SilverSolutions/silverlinux-infra

Fork 0

Files

T

Oclick021 3f94ced9ea Document Nextcloud deployment and Infisical secrets

2026-07-08 15:13:17 +03:30

6.6 KiB

Raw Permalink Blame History

Nextcloud

Overview

Nextcloud is deployed on SilverLinux as the private cloud storage and file sharing service for Silver Solutions.

Status:

Operational

Public URL:

https://cloud.silveressence.net

Verified runtime snapshot:

2026-07-08 13:21:13 +02:00

Runtime Stack

Location:

/srv/docker/nextcloud

Files present on the server:

/srv/docker/nextcloud/docker-compose.yml
/srv/docker/nextcloud/.env

The .env file was present in the 2026-07-08 snapshot, but passwords should come from Infisical through slcompose. Remove any secret values from this file if they still exist.

Management:

Docker Compose stack name: nextcloud
Managed by slcompose
Secrets injected at runtime through Infisical
Restart policy: unless-stopped

Containers

Container	Image	Purpose	Status at snapshot
`nextcloud`	`nextcloud:29-apache`	Web UI, file storage and application runtime	Up 6 days
`nextcloud-db`	`postgres:16`	Nextcloud PostgreSQL database	Up 6 days
`nextcloud-redis`	`redis:7-alpine`	Redis cache and locking backend	Up 6 days

Nextcloud application status:

installed: true
version: 29.0.16
maintenance: false
needsDbUpgrade: false

Networking

Networks:

proxy
nextcloud_nextcloud_internal

Network roles:

proxy connects nextcloud to Nginx Proxy Manager.
nextcloud_nextcloud_internal connects nextcloud, nextcloud-db and nextcloud-redis.
nextcloud-db and nextcloud-redis are internal-only and are not attached to proxy.

Verified subnet:

nextcloud_nextcloud_internal: 172.27.0.0/16

Port exposure:

nextcloud exposes 80/tcp only inside Docker.
nextcloud-db exposes 5432/tcp only inside Docker.
nextcloud-redis exposes 6379/tcp only inside Docker.
No Nextcloud stack ports were published to the host in the runtime snapshot.

Routing:

Internet
  -> Nginx Proxy Manager
  -> proxy network
  -> nextcloud:80

Domain And Proxy

Domain:

cloud.silveressence.net

Nextcloud trusted domain:

cloud.silveressence.net

Reverse proxy settings observed in the application configuration:

overwritehost: cloud.silveressence.net
overwriteprotocol: https
trusted_proxies: 172.16.0.0/12

Nginx Proxy Manager proxy host 13 forwards requests to nextcloud.

Proxy host settings from the 2026-07-08 Nginx Proxy Manager database query:

Setting	Value
Forward scheme	`http`
Forward host	`nextcloud`
Forward port	`80`
SSL Force	disabled
HTTP/2	disabled
HSTS	disabled
HSTS subdomains	disabled
Block Exploits	enabled
WebSocket	enabled
Access List	none
Status	enabled

Persistent Data

Docker volumes:

Volume	Mount point	Purpose
`nextcloud_nextcloud_data`	`/var/www/html`	Nextcloud application files, config, apps and user data directory
`nextcloud_nextcloud_db`	`/var/lib/next-cloud-postgresDb/data`	PostgreSQL data for Nextcloud

Host mountpoints:

/var/lib/docker/volumes/nextcloud_nextcloud_data/_data
/var/lib/docker/volumes/nextcloud_nextcloud_db/_data

Application data directory:

/var/www/html/data

Database

Database type:

pgsql

Database host:

nextcloud-db

Database image:

postgres:16

Operational note:

PostgreSQL is pinned to version 16 for this stack. During initial deployment, the database volume was initialized with PostgreSQL 16 and therefore must not be started with PostgreSQL 17 without a proper PostgreSQL major-version upgrade.

Redis

Redis host:

nextcloud-redis

Port:

Purpose:

Cache backend
File locking support
Internal application performance support

Email

Nextcloud SMTP is configured.

Observed application mail settings:

mail_smtphost: smtp.gmail.com
mail_smtpport: 465
mail_smtpsecure: ssl
mail_from_address: noreply
mail_domain: silveressence.net

Sender:

noreply@silveressence.net

Credentials must remain in Infisical and must not be committed.

Secrets

Required secret values include:

NEXTCLOUD_ADMIN_USER
NEXTCLOUD_ADMIN_PASSWORD
POSTGRES_DB
POSTGRES_USER
POSTGRES_PASSWORD
SMTP credentials if not inherited from shared mail configuration

Security note:

Nextcloud config.php contains sensitive values such as secret, passwordsalt, database credentials and SMTP credentials. Do not paste the raw file into public channels and rotate any exposed credentials.

Backup Requirements

Back up these items:

nextcloud_nextcloud_data
nextcloud_nextcloud_db
/srv/docker/nextcloud/docker-compose.yml
/srv/docker/nextcloud/.env only if it contains non-secret runtime configuration
Infisical secrets for the /nextcloud path

The nextcloud_nextcloud_data volume includes the application config and user uploaded files. The nextcloud_nextcloud_db volume contains the metadata database and should also be backed up with a logical PostgreSQL dump where possible.

See docs/backups.md for the backup recipe and restore order.

Operational Commands

Check stack status:

docker ps --filter "name=nextcloud"

Check Nextcloud application status:

docker exec -u www-data nextcloud php -f /var/www/html/occ status

Check selected config values:

docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get trusted_domains
docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get overwritehost
docker exec -u www-data nextcloud php -f /var/www/html/occ config:system:get overwriteprotocol

Manage through slcompose:

slcompose up nextcloud
slcompose restart nextcloud
slcompose logs nextcloud
slcompose logs-tail nextcloud 200

Verification Evidence

The 2026-07-08 server output verified:

Hostname silverlinux
Containers nextcloud, nextcloud-db and nextcloud-redis running
Compose files present under /srv/docker/nextcloud
Public domain cloud.silveressence.net
Nextcloud version 29.0.16
Maintenance mode disabled
Database upgrade not required
PostgreSQL backend at nextcloud-db
Redis backend at nextcloud-redis
Docker volumes nextcloud_nextcloud_data and nextcloud_nextcloud_db
No host-published ports for the Nextcloud stack

6.6 KiB Raw Permalink Blame History