+* Source control
+* Git repositories
+* Pull requests
+* Issue tracking
+
+Container:
+
+```text
+gitea
+```
+
+---
+
+### OpenProject
+
+Domain:
+
+```text
+team.silveressence.net
+```
+
+Purpose:
+
+* Project management
+* Work packages
+* Time tracking
+* Team collaboration
+
+Container:
+
+```text
+openproject
+```
+
+---
+
+### Jitsi Meet
+
+Domain:
+
+```text
+meet.silveressence.net
+```
+
+Purpose:
+
+* Video conferencing
+* Team meetings
+* Customer meetings
+
+Container Stack:
+
+```text
+jitsi
+```
+
+---
+
+### Portainer
+
+Domain:
+
+```text
+portainer.silveressence.net
+```
+
+Purpose:
+
+* Docker management
+* Infrastructure administration
+
+Container:
+
+```text
+portainer
+```
+
+---
+
+## Planned Domains
+
+### BaGet
+
+Domain:
+
+```text
+nuget.silveressence.net
+```
+
+Purpose:
+
+* Private NuGet package hosting
+
+Status:
+
+```text
+Planned
+```
+
+---
+
+## DNS
+
+DNS records should point to:
+
+```text
+51.255.83.140
+```
+
+Server:
+
+```text
+SilverLinux
+```
+
+---
+
+## SSL Certificates
+
+SSL certificates are managed through:
+
+```text
+Nginx Proxy Manager
+```
+
+Certificate data location:
+
+```text
+/srv/docker/nginx-proxy-manager/letsencrypt
+```
+
+---
+
+## Routing
+
+Internet
+↓
+Nginx Proxy Manager
+↓
+Service Container
+
+Examples:
+
+```text
+git.silveressence.net
+    ↓
+gitea
+
+team.silveressence.net
+    ↓
+openproject
+
+meet.silveressence.net
+    ↓
+jitsi
+
+portainer.silveressence.net
+    ↓
+portainer
+```
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/security.md
+* nginx-proxy-manager/README.md
@@ -0,0 +1,205 @@
+# Email Configuration
+
+## Overview
+
+SilverLinux uses a centralized SMTP configuration for application email delivery.
+
+Email is used for:
+
+* Password resets
+* User invitations
+* Notifications
+* System alerts
+* Future CI/CD notifications
+
+---
+
+## Sender Address
+
+```text
+noreply@silveressence.net
+```
+
+Purpose:
+
+* Automated emails
+* Application notifications
+* No inbound processing required
+
+---
+
+## SMTP Provider
+
+Provider:
+
+```text
+Gmail SMTP
+```
+
+Server:
+
+```text
+smtp.gmail.com
+```
+
+Port:
+
+```text
+587
+```
+
+Security:
+
+```text
+STARTTLS
+```
+
+Authentication:
+
+```text
+Login
+```
+
+---
+
+## Secret Storage
+
+SMTP credentials are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Variables:
+
+```text
+SMTP_HOST
+SMTP_PORT
+SMTP_USERNAME
+SMTP_PASSWORD
+```
+
+These values must never be committed to Git repositories.
+
+---
+
+## Applications Using Email
+
+### OpenProject
+
+Purpose:
+
+* Password reset emails
+* Work package notifications
+* Mention notifications
+* User invitations
+
+Sender:
+
+```text
+noreply@silveressence.net
+```
+
+Status:
+
+Configured
+
+---
+
+### Gitea
+
+Purpose:
+
+* Password reset emails
+* Repository notifications
+* User invitations
+
+Sender:
+
+```text
+noreply@silveressence.net
+```
+
+Status:
+
+Configured
+
+---
+
+## Future Applications
+
+Future services should use the centralized SMTP configuration whenever possible.
+
+Examples:
+
+* BaGet
+* CI/CD notifications
+* Monitoring systems
+* Alerting systems
+
+---
+
+## Testing
+
+### OpenProject
+
+Test by:
+
+1. Creating a user.
+2. Triggering a password reset.
+3. Verifying email delivery.
+
+### Gitea
+
+Test by:
+
+1. Opening "Forgot Password".
+2. Requesting a password reset.
+3. Verifying email delivery.
+
+---
+
+## Troubleshooting
+
+### OpenProject
+
+View logs:
+
+```bash
+docker logs openproject
+```
+
+### Gitea
+
+View logs:
+
+```bash
+docker logs gitea
+```
+
+### Gmail Authentication
+
+Verify:
+
+* App password is valid
+* SMTP credentials match company.env
+* STARTTLS is enabled
+* Port 587 is used
+
+---
+
+## Security Notes
+
+* Use Gmail App Passwords.
+* Never use personal Gmail passwords.
+* Store SMTP credentials only in company.env.
+* Rotate credentials if they become exposed.
+
+---
+
+## Related Documentation
+
+* docs/secrets.md
+* docs/security.md
+* openproject/README.md
+* gitea/README.md
@@ -0,0 +1,181 @@
+# Secrets Management
+
+## Overview
+
+SilverLinux uses a centralized secrets file for shared credentials and sensitive configuration.
+
+Location:
+
+```text
+/srv/secrets/company.env
+```
+
+This file is stored on the server and is never committed to Git.
+
+---
+
+## Purpose
+
+The secrets file provides a single location for:
+
+* SMTP credentials
+* Database passwords
+* Application secrets
+* OAuth client secrets
+* Future API keys
+
+Applications should load secrets using:
+
+```yaml
+env_file:
+  - /srv/secrets/company.env
+```
+
+---
+
+## Current Variables
+
+### Email
+
+```text
+SMTP_HOST
+SMTP_PORT
+SMTP_USERNAME
+SMTP_PASSWORD
+```
+
+Used by:
+
+* Gitea
+* OpenProject
+* Future services
+
+---
+
+### PostgreSQL
+
+```text
+POSTGRES_ROOT_PASSWORD
+POSTGRES_OPENPROJECT_PASSWORD
+```
+
+Used by:
+
+* PostgreSQL
+* OpenProject
+* Gitea
+
+---
+
+### OpenProject
+
+```text
+OPENPROJECT_SECRET_KEY_BASE
+```
+
+Used by:
+
+* OpenProject
+
+---
+
+### Jitsi
+
+```text
+JICOFO_AUTH_PASSWORD
+JVB_AUTH_PASSWORD
+JIBRI_XMPP_PASSWORD
+JIBRI_RECORDER_PASSWORD
+JIGASI_XMPP_PASSWORD
+JIGASI_TRANSCRIBER_PASSWORD
+```
+
+Used by:
+
+* Jitsi Meet
+
+---
+
+### Future OAuth
+
+```text
+GOOGLE_CLIENT_ID
+GOOGLE_CLIENT_SECRET
+
+GITHUB_CLIENT_ID
+GITHUB_CLIENT_SECRET
+
+MICROSOFT_CLIENT_ID
+MICROSOFT_CLIENT_SECRET
+```
+
+Future use:
+
+* Gitea
+* OpenProject
+* Other applications
+
+---
+
+## Rules
+
+* Never commit secrets to Git.
+* Never store passwords directly in docker-compose files.
+* Never share the contents of company.env.
+* Use environment variables whenever possible.
+* Use `.env.example` files for documentation.
+* Rotate credentials immediately if exposure is suspected.
+
+---
+
+## Backup Requirements
+
+The following file must be included in server backups:
+
+```text
+/srv/secrets/company.env
+```
+
+Loss of this file may prevent applications from starting correctly.
+
+---
+
+## Recovery Procedure
+
+If the server must be rebuilt:
+
+1. Restore `/srv/secrets/company.env`
+2. Verify file permissions
+3. Deploy Docker stacks
+4. Verify services can access required variables
+5. Verify SMTP functionality
+6. Verify database connectivity
+
+---
+
+## Security Notes
+
+The secrets file contains credentials for multiple services.
+
+Access should be restricted to system administrators only.
+
+Recommended permissions:
+
+```bash
+chmod 600 /srv/secrets/company.env
+```
+
+Recommended ownership:
+
+```bash
+root:root
+```
+
+---
+
+## Related Documents
+
+* docs/email.md
+* docs/security.md
+* docs/server.md
+* docs/backups.md
@@ -0,0 +1,262 @@
+# Security
+
+## Overview
+
+SilverLinux hosts critical infrastructure for Silver Solutions.
+
+This document describes the security measures implemented on the server and operational security requirements.
+
+---
+
+## Access Control
+
+### SSH Access
+
+SSH access is limited to authorized administrators.
+
+Authentication:
+
+* SSH key authentication
+* Password login discouraged
+* Root login disabled
+
+Primary user:
+
+```text
+ubuntu
+```
+
+---
+
+## Firewall
+
+### UFW
+
+UFW is enabled and used as the primary host firewall.
+
+Allowed ports:
+
+| Port | Purpose |
+| ---- | ------- |
+| 22   | SSH     |
+| 80   | HTTP    |
+| 443  | HTTPS   |
+
+All other ports should remain blocked unless explicitly required.
+
+---
+
+## Intrusion Protection
+
+### Fail2Ban
+
+Fail2Ban is enabled.
+
+Purpose:
+
+* Detect brute-force attacks
+* Automatically block malicious IP addresses
+* Protect SSH access
+
+---
+
+## Secrets Management
+
+Shared secrets are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Examples:
+
+* SMTP credentials
+* PostgreSQL passwords
+* OpenProject secrets
+* Future OAuth secrets
+
+Rules:
+
+* Never commit secrets to Git
+* Never share secrets in documentation
+* Never hardcode passwords in Docker Compose files
+
+See:
+
+```text
+docs/secrets.md
+```
+
+---
+
+## SSL Certificates
+
+SSL certificates are managed through Nginx Proxy Manager.
+
+Certificates are automatically renewed.
+
+All public services should be accessible through HTTPS only.
+
+---
+
+## Email Security
+
+Outgoing email is provided through Gmail SMTP.
+
+Credentials are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Requirements:
+
+* Use Gmail App Passwords only
+* Never store personal account passwords
+* Rotate credentials if exposure is suspected
+
+Sender address:
+
+```text
+noreply@silveressence.net
+```
+
+---
+
+## Authentication
+
+### Current
+
+* Local user accounts
+* Strong passwords
+
+### Planned
+
+Future OAuth providers:
+
+* Google OAuth2
+* GitHub OAuth2
+
+Requirements:
+
+* Store client secrets in company.env
+* Use least-privilege scopes
+* Disable unused authentication providers
+
+### Disabled
+
+* OpenID authentication
+
+Reason:
+
+OpenID is not required and increases attack surface.
+
+---
+
+## Two-Factor Authentication
+
+Where supported:
+
+* Enable 2FA for administrator accounts
+* Encourage 2FA for all users
+
+Priority:
+
+1. Gitea administrators
+2. OpenProject administrators
+
+---
+
+## Database Security
+
+PostgreSQL is not exposed publicly.
+
+Database access is restricted to Docker internal networks.
+
+Applications communicate with PostgreSQL through the internal Docker network.
+
+---
+
+## Docker Security
+
+Services are isolated through Docker containers.
+
+Principles:
+
+* Public services should be exposed only through Nginx Proxy Manager
+* Internal services should not expose ports publicly
+* Services should communicate through Docker networks
+* Containers should run with the minimum required privileges
+
+Networks:
+
+* proxy
+* internal
+
+---
+
+## System Updates
+
+The operating system and containers should be updated regularly.
+
+Recommendations:
+
+* Apply Ubuntu security updates
+* Update Docker images periodically
+* Remove unused containers and images
+* Review security advisories for critical services
+
+---
+
+## Backup Security
+
+Backups must include:
+
+* Configuration files
+* Docker Compose files
+* Application data
+* PostgreSQL databases
+* Shared secrets
+
+Backups must never be stored inside public repositories.
+
+---
+
+## Security Review Checklist
+
+Periodically verify:
+
+* SSH keys are current
+* Unused accounts are removed
+* Fail2Ban is active
+* UFW is active
+* SSL certificates are valid
+* Secrets are not stored in repositories
+* Backups are functioning
+* Administrator accounts have 2FA enabled
+* Review application logs
+* Review Docker logs
+* Review authentication failures
+* Review Fail2Ban bans
+
+---
+
+## Incident Response
+
+If a credential is exposed:
+
+1. Rotate the credential immediately.
+2. Update `/srv/secrets/company.env`.
+3. Restart affected services.
+4. Review logs for unauthorized access.
+5. Update documentation if required.
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/secrets.md
+* docs/backups.md
+* docs/email.md
+* nginx-proxy-manager/README.md
@@ -0,0 +1,275 @@
+# Server Information
+
+## Overview
+
+SilverLinux is the primary self-hosted infrastructure server for Silver Solutions.
+
+The server hosts source control, project management, collaboration, communication and supporting infrastructure services.
+
+---
+
+## Host Information
+
+| Property         | Value                   |
+| ---------------- | ----------------------- |
+| Hostname         | silverlinux             |
+| Provider         | OVH                     |
+| Operating System | Ubuntu Server 24.04 LTS |
+| Public IP        | 51.255.83.140           |
+
+---
+
+## Hardware
+
+| Resource | Value                |
+| -------- | -------------------- |
+| CPU      | Intel Xeon-D 1520    |
+| Memory   | 32 GB RAM            |
+| Storage  | 2 × 480 GB SSD RAID1 |
+
+---
+
+## Installed Software
+
+### Docker
+
+Purpose:
+
+* Container hosting
+* Service isolation
+* Deployment management
+
+### Docker Compose
+
+Purpose:
+
+* Multi-container application deployment
+* Service management
+
+### PostgreSQL
+
+Purpose:
+
+* Shared database platform
+
+### Fail2Ban
+
+Purpose:
+
+* SSH brute-force protection
+
+### UFW
+
+Purpose:
+
+* Firewall management
+
+---
+
+## Docker Networks
+
+### internal
+
+Purpose:
+
+Private communication between services.
+
+Examples:
+
+* Gitea → PostgreSQL
+* OpenProject → PostgreSQL
+
+---
+
+### proxy
+
+Purpose:
+
+Public-facing services behind Nginx Proxy Manager.
+
+Examples:
+
+* Gitea
+* OpenProject
+* Jitsi Meet
+* Portainer
+
+---
+
+## Running Services
+
+* PostgreSQL
+* Gitea
+* OpenProject
+* Jitsi Meet
+* Portainer
+* Nginx Proxy Manager
+
+---
+
+## Directory Structure
+
+### Docker Services
+
+```text
+/srv/docker
+```
+
+Contains:
+
+```text
+/srv/docker/gitea
+/srv/docker/openproject
+/srv/docker/postgres
+/srv/docker/jitsi
+/srv/docker/portainer
+/srv/docker/nginx-proxy-manager
+```
+
+---
+
+### Shared Secrets
+
+```text
+/srv/secrets/company.env
+```
+
+Contains:
+
+* SMTP credentials
+* Database passwords
+* Application secrets
+* Future OAuth credentials
+
+---
+
+### Backups
+
+```text
+/srv/backups
+```
+
+Suggested structure:
+
+```text
+/srv/backups/daily
+/srv/backups/weekly
+/srv/backups/monthly
+```
+
+---
+
+## Service Data Locations
+
+### Gitea
+
+```text
+/srv/docker/gitea/data
+```
+
+---
+
+### OpenProject
+
+```text
+/srv/docker/openproject/assets
+```
+
+---
+
+### PostgreSQL
+
+```text
+/srv/docker/postgres/data
+```
+
+---
+
+### Nginx Proxy Manager
+
+```text
+/srv/docker/nginx-proxy-manager/data
+/srv/docker/nginx-proxy-manager/letsencrypt
+```
+
+---
+
+### Jitsi
+
+```text
+/srv/docker/jitsi
+```
+
+---
+
+## SSH Access
+
+Primary user:
+
+```text
+ubuntu
+```
+
+Authentication:
+
+* SSH key authentication
+* Root login disabled
+
+---
+
+## Security
+
+Implemented:
+
+* UFW enabled
+* Fail2Ban enabled
+* Shared secrets stored outside Git repositories
+* SSL certificates managed through Nginx Proxy Manager
+* PostgreSQL not exposed publicly
+* OpenID disabled in Gitea
+
+---
+
+## Email
+
+Sender address:
+
+```text
+noreply@silveressence.net
+```
+
+SMTP credentials are stored in:
+
+```text
+/srv/secrets/company.env
+```
+
+Used by:
+
+* Gitea
+* OpenProject
+
+---
+
+## Disaster Recovery
+
+This repository should contain enough information to rebuild the SilverLinux environment from scratch.
+
+Recovery priorities:
+
+1. Restore secrets
+2. Restore PostgreSQL
+3. Restore Nginx Proxy Manager
+4. Restore Gitea
+5. Restore OpenProject
+6. Restore remaining services
+
+---
+
+## Related Documentation
+
+* docs/secrets.md
+* docs/security.md
+* docs/backups.md
+* docs/services.md
+* docs/domains.md
@@ -1,7 +1,33 @@
 # Services

+## Overview
+
+This document lists all services running on SilverLinux and their purpose.
+
+---
+
 ## Running Services

+### PostgreSQL
+
+Purpose:
+
+* Shared database platform
+* Application data storage
+
+Used by:
+
+* Gitea
+* OpenProject
+
+Status:
+
+```text
+Running
+```
+
+---
+
 ### Gitea

 URL:
@@ -12,13 +38,61 @@ https://git.silveressence.net

 Purpose:

+* Source control
 * Git repositories
 * Pull requests
-* Source control
+* Issue tracking

 Status:

-* Running
+```text
+Running
+```
+
+---
+
+### OpenProject
+
+URL:
+
+```text
+https://team.silveressence.net
+```
+
+Purpose:
+
+* Project management
+* Work packages
+* Time tracking
+* Team collaboration
+
+Status:
+
+```text
+Running
+```
+
+---
+
+### Jitsi Meet
+
+URL:
+
+```text
+https://meet.silveressence.net
+```
+
+Purpose:
+
+* Video conferencing
+* Team meetings
+* Customer meetings
+
+Status:
+
+```text
+Running
+```

 ---

@@ -34,44 +108,127 @@ Purpose:

 * Docker administration
 * Stack deployment
+* Container monitoring

 Status:

-* Running
+```text
+Running
+```

 ---

-### Nginx
+### Nginx Proxy Manager

 Purpose:

- Reverse proxy
- SSL termination
- Domain routing
+* Reverse proxy
+* SSL termination
+* Domain routing
+* Certificate management

 Status:

- Running
- Docker hosted
+```text
+Running
+```
+
+---
+
+## Shared Infrastructure
+
+### Docker
+
+Purpose:
+
+* Container hosting
+* Service isolation
+
+Status:
+
+```text
+Running
+```
+
+---
+
+### Internal Docker Network
+
+Purpose:
+
+* Private communication between services
+
+Status:
+
+```text
+Running
+```
+
+---
+
+### Shared Secrets
+
+Location:
+
+```text
+/srv/secrets/company.env
+```
+
+Purpose:
+
+* SMTP credentials
+* Database passwords
+* Application secrets
+
+Status:
+
+```text
+Active
+```
+
+---

 ## Planned Services

 ### BaGet

+URL:
+
+```text
+https://nuget.silveressence.net
+```
+
 Purpose:

-* Private NuGet feed
+* Private NuGet package hosting

 Status:

-* Planned
+```text
+Planned
+```
+
+---
+
+## Removed Services

 ### Plane.so

-Purpose:
+Reason:

-* Project management
+OpenProject was selected as the primary project management platform.

 Status:

-* Planned
+```text
+Removed
+```
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/domains.md
+* docs/security.md
+* docs/backups.md