add dbgate and mssql

dbgate/README.md

@@ -0,0 +1,135 @@
+# DbGate
+
+## Overview
+
+DbGate is the HTTPS-accessible database administration portal for SilverLinux.
+
+URL:
+
+```text
+https://dbgate.silveressence.net
+```
+
+Status:
+
+```text
+Operational
+```
+
+It administers private Microsoft SQL Server and PostgreSQL instances without exposing either database server directly to the internet.
+
+---
+
+## Service Information
+
+| Property | Value |
+| --- | --- |
+| Container | `dbgate` |
+| Image | `dbgate/dbgate:latest` |
+| Application port | `3000` |
+| Networks | `internal`, `proxy` |
+| Compose location | `/srv/docker/dbgate/docker-compose.yml` |
+| Data location | `/srv/docker/dbgate/data` |
+
+The `internal` network provides database access. The `proxy` network connects DbGate to Nginx Proxy Manager.
+
+---
+
+## Reverse Proxy
+
+| Setting | Value |
+| --- | --- |
+| Domain | `dbgate.silveressence.net` |
+| Scheme | `http` |
+| Forward host | `dbgate` |
+| Forward port | `3000` |
+| SSL | Let's Encrypt |
+| Force SSL | Enabled |
+| HTTP/2 | Enabled |
+
+Only DbGate is publicly accessible. MSSQL port `1433` and PostgreSQL port `5432` remain private.
+
+---
+
+## Authentication
+
+DbGate requires a username and password before granting access. The initial unauthenticated deployment was corrected by configuring `LOGIN` and `PASSWORD`.
+
+The running server currently stores the DbGate credentials directly in its Compose configuration. The repository intentionally does not contain the password; its Compose definition resolves `DBGATE_PASSWORD` from the deployment environment.
+
+Planned improvement:
+
+* Add `DBGATE_PASSWORD` to `/srv/secrets/company.env`.
+* Deploy with `docker compose --env-file /srv/secrets/company.env up -d`.
+* Remove the credential from the server-side Compose file.
+
+---
+
+## Database Connections
+
+### SilverLinux MSSQL
+
+| Setting | Value |
+| --- | --- |
+| Engine | SQL Server |
+| Server | `mssql` |
+| Port | `1433` |
+| Default database | `master` |
+| User | `sa` |
+| Encrypt | Yes |
+| Trust server certificate | Yes |
+
+The connection was validated against `master`, `model`, `msdb` and `tempdb`.
+
+PostgreSQL is also reachable through the shared `internal` network using hostname `postgres` and port `5432`.
+
+---
+
+## Validation
+
+```bash
+docker ps
+docker logs dbgate
+```
+
+Expected log message:
+
+```text
+DbGate API listening on port 3000
+```
+
+---
+
+## Architecture
+
+```text
+Internet
+  -> Nginx Proxy Manager
+  -> DbGate
+       -> MSSQL 2022 Express
+       -> PostgreSQL 17
+```
+
+---
+
+## Backup Requirements
+
+Back up:
+
+```text
+/srv/docker/dbgate/data
+```
+
+Also retain the Compose definition, Nginx Proxy Manager configuration and DbGate credential through the centralized secrets backup after migration.
+
+---
+
+## Related Documentation
+
+* mssql/README.md
+* postgres/README.md
+* nginx-proxy-manager/README.md
+* docs/domains.md
+* docs/security.md
+* docs/secrets.md
+* docs/backups.md

dbgate/docker-compose.yml

@@ -0,0 +1,19 @@
+services:
+  dbgate:
+    image: dbgate/dbgate:latest
+    container_name: dbgate
+    restart: unless-stopped
+    environment:
+      LOGIN: admin
+      PASSWORD: ${DBGATE_PASSWORD}
+    volumes:
+      - /srv/docker/dbgate/data:/root/.dbgate
+    networks:
+      - internal
+      - proxy
+
+networks:
+  internal:
+    external: true
+  proxy:
+    external: true