# Services ## Overview This document lists all services running on SilverLinux and their purpose. Generated state reference: ```text 2026-06-25 infrastructure review ``` --- ## Running Services ### PostgreSQL Purpose: * Primary shared database platform * Application data storage Used by: * Gitea * OpenProject Status: ```text Running ``` --- ### Microsoft SQL Server Express Purpose: * Secondary database platform for SQL Server compatibility * Support future applications requiring Microsoft SQL Server * Extend the platform beyond PostgreSQL-only workloads Image: ```text mcr.microsoft.com/mssql/server:2022-latest ``` Network: ```text internal ``` Exposure: * Port 1433 is not published * Not routed through Nginx Proxy Manager * Private database access only Status: ```text Operational ``` --- ### Gitea URL: ```text https://git.silveressence.net ``` Purpose: * Source control * Git repositories * Pull requests * Issue tracking Status: ```text Running ``` --- ### OpenProject URL: ```text https://team.silveressence.net ``` Purpose: * Project management * Work packages * Time tracking * Team collaboration Status: ```text Running ``` --- ### Jitsi Meet URL: ```text https://meet.silveressence.net ``` Purpose: * Video conferencing * Team meetings * Customer meetings Status: ```text Running ``` --- ### Portainer URL: ```text https://portainer.silveressence.net ``` Purpose: * Docker administration * Stack deployment * Container monitoring Status: ```text Running ``` --- ### Nginx Proxy Manager Purpose: * Reverse proxy * SSL termination * Domain routing * Certificate management Status: ```text Running ``` --- ### Prometheus Purpose: * Metrics collection * Alert rule engine * Monitoring data storage * Scrape targets for system, Docker and backup metrics Scrapes: * Prometheus * Node Exporter * cAdvisor * SilverLinux backup metrics Alert categories: * Backup * System pressure * Monitoring health * Database availability * Container health Status: ```text Running ``` --- ### Grafana Purpose: * Monitoring dashboards * Metrics visualization * Prometheus datasource frontend Dashboards: * Custom backup dashboard * Custom system dashboard * Docker monitoring dashboard Note: The imported Prometheus 2.0 Overview dashboard is not compatible with the installed Prometheus version `3.5.4`. This is a third-party dashboard compatibility issue, not an infrastructure problem. Status: ```text Running ``` --- ### Alertmanager Purpose: * Alert routing * Email notifications * Incident grouping * Alert deduplication * Severity-based routing Recipients: * `oclick021@gmail.com` * `martin@silversolutions.nl` Incident groups: * `backup_failure` * `system_pressure` * `storage_pressure` * `database_outage` * `monitoring_failure` * `container_health` Status: ```text Running ``` --- ### Node Exporter Purpose: * Host metrics collection * CPU, memory and disk metrics * Textfile Collector endpoint for SilverLinux backup metrics Status: ```text Running ``` --- ### cAdvisor Purpose: * Docker container metrics * Container CPU, memory and runtime visibility Status: ```text Running ``` --- ### BaGet URL: ```text https://nuget.silveressence.net ``` Purpose: * Private NuGet repository * Internal Silver.* package distribution * Package source for CI/CD * Package source for team development Access: * Routed through Nginx Proxy Manager Status: ```text Running ``` --- ### Gitea Actions Runner Location: ```text /srv/docker/gitea-runner ``` Image: ```text gitea/act_runner:latest ``` Runner Name: ```text silverlinux-runner ``` Type: ```text Global Runner ``` Labels: * `ubuntu-latest` * `ubuntu-24.04` * `ubuntu-22.04` Status: ```text Operational ``` --- ### Exact Syncer Demo Purpose: * Demo `.NET 9` Blazor application for Exact Online integration * Provides a user interface for connecting Exact webhooks * Syncs changes from a main division to dependent sub-divisions Behavior: * When the main division relation changes, the app updates related sub-divisions with Exact data * Example: a change in main division Relation 1 propagates to divisions 2–10 Runtime: * Hostname: `exactsyncer.silveressence.net` * Container: `exact-syncer` * Port: `8080` Deployment notes: * Demo version for clients to evaluate Exact Online sync behavior * Can be recreated as a dedicated instance for new customers Status: ```text Operational demo ``` --- ### BobAutoWas Exact Syncer Instance Purpose: * Client-specific Exact Syncer instance for BobAutoWas * Recreated from the Exact Syncer demo for customer delivery * Provides the same webhook-driven and division-sync workflow Behavior: * Uses the same Exact Online master/sub-division sync model as the demo * Intended for client preview and delivery use Runtime: * Hostname: `cicd.silveressence.net` * Container: `bobsAutowas` * Port: `8080` Deployment notes: * Dedicated customer-facing instance of Exact Syncer * Managed as an active demo/product instance Status: ```text Active client instance ``` --- ### DbGate URL: ```text https://dbgate.silveressence.net ``` Purpose: * Browser-based PostgreSQL administration * Browser-based MSSQL administration * Database explorer and debugging interface Networks: * `internal` for private database connectivity * `proxy` for Nginx Proxy Manager Security: * Publicly reachable through the proxy layer * HTTPS enforced * DbGate username and password required * Authentication must remain hardened and periodically verified * Database ports remain private Status: ```text Operational ``` --- ### Sentry URL: ```text https://sentry.silveressence.net ``` Purpose: * Centralized error tracking and observability * Application exception diagnostics * Release health visibility * Performance monitoring Architecture: * Distributed system with 70+ services * Components: Relay, Kafka, Snuba, ClickHouse, PostgreSQL, Redis, SeaweedFS * Self-hosted deployment Networks: * `proxy` for Nginx Proxy Manager access * `sentry-self-hosted_default` for internal service communication Management: * Managed via slcompose orchestrator * Automated Infisical secret injection * Single atomic deployment unit Data Storage: * PostgreSQL for metadata * ClickHouse for high-performance event storage * Redis for caching and coordination * SeaweedFS for attachments and objects Backup Requirements: * PostgreSQL database volume * ClickHouse data volume * Sentry configuration files * Persistent Kafka data (if enabled) Status: ```text Running ``` See [docs/sentry.md](sentry.md) for complete deployment documentation. --- ### Xray (Direct Production) Purpose: * Primary production VLESS endpoint * Direct OVH internet routing for stable public access * Separate from VPN-routed traffic to protect production stability Classification: ```text Primary production connectivity layer ``` Networks: * `proxy` Runtime ports: ```text 0.0.0.0:32443 -> 8080/tcp ``` Image: ```text ghcr.io/xtls/xray-core:latest ``` Runtime note: * Direct production Xray is unmodified and isolated from the VPN routing setup. * The `xray_default` network exists, but the running `xray` container was attached only to `proxy` in the 2026-06-24 runtime snapshot. Security: * Public tunneling endpoint exposure must be monitored * Access policy and abuse monitoring must be reviewed regularly * Not classified as an application backend service Status: ```text Operational ``` --- ### VPN Gateway (Gluetun PIA) Purpose: * Containerized VPN gateway for Private Internet Access (PIA) * Routes selected containers through WireGuard without affecting host networking * Provides an isolated VPN execution layer for safe experimentation Container: ```text gluetun-pia ``` VPN Provider: * Private Internet Access (PIA) Mode: * Custom WireGuard configuration generated by PIA Notes: * No VPN software runs on the host * Prevents SSH lockout and host routing table override issues * Only selected services use this VPN gateway Status: ```text Operational VPN gateway ``` --- ### VPN-Routed Xray (xray-pia) Purpose: * Secondary VLESS endpoint routed through the PIA VPN gateway * Maintains a separate service path from the direct production Xray endpoint Container: ```text xray-pia ``` Runtime ports: ```text 0.0.0.0:32444 -> 32444/tcp ``` Network mode: * `container:gluetun-pia` Routing: * Client -> `xray-pia` (32444) -> `gluetun-pia` -> PIA WireGuard VPN -> Internet Notes: * Fully isolated from host networking * Does not impact the direct production Xray endpoint * Supports future multiple VPN exit points Status: ```text Operational secondary VPN endpoint ``` --- ## Shared Infrastructure ### Docker Purpose: * Container hosting * Service isolation Status: ```text Running ``` --- ### Internal Docker Network Purpose: * Private communication between services Status: ```text Running ``` --- ### Proxy Docker Network Purpose: * HTTP and HTTPS service exposure through Nginx Proxy Manager * Shared public routing layer for web-facing services Status: ```text Running ``` --- ### Isolated Docker Networks Purpose: * Keep specialized infrastructure stacks isolated from application backends * Separate Jitsi, Xray and CI/CD runner traffic from shared database traffic Networks: * `jitsi-docker-jitsi-meet-aa76415_meet.jitsi` * `xray_default` * `gitea-runner_default` Status: ```text Running ``` --- ### Shared Secrets Location: ```text /srv/secrets/company.env ``` Purpose: * SMTP credentials * Database passwords * Application secrets Status: ```text Active ``` --- ## Removed Services ## Planned Services See: ```text docs/roadmap.md ``` Phase 1: * Loki * Redis * Authelia Phase 2: * CrowdSec * Restic * Fail2Ban upgrade * Cloudflare rate limiting and WAF Phase 3: * SonarQube * Harbor * Backstage * Nextcloud --- ### Plane.so Reason: OpenProject was selected as the primary project management platform. Plane.so is not used and will not be used. Status: ```text Removed ``` Cleanup: * Containers removed * Nginx Proxy Manager route removed * Unused SSL certificate removed from the server --- ## Related Documentation * docs/server.md * docs/network.md * docs/roadmap.md * docs/monitoring.md * docs/domains.md * docs/security.md * docs/backups.md