feat: Add slcompose service orchestrator with Infisical secret injection

- Add slcompose.sh: Central orchestrator for managing all Docker services * Boot all services at startup with automated Infisical secret injection * Commands: up, down, restart, logs, logs-tail, env, env-all * Colored environment variable output (blue names, green values) - Add slcompose.service: Systemd service file for auto-boot on startup * Type=oneshot with RemainAfterExit=yes * Waits for Docker service before starting * Runs on multi-user.target - Add orchestration.md: Comprehensive documentation * Architecture and installation guide * Usage examples for all commands * Secret injection flow and troubleshooting * Performance and security notes - Update README.md and AI_CONTEXT.md * Document service orchestration architecture * Explain slcompose functionality and commands * Reference new orchestration documentation
2026-07-02 14:13:15 +03:30
parent a74909be25
commit a9a758d332
14 changed files with 1039 additions and 55 deletions
@@ -363,6 +363,69 @@ Operational

 ---

+### Exact Syncer Demo
+
+Purpose:
+
+* Demo `.NET 9` Blazor application for Exact Online integration
+* Provides a user interface for connecting Exact webhooks
+* Syncs changes from a main division to dependent sub-divisions
+
+Behavior:
+
+* When the main division relation changes, the app updates related sub-divisions with Exact data
+* Example: a change in main division Relation 1 propagates to divisions 2–10
+
+Runtime:
+
+* Hostname: `exactsyncer.silveressence.net`
+* Container: `exact-syncer`
+* Port: `8080`
+
+Deployment notes:
+
+* Demo version for clients to evaluate Exact Online sync behavior
+* Can be recreated as a dedicated instance for new customers
+
+Status:
+
+```text
+Operational demo
+```
+
+---
+
+### BobAutoWas Exact Syncer Instance
+
+Purpose:
+
+* Client-specific Exact Syncer instance for BobAutoWas
+* Recreated from the Exact Syncer demo for customer delivery
+* Provides the same webhook-driven and division-sync workflow
+
+Behavior:
+
+* Uses the same Exact Online master/sub-division sync model as the demo
+* Intended for client preview and delivery use
+
+Runtime:
+
+* Hostname: `cicd.silveressence.net`
+* Container: `bobsAutowas`
+* Port: `8080`
+
+Deployment notes:
+
+* Dedicated customer-facing instance of Exact Syncer
+* Managed as an active demo/product instance
+
+Status:
+
+```text
+Active client instance
+```
+---
+
 ### DbGate

 URL:
@@ -398,18 +461,18 @@ Operational

 ---

-### Xray
+### Xray (Direct Production)

 Purpose:

-* Connectivity and tunneling layer
-* Improve long-distance connectivity stability to SilverLinux
-* Maintain secure routing paths when direct connectivity is limited
+* Primary production VLESS endpoint
+* Direct OVH internet routing for stable public access
+* Separate from VPN-routed traffic to protect production stability

 Classification:

 ```text
-Network tunneling / connectivity layer
+Primary production connectivity layer
 ```

 Networks:
@@ -430,6 +493,7 @@ ghcr.io/xtls/xray-core:latest

 Runtime note:

+* Direct production Xray is unmodified and isolated from the VPN routing setup.
 * The `xray_default` network exists, but the running `xray` container was attached only to `proxy` in the 2026-06-24 runtime snapshot.

 Security:
@@ -446,6 +510,83 @@ Operational

 ---

+### VPN Gateway (Gluetun PIA)
+
+Purpose:
+
+* Containerized VPN gateway for Private Internet Access (PIA)
+* Routes selected containers through WireGuard without affecting host networking
+* Provides an isolated VPN execution layer for safe experimentation
+
+Container:
+
+```text
+gluetun-pia
+```
+
+VPN Provider:
+
+* Private Internet Access (PIA)
+
+Mode:
+
+* Custom WireGuard configuration generated by PIA
+
+Notes:
+
+* No VPN software runs on the host
+* Prevents SSH lockout and host routing table override issues
+* Only selected services use this VPN gateway
+
+Status:
+
+```text
+Operational VPN gateway
+```
+
+---
+
+### VPN-Routed Xray (xray-pia)
+
+Purpose:
+
+* Secondary VLESS endpoint routed through the PIA VPN gateway
+* Maintains a separate service path from the direct production Xray endpoint
+
+Container:
+
+```text
+xray-pia
+```
+
+Runtime ports:
+
+```text
+0.0.0.0:32444 -> 32444/tcp
+```
+
+Network mode:
+
+* `container:gluetun-pia`
+
+Routing:
+
+* Client -> `xray-pia` (32444) -> `gluetun-pia` -> PIA WireGuard VPN -> Internet
+
+Notes:
+
+* Fully isolated from host networking
+* Does not impact the direct production Xray endpoint
+* Supports future multiple VPN exit points
+
+Status:
+
+```text
+Operational secondary VPN endpoint
+```
+
+---
+
 ## Shared Infrastructure

 ### Docker