add dbgate and mssql
This commit is contained in:
+21
-5
@@ -19,6 +19,7 @@ Public IP: 51.255.83.140
|
||||
## Core Services
|
||||
|
||||
* PostgreSQL
|
||||
* Microsoft SQL Server 2022 Express
|
||||
* Gitea
|
||||
* OpenProject
|
||||
* Jitsi Meet
|
||||
@@ -26,6 +27,7 @@ Public IP: 51.255.83.140
|
||||
* Nginx Proxy Manager
|
||||
* BaGet
|
||||
* Gitea Actions Runner (`silverlinux-runner`)
|
||||
* DbGate
|
||||
|
||||
## Domains
|
||||
|
||||
@@ -39,6 +41,8 @@ portainer.silveressence.net -> Portainer
|
||||
|
||||
nuget.silveressence.net -> BaGet (through Nginx Proxy Manager)
|
||||
|
||||
dbgate.silveressence.net -> DbGate (through Nginx Proxy Manager)
|
||||
|
||||
## Secrets
|
||||
|
||||
Secrets are stored in:
|
||||
@@ -54,10 +58,19 @@ Always use env_file.
|
||||
proxy
|
||||
internal
|
||||
|
||||
MSSQL is attached only to `internal`. DbGate is attached to both `internal` and `proxy`.
|
||||
|
||||
## Authentication
|
||||
|
||||
Gitea:
|
||||
|
||||
* Local accounts
|
||||
* OpenID disabled
|
||||
* Google OAuth planned
|
||||
* GitHub OAuth planned
|
||||
|
||||
OpenProject:
|
||||
|
||||
* Local accounts
|
||||
|
||||
## CI/CD
|
||||
@@ -69,13 +82,14 @@ The global self-hosted runner is operational at `/srv/docker/gitea-runner` with
|
||||
Silver 2.0 uses `.gitea/workflows/package.yml` to publish NuGet packages to BaGet when a push to `net-8-version` has a commit message containing `[Package]`.
|
||||
|
||||
The runner registration token is stored in `/srv/secrets/company.env`. The BaGet publishing key is stored as the repository Actions secret `BAGET_API_KEY`.
|
||||
* OpenID disabled
|
||||
* Google OAuth planned
|
||||
* GitHub OAuth planned
|
||||
|
||||
OpenProject:
|
||||
## Databases
|
||||
|
||||
* Local accounts
|
||||
PostgreSQL 17 and Microsoft SQL Server 2022 Express are operational.
|
||||
|
||||
MSSQL uses hostname `mssql` on the `internal` Docker network. Port 1433 is not published.
|
||||
|
||||
DbGate provides authenticated HTTPS administration for MSSQL and PostgreSQL at `https://dbgate.silveressence.net`.
|
||||
|
||||
## Documentation
|
||||
|
||||
@@ -94,3 +108,5 @@ and the README.md of each service folder before making infrastructure recommenda
|
||||
* PostgreSQL selected as shared database platform
|
||||
* BaGet deployed at nuget.silveressence.net through Nginx Proxy Manager
|
||||
* Gitea Actions and a global self-hosted runner selected for package publishing
|
||||
* MSSQL Express deployed alongside PostgreSQL
|
||||
* DbGate selected as the database administration portal
|
||||
|
||||
+59
-10
@@ -28,6 +28,28 @@ Critical
|
||||
|
||||
---
|
||||
|
||||
#### Microsoft SQL Server
|
||||
|
||||
Data location:
|
||||
|
||||
```text
|
||||
/srv/docker/mssql/data
|
||||
```
|
||||
|
||||
Required:
|
||||
|
||||
* Native SQL Server database backups
|
||||
* MSSQL Compose configuration
|
||||
* `MSSQL_SA_PASSWORD` from the shared secrets backup
|
||||
|
||||
Importance:
|
||||
|
||||
Critical
|
||||
|
||||
Do not rely on copying live database files as the only backup method.
|
||||
|
||||
---
|
||||
|
||||
#### Gitea Data
|
||||
|
||||
Location:
|
||||
@@ -81,7 +103,9 @@ Contains:
|
||||
|
||||
* SMTP credentials
|
||||
* PostgreSQL passwords
|
||||
* MSSQL SA password
|
||||
* OpenProject secrets
|
||||
* Future DbGate password
|
||||
* Future OAuth secrets
|
||||
|
||||
Importance:
|
||||
@@ -196,6 +220,27 @@ Medium
|
||||
|
||||
---
|
||||
|
||||
#### DbGate Data
|
||||
|
||||
Location:
|
||||
|
||||
```text
|
||||
/srv/docker/dbgate/data
|
||||
```
|
||||
|
||||
Contains:
|
||||
|
||||
* Saved connections
|
||||
* DbGate application state
|
||||
|
||||
Also retain the Nginx Proxy Manager route and DbGate authentication credential.
|
||||
|
||||
Importance:
|
||||
|
||||
Medium
|
||||
|
||||
---
|
||||
|
||||
## Backup Storage
|
||||
|
||||
Current Location:
|
||||
@@ -247,15 +292,17 @@ Keep:
|
||||
|
||||
Restore order:
|
||||
|
||||
1. PostgreSQL
|
||||
2. Shared secrets
|
||||
3. Nginx Proxy Manager
|
||||
4. Gitea
|
||||
5. OpenProject
|
||||
6. Portainer
|
||||
7. Jitsi
|
||||
8. BaGet
|
||||
9. Gitea Actions Runner
|
||||
1. Shared secrets
|
||||
2. PostgreSQL
|
||||
3. Microsoft SQL Server
|
||||
4. Nginx Proxy Manager
|
||||
5. Gitea
|
||||
6. OpenProject
|
||||
7. Portainer
|
||||
8. Jitsi
|
||||
9. BaGet
|
||||
10. Gitea Actions Runner
|
||||
11. DbGate
|
||||
|
||||
---
|
||||
|
||||
@@ -289,7 +336,7 @@ data directories.
|
||||
|
||||
### Step 4
|
||||
|
||||
Restore PostgreSQL databases.
|
||||
Restore PostgreSQL and Microsoft SQL Server databases.
|
||||
|
||||
### Step 5
|
||||
|
||||
@@ -314,3 +361,5 @@ Verify:
|
||||
* postgres/README.md
|
||||
* gitea/README.md
|
||||
* openproject/README.md
|
||||
* mssql/README.md
|
||||
* dbgate/README.md
|
||||
|
||||
@@ -274,6 +274,54 @@ when additional services begin consuming the same secret management approach.
|
||||
|
||||
---
|
||||
|
||||
## 2026-06-22 - Deploy Microsoft SQL Server Express Alongside PostgreSQL
|
||||
|
||||
Decision:
|
||||
|
||||
* Run Microsoft SQL Server 2022 Express alongside PostgreSQL.
|
||||
* Attach MSSQL only to the `internal` Docker network.
|
||||
* Do not publish port `1433` or route MSSQL through the reverse proxy.
|
||||
* Store `MSSQL_SA_PASSWORD` in `/srv/secrets/company.env`.
|
||||
|
||||
Reason:
|
||||
|
||||
* Support Silver projects that require Microsoft SQL Server compatibility.
|
||||
* Allow both database platforms to coexist without exposing database ports.
|
||||
|
||||
Status:
|
||||
|
||||
```text
|
||||
Implemented
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 2026-06-22 - Select DbGate for Database Administration
|
||||
|
||||
Decision:
|
||||
|
||||
* Use DbGate to administer Microsoft SQL Server and PostgreSQL.
|
||||
* Connect DbGate to both the `internal` and `proxy` Docker networks.
|
||||
* Publish only the DbGate web interface through Nginx Proxy Manager.
|
||||
* Require DbGate authentication and HTTPS.
|
||||
|
||||
Reason:
|
||||
|
||||
* Provides one lightweight, modern browser interface for both database platforms.
|
||||
* Keeps PostgreSQL and MSSQL private.
|
||||
|
||||
Follow-up:
|
||||
|
||||
Move the DbGate password from the server-side Compose configuration to `/srv/secrets/company.env`.
|
||||
|
||||
Status:
|
||||
|
||||
```text
|
||||
Implemented
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Future Decisions
|
||||
|
||||
Document future decisions using the following template:
|
||||
|
||||
@@ -145,6 +145,38 @@ Active
|
||||
|
||||
---
|
||||
|
||||
### DbGate
|
||||
|
||||
Domain:
|
||||
|
||||
```text
|
||||
dbgate.silveressence.net
|
||||
```
|
||||
|
||||
Purpose:
|
||||
|
||||
* HTTPS database administration portal
|
||||
|
||||
Container:
|
||||
|
||||
```text
|
||||
dbgate
|
||||
```
|
||||
|
||||
Routing:
|
||||
|
||||
```text
|
||||
Nginx Proxy Manager -> dbgate:3000
|
||||
```
|
||||
|
||||
Status:
|
||||
|
||||
```text
|
||||
Active
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## DNS
|
||||
|
||||
DNS records should point to:
|
||||
|
||||
@@ -67,6 +67,19 @@ Used by:
|
||||
|
||||
---
|
||||
|
||||
### Microsoft SQL Server
|
||||
|
||||
```text
|
||||
MSSQL_SA_PASSWORD
|
||||
```
|
||||
|
||||
Used by:
|
||||
|
||||
* Microsoft SQL Server 2022 Express
|
||||
* DbGate's MSSQL connection
|
||||
|
||||
---
|
||||
|
||||
### OpenProject
|
||||
|
||||
```text
|
||||
@@ -132,6 +145,25 @@ Future use:
|
||||
|
||||
---
|
||||
|
||||
### DbGate Credential Migration
|
||||
|
||||
The running DbGate deployment currently has its login credential in the server-side Compose configuration. Move the password to:
|
||||
|
||||
```text
|
||||
/srv/secrets/company.env
|
||||
DBGATE_PASSWORD
|
||||
```
|
||||
|
||||
The repository Compose definition already references `DBGATE_PASSWORD` and contains no real password.
|
||||
|
||||
Status:
|
||||
|
||||
```text
|
||||
Migration pending
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Rules
|
||||
|
||||
* Never commit secrets to Git.
|
||||
|
||||
+5
-2
@@ -72,6 +72,7 @@ Examples:
|
||||
|
||||
* SMTP credentials
|
||||
* PostgreSQL passwords
|
||||
* MSSQL SA password
|
||||
* OpenProject secrets
|
||||
* Future OAuth secrets
|
||||
|
||||
@@ -169,11 +170,13 @@ Priority:
|
||||
|
||||
## Database Security
|
||||
|
||||
PostgreSQL is not exposed publicly.
|
||||
PostgreSQL and Microsoft SQL Server are not exposed publicly.
|
||||
|
||||
Database access is restricted to Docker internal networks.
|
||||
|
||||
Applications communicate with PostgreSQL through the internal Docker network.
|
||||
Applications and DbGate communicate with the database containers through the `internal` Docker network.
|
||||
|
||||
DbGate is the public administration entry point and must require authentication and HTTPS. Its web interface is routed through Nginx Proxy Manager; database ports `5432` and `1433` remain private.
|
||||
|
||||
---
|
||||
|
||||
|
||||
+32
-1
@@ -50,7 +50,13 @@ Purpose:
|
||||
|
||||
Purpose:
|
||||
|
||||
* Shared database platform
|
||||
* Primary PostgreSQL database platform
|
||||
|
||||
### Microsoft SQL Server Express
|
||||
|
||||
Purpose:
|
||||
|
||||
* Private SQL Server platform for compatible applications
|
||||
|
||||
### Fail2Ban
|
||||
|
||||
@@ -93,6 +99,7 @@ Examples:
|
||||
* OpenProject
|
||||
* Jitsi Meet
|
||||
* Portainer
|
||||
* DbGate
|
||||
|
||||
---
|
||||
|
||||
@@ -106,6 +113,8 @@ Examples:
|
||||
* Nginx Proxy Manager
|
||||
* BaGet
|
||||
* Gitea Actions Runner
|
||||
* Microsoft SQL Server 2022 Express
|
||||
* DbGate
|
||||
|
||||
---
|
||||
|
||||
@@ -128,6 +137,8 @@ Contains:
|
||||
/srv/docker/nginx-proxy-manager
|
||||
/srv/docker/baget
|
||||
/srv/docker/gitea-runner
|
||||
/srv/docker/mssql
|
||||
/srv/docker/dbgate
|
||||
```
|
||||
|
||||
---
|
||||
@@ -143,6 +154,8 @@ Contains:
|
||||
* SMTP credentials
|
||||
* Database passwords
|
||||
* Application secrets
|
||||
* MSSQL SA password
|
||||
* Future DbGate password
|
||||
* Future OAuth credentials
|
||||
|
||||
---
|
||||
@@ -189,6 +202,22 @@ Suggested structure:
|
||||
|
||||
---
|
||||
|
||||
### Microsoft SQL Server Express
|
||||
|
||||
```text
|
||||
/srv/docker/mssql/data
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### DbGate
|
||||
|
||||
```text
|
||||
/srv/docker/dbgate/data
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Nginx Proxy Manager
|
||||
|
||||
```text
|
||||
@@ -252,6 +281,8 @@ Implemented:
|
||||
* Shared secrets stored outside Git repositories
|
||||
* SSL certificates managed through Nginx Proxy Manager
|
||||
* PostgreSQL not exposed publicly
|
||||
* MSSQL port 1433 not exposed publicly
|
||||
* Database administration is available only through authenticated HTTPS access to DbGate
|
||||
* OpenID disabled in Gitea
|
||||
|
||||
---
|
||||
|
||||
@@ -135,6 +135,38 @@ Running
|
||||
|
||||
---
|
||||
|
||||
### Microsoft SQL Server Express
|
||||
|
||||
Purpose:
|
||||
|
||||
* Support applications requiring Microsoft SQL Server
|
||||
* Run alongside PostgreSQL as a private database platform
|
||||
|
||||
Image:
|
||||
|
||||
```text
|
||||
mcr.microsoft.com/mssql/server:2022-latest
|
||||
```
|
||||
|
||||
Network:
|
||||
|
||||
```text
|
||||
internal
|
||||
```
|
||||
|
||||
Exposure:
|
||||
|
||||
* Port 1433 is not published
|
||||
* Not routed through Nginx Proxy Manager
|
||||
|
||||
Status:
|
||||
|
||||
```text
|
||||
Operational
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### BaGet
|
||||
|
||||
URL:
|
||||
@@ -202,6 +234,38 @@ Operational
|
||||
|
||||
---
|
||||
|
||||
### DbGate
|
||||
|
||||
URL:
|
||||
|
||||
```text
|
||||
https://dbgate.silveressence.net
|
||||
```
|
||||
|
||||
Purpose:
|
||||
|
||||
* Browser-based MSSQL administration
|
||||
* Browser-based PostgreSQL administration
|
||||
|
||||
Networks:
|
||||
|
||||
* `internal` for private database connectivity
|
||||
* `proxy` for Nginx Proxy Manager
|
||||
|
||||
Security:
|
||||
|
||||
* HTTPS enforced
|
||||
* DbGate username and password required
|
||||
* Database ports remain private
|
||||
|
||||
Status:
|
||||
|
||||
```text
|
||||
Operational
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Shared Infrastructure
|
||||
|
||||
### Docker
|
||||
|
||||
Reference in New Issue
Block a user