198 lines
4.7 KiB
Markdown
198 lines
4.7 KiB
Markdown
# SilverLinux Infrastructure
|
||
|
||
This repository contains the infrastructure configuration, deployment files and operational documentation for the SilverLinux server.
|
||
|
||
SilverLinux is the primary self-hosted platform for Silver Solutions and hosts source control, project management, collaboration, communication and CI/CD services.
|
||
|
||
---
|
||
|
||
## Server Information
|
||
|
||
| Property | Value |
|
||
| ---------------- | ----------------------- |
|
||
| Hostname | silverlinux |
|
||
| Provider | OVH |
|
||
| Operating System | Ubuntu Server 24.04 LTS |
|
||
| Public IP | 51.255.83.140 |
|
||
| CPU | Intel Xeon-D 1520 |
|
||
| Memory | 32 GB RAM |
|
||
| Storage | 2 × 480 GB SSD RAID1 |
|
||
|
||
---
|
||
|
||
## Core Services
|
||
|
||
### Running
|
||
|
||
* PostgreSQL
|
||
* Microsoft SQL Server 2022 Express
|
||
* Gitea
|
||
* OpenProject
|
||
* Jitsi Meet
|
||
* Portainer
|
||
* Nginx Proxy Manager
|
||
* BaGet
|
||
* Gitea Actions Runner
|
||
* DbGate
|
||
* Xray
|
||
* Sentry
|
||
* Prometheus
|
||
* Grafana
|
||
* Node Exporter
|
||
* cAdvisor
|
||
* Alertmanager
|
||
* Nextcloud
|
||
|
||
### Planned
|
||
|
||
* Loki
|
||
* Redis
|
||
* Authelia
|
||
* CrowdSec
|
||
* Restic
|
||
* Harbor
|
||
* SonarQube
|
||
* Backstage
|
||
|
||
See [docs/roadmap.md](docs/roadmap.md) for the phased infrastructure roadmap.
|
||
|
||
### Removed
|
||
|
||
* Plane.so (replaced by OpenProject)
|
||
|
||
---
|
||
|
||
## Service Orchestration
|
||
|
||
All Docker services on SilverLinux are managed through the **slcompose orchestrator** (`slcompose`), a bash wrapper that:
|
||
|
||
1. **Injects Secrets** — Uses Infisical CLI to load environment variables from Infisical and inject them into each service at runtime
|
||
2. **Boots All Services** — Automatically starts all services at system startup via systemd
|
||
3. **Manages Services** — Provides CLI commands to start, stop, restart, and view logs for individual services
|
||
|
||
### How It Works
|
||
|
||
```bash
|
||
# Load secrets from Infisical and start all services
|
||
slcompose boot
|
||
|
||
# Manage individual services
|
||
slcompose up gitea # Start gitea
|
||
slcompose down gitea # Stop gitea
|
||
slcompose restart gitea # Restart gitea
|
||
slcompose logs gitea # Stream live logs
|
||
slcompose logs-tail gitea 200 # View last 200 lines
|
||
slcompose list # List all services
|
||
|
||
# View injected environment variables
|
||
slcompose env gitea # Show env vars for gitea
|
||
slcompose env-all # Show env vars for all services
|
||
```
|
||
|
||
**Service Auto-Boot:** The systemd service `slcompose.service` automatically runs `slcompose boot` on system startup, ensuring all services recover after server reboot.
|
||
|
||
**Secrets Flow:**
|
||
```
|
||
System Boot → systemd slcompose.service → slcompose boot
|
||
↓
|
||
For each service in /srv/docker/:
|
||
- Load INFISICAL_TOKEN from /etc/infisical/token
|
||
- Use Infisical CLI to inject secrets from path: /[SERVICE_NAME]
|
||
- Run: docker compose up -d
|
||
```
|
||
|
||
See [docs/orchestration.md](docs/orchestration.md) and [docs/slcompose.sh](docs/slcompose.sh) for complete details.
|
||
|
||
---
|
||
|
||
## Shared Infrastructure
|
||
|
||
The following components are shared across multiple services:
|
||
|
||
* Docker
|
||
* Docker Compose
|
||
* Internal Docker Network
|
||
* Proxy Docker Network
|
||
* Isolated Docker Networks
|
||
* Monitoring Docker Stack
|
||
* Automated Backup System
|
||
* Shared Secrets Management (Infisical + slcompose)
|
||
|
||
Secrets are managed centrally through Infisical and injected at runtime by the slcompose wrapper.
|
||
|
||
---
|
||
|
||
## Repository Structure
|
||
|
||
```text
|
||
baget/
|
||
dbgate/
|
||
docs/
|
||
docs/nextcloud.md
|
||
gitea/
|
||
jitsi/
|
||
mssql/
|
||
nginx-proxy-manager/
|
||
openproject/
|
||
portainer/
|
||
postgres/
|
||
scripts/
|
||
```
|
||
|
||
Each service folder contains:
|
||
|
||
* docker-compose.yml
|
||
* README.md
|
||
* .env.example
|
||
|
||
---
|
||
|
||
## Purpose
|
||
|
||
This repository serves as the single source of truth for rebuilding and maintaining the SilverLinux environment.
|
||
|
||
Infrastructure documentation, Docker Compose files, backup procedures, deployment notes and operational decisions are stored here.
|
||
|
||
The goal is that the entire environment can be rebuilt from this repository and the documented backup files.
|
||
|
||
---
|
||
|
||
## CI/CD
|
||
|
||
Gitea Actions is enabled globally and uses the self-hosted `silverlinux-runner` on SilverLinux. The operational Silver 2.0 package workflow builds and publishes NuGet packages to the internal BaGet feed.
|
||
|
||
See [docs/cicd.md](docs/cicd.md) for the runner, workflow triggers, pipeline stages and secret locations.
|
||
|
||
---
|
||
|
||
## Security
|
||
|
||
Never commit:
|
||
|
||
* Passwords
|
||
* API Keys
|
||
* SMTP Credentials
|
||
* OAuth Secrets
|
||
* SSL Private Keys
|
||
* Database Credentials
|
||
* Real `.env` files
|
||
* Infisical tokens
|
||
* Sentry upstream installer secrets
|
||
|
||
Use example files whenever possible.
|
||
|
||
---
|
||
|
||
## Disaster Recovery
|
||
|
||
This repository should contain enough information to rebuild the entire SilverLinux environment from scratch.
|
||
|
||
See:
|
||
|
||
* docs/server.md
|
||
* docs/network.md
|
||
* docs/roadmap.md
|
||
* docs/backups.md
|
||
* docs/security.md
|
||
* docs/secrets.md
|