add dbgate and mssql

mssql/README.md

@@ -0,0 +1,117 @@
+# Microsoft SQL Server Express
+
+## Overview
+
+Microsoft SQL Server 2022 Express runs alongside PostgreSQL for Silver projects that require Microsoft SQL Server compatibility.
+
+Status:
+
+```text
+Operational
+```
+
+Verified version:
+
+```text
+Microsoft SQL Server 2022 Express Edition (64-bit)
+Linux
+Version 16.0.4255.1
+```
+
+---
+
+## Service Information
+
+| Property | Value |
+| --- | --- |
+| Container | `mssql` |
+| Image | `mcr.microsoft.com/mssql/server:2022-latest` |
+| Edition | Express |
+| Docker network | `internal` |
+| Compose location | `/srv/docker/mssql/docker-compose.yml` |
+| Data location | `/srv/docker/mssql/data` |
+
+Port `1433` is not published by Docker or exposed through Nginx Proxy Manager. Applications connect privately over the `internal` Docker network using hostname `mssql`.
+
+Server-side administration must use `docker exec` or another container attached to `internal`; there is no host-bound SQL port in the current configuration.
+
+---
+
+## Secrets
+
+The SA password is stored outside the repository:
+
+```text
+/srv/secrets/company.env
+MSSQL_SA_PASSWORD
+```
+
+Never commit the value to Git or place it directly in the Compose file.
+
+---
+
+## Deployment
+
+Docker Compose must be given the secrets file for interpolation:
+
+```bash
+cd /srv/docker/mssql
+docker compose --env-file /srv/secrets/company.env up -d
+```
+
+The Compose `env_file:` setting passes variables into the container. It does not make them available while Compose resolves `${MSSQL_SA_PASSWORD}`, which is why `--env-file` is required.
+
+Validate startup:
+
+```bash
+docker ps
+docker logs mssql
+```
+
+Expected log message:
+
+```text
+SQL Server is now ready for client connections.
+```
+
+---
+
+## Data Directory Permissions
+
+The SQL Server container runs as UID and GID `10001`. For a new, empty deployment, initialize the bind-mounted directory with:
+
+```bash
+sudo mkdir -p /srv/docker/mssql/data
+sudo chown -R 10001:10001 /srv/docker/mssql/data
+sudo chmod -R 700 /srv/docker/mssql/data
+```
+
+Do not delete or recreate the directory after databases exist. Removing `/srv/docker/mssql/data` destroys the persisted SQL Server data.
+
+---
+
+## Troubleshooting
+
+### Variable Is Not Set
+
+If Compose reports that `MSSQL_SA_PASSWORD` is unset and defaults to a blank string, use the required `docker compose --env-file /srv/secrets/company.env up -d` command.
+
+### System Directory Permission Denied
+
+If `[/.system]` cannot be created, verify that `/srv/docker/mssql/data` is owned by `10001:10001` with mode `700`.
+
+### Password Validation Failed
+
+Confirm that the password meets SQL Server complexity requirements and that Compose resolved `MSSQL_SA_PASSWORD` from the secrets file.
+
+---
+
+## Related Documentation
+
+* docs/server.md
+* docs/services.md
+* docs/security.md
+* docs/secrets.md
+* docs/backups.md
+* dbgate/README.md
+* postgres/README.md

mssql/docker-compose.yml

@@ -0,0 +1,19 @@
+services:
+  mssql:
+    image: mcr.microsoft.com/mssql/server:2022-latest
+    container_name: mssql
+    restart: unless-stopped
+    env_file:
+      - /srv/secrets/company.env
+    environment:
+      ACCEPT_EULA: Y
+      MSSQL_PID: Express
+      MSSQL_SA_PASSWORD: ${MSSQL_SA_PASSWORD}
+    volumes:
+      - /srv/docker/mssql/data:/var/opt/mssql
+    networks:
+      - internal
+
+networks:
+  internal:
+    external: true