SilverSolutions/silverlinux-infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
3f94ced9ea111c7b4831a3d02f118f6167ed4303
silverlinux-infra/docs/services.md
T

11 KiB
Raw Blame History

Services

Overview

This document lists all services running on SilverLinux and their purpose.

Generated state reference:

2026-06-25 infrastructure review

Running Services

PostgreSQL

Purpose:

  • Primary shared database platform
  • Application data storage

Used by:

  • Gitea
  • OpenProject

Status:

Running

Microsoft SQL Server Express

Purpose:

  • Secondary database platform for SQL Server compatibility
  • Support future applications requiring Microsoft SQL Server
  • Extend the platform beyond PostgreSQL-only workloads

Image:

mcr.microsoft.com/mssql/server:2022-latest

Network:

internal

Exposure:

  • Port 1433 is not published
  • Not routed through Nginx Proxy Manager
  • Private database access only

Status:

Operational

Gitea

URL:

https://git.silveressence.net

Purpose:

  • Source control
  • Git repositories
  • Pull requests
  • Issue tracking

Status:

Running

OpenProject

URL:

https://team.silveressence.net

Purpose:

  • Project management
  • Work packages
  • Time tracking
  • Team collaboration

Status:

Running

Jitsi Meet

URL:

https://meet.silveressence.net

Purpose:

  • Video conferencing
  • Team meetings
  • Customer meetings

Status:

Running

Portainer

URL:

https://portainer.silveressence.net

Purpose:

  • Docker administration
  • Stack deployment
  • Container monitoring

Status:

Running

Nginx Proxy Manager

Purpose:

  • Reverse proxy
  • SSL termination
  • Domain routing
  • Certificate management

Status:

Running

Prometheus

Purpose:

  • Metrics collection
  • Alert rule engine
  • Monitoring data storage
  • Scrape targets for system, Docker and backup metrics

Scrapes:

  • Prometheus
  • Node Exporter
  • cAdvisor
  • SilverLinux backup metrics

Alert categories:

  • Backup
  • System pressure
  • Monitoring health
  • Database availability
  • Container health

Status:

Running

Grafana

Purpose:

  • Monitoring dashboards
  • Metrics visualization
  • Prometheus datasource frontend

Dashboards:

  • Custom backup dashboard
  • Custom system dashboard
  • Docker monitoring dashboard

Note:

The imported Prometheus 2.0 Overview dashboard is not compatible with the installed Prometheus version 3.5.4. This is a third-party dashboard compatibility issue, not an infrastructure problem.

Status:

Running

Alertmanager

Purpose:

  • Alert routing
  • Email notifications
  • Incident grouping
  • Alert deduplication
  • Severity-based routing

Recipients:

  • oclick021@gmail.com
  • martin@silversolutions.nl

Incident groups:

  • backup_failure
  • system_pressure
  • storage_pressure
  • database_outage
  • monitoring_failure
  • container_health

Status:

Running

Node Exporter

Purpose:

  • Host metrics collection
  • CPU, memory and disk metrics
  • Textfile Collector endpoint for SilverLinux backup metrics

Status:

Running

cAdvisor

Purpose:

  • Docker container metrics
  • Container CPU, memory and runtime visibility

Status:

Running

BaGet

URL:

https://nuget.silveressence.net

Purpose:

  • Private NuGet repository
  • Internal Silver.* package distribution
  • Package source for CI/CD
  • Package source for team development

Access:

  • Routed through Nginx Proxy Manager

Status:

Running

Gitea Actions Runner

Location:

/srv/docker/gitea-runner

Image:

gitea/act_runner:latest

Runner Name:

silverlinux-runner

Type:

Global Runner

Labels:

  • ubuntu-latest
  • ubuntu-24.04
  • ubuntu-22.04

Status:

Operational

Exact Syncer Demo

Purpose:

  • Demo .NET 9 Blazor application for Exact Online integration
  • Provides a user interface for connecting Exact webhooks
  • Syncs changes from a main division to dependent sub-divisions

Behavior:

  • When the main division relation changes, the app updates related sub-divisions with Exact data
  • Example: a change in main division Relation 1 propagates to divisions 2–10

Runtime:

  • Hostname: exactsyncer.silveressence.net
  • Container: exact-syncer
  • Port: 8080

Deployment notes:

  • Demo version for clients to evaluate Exact Online sync behavior
  • Can be recreated as a dedicated instance for new customers

Status:

Operational demo

BobAutoWas Exact Syncer Instance

Purpose:

  • Client-specific Exact Syncer instance for BobAutoWas
  • Recreated from the Exact Syncer demo for customer delivery
  • Provides the same webhook-driven and division-sync workflow

Behavior:

  • Uses the same Exact Online master/sub-division sync model as the demo
  • Intended for client preview and delivery use

Runtime:

  • Hostname: cicd.silveressence.net
  • Container: bobsAutowas
  • Port: 8080

Deployment notes:

  • Dedicated customer-facing instance of Exact Syncer
  • Managed as an active demo/product instance

Status:

Active client instance

DbGate

URL:

https://dbgate.silveressence.net

Purpose:

  • Browser-based PostgreSQL administration
  • Browser-based MSSQL administration
  • Database explorer and debugging interface

Networks:

  • internal for private database connectivity
  • proxy for Nginx Proxy Manager

Security:

  • Publicly reachable through the proxy layer
  • HTTPS enforced
  • DbGate username and password required
  • Authentication must remain hardened and periodically verified
  • Database ports remain private

Status:

Operational

Nextcloud

URL:

https://cloud.silveressence.net

Purpose:

  • Private cloud storage
  • File sharing
  • Team document storage
  • Nextcloud notification email

Runtime:

  • nextcloud using nextcloud:29-apache
  • nextcloud-db using postgres:16
  • nextcloud-redis using redis:7-alpine

Networks:

  • proxy for Nginx Proxy Manager access to the web container
  • nextcloud_nextcloud_internal for private Nextcloud, PostgreSQL and Redis traffic

Storage:

  • nextcloud_nextcloud_data
  • nextcloud_nextcloud_db

Exposure:

  • Routed through Nginx Proxy Manager
  • No Nextcloud stack ports were published to the host in the 2026-07-08 runtime snapshot
  • Database and Redis containers are internal-only

Status:

Operational

See docs/nextcloud.md for complete deployment documentation.

Sentry

URL:

https://sentry.silveressence.net

Purpose:

  • Centralized error tracking and observability
  • Application exception diagnostics
  • Release health visibility
  • Performance monitoring

Architecture:

  • Distributed system with 70+ services
  • Components: Relay, Kafka, Snuba, ClickHouse, PostgreSQL, Redis, SeaweedFS
  • Self-hosted deployment

Networks:

  • proxy for Nginx Proxy Manager access
  • sentry-self-hosted_default for internal service communication

Management:

  • Managed via slcompose orchestrator
  • Automated Infisical secret injection
  • Single atomic deployment unit

Data Storage:

  • PostgreSQL for metadata
  • ClickHouse for high-performance event storage
  • Redis for caching and coordination
  • SeaweedFS for attachments and objects

Backup Requirements:

  • PostgreSQL database volume
  • ClickHouse data volume
  • Sentry configuration files
  • Persistent Kafka data (if enabled)

Status:

Running

See docs/sentry.md for complete deployment documentation.

Xray (Direct Production)

Purpose:

  • Primary production VLESS endpoint
  • Direct OVH internet routing for stable public access
  • Separate from VPN-routed traffic to protect production stability

Classification:

Primary production connectivity layer

Networks:

  • proxy

Runtime ports:

0.0.0.0:32443 -> 8080/tcp

Image:

ghcr.io/xtls/xray-core:latest

Runtime note:

  • Direct production Xray is unmodified and isolated from the VPN routing setup.
  • The xray_default network exists, but the running xray container was attached only to proxy in the 2026-06-24 runtime snapshot.

Security:

  • Public tunneling endpoint exposure must be monitored
  • Access policy and abuse monitoring must be reviewed regularly
  • Not classified as an application backend service

Status:

Operational

VPN Gateway (Gluetun PIA)

Purpose:

  • Containerized VPN gateway for Private Internet Access (PIA)
  • Routes selected containers through WireGuard without affecting host networking
  • Provides an isolated VPN execution layer for safe experimentation

Container:

gluetun-pia

VPN Provider:

  • Private Internet Access (PIA)

Mode:

  • Custom WireGuard configuration generated by PIA

Notes:

  • No VPN software runs on the host
  • Prevents SSH lockout and host routing table override issues
  • Only selected services use this VPN gateway

Status:

Operational VPN gateway

VPN-Routed Xray (xray-pia)

Purpose:

  • Secondary VLESS endpoint routed through the PIA VPN gateway
  • Maintains a separate service path from the direct production Xray endpoint

Container:

xray-pia

Runtime ports:

0.0.0.0:32444 -> 32444/tcp

Network mode:

  • container:gluetun-pia

Routing:

  • Client -> xray-pia (32444) -> gluetun-pia -> PIA WireGuard VPN -> Internet

Notes:

  • Fully isolated from host networking
  • Does not impact the direct production Xray endpoint
  • Supports future multiple VPN exit points

Status:

Operational secondary VPN endpoint

Shared Infrastructure

Docker

Purpose:

  • Container hosting
  • Service isolation

Status:

Running

Internal Docker Network

Purpose:

  • Private communication between services

Status:

Running

Proxy Docker Network

Purpose:

  • HTTP and HTTPS service exposure through Nginx Proxy Manager
  • Shared public routing layer for web-facing services

Status:

Running

Isolated Docker Networks

Purpose:

  • Keep specialized infrastructure stacks isolated from application backends
  • Separate Jitsi, Xray and CI/CD runner traffic from shared database traffic

Networks:

  • jitsi-docker-jitsi-meet-aa76415_meet.jitsi
  • xray_default
  • gitea-runner_default

Status:

Running

Shared Secrets

Source:

Infisical

Purpose:

  • SMTP credentials
  • Database passwords
  • Application secrets

Status:

Active

Legacy note:

  • /srv/secrets/company.env is no longer part of the active secret model and should be removed if it still exists.

Removed Services

Planned Services

See:

docs/roadmap.md

Phase 1:

  • Loki
  • Redis
  • Authelia

Phase 2:

  • CrowdSec
  • Restic
  • Fail2Ban upgrade
  • Cloudflare rate limiting and WAF

Phase 3:

  • SonarQube
  • Harbor
  • Backstage

Plane.so

Reason:

OpenProject was selected as the primary project management platform. Plane.so is not used and will not be used.

Status:

Removed

Cleanup:

  • Containers removed
  • Nginx Proxy Manager route removed
  • Unused SSL certificate removed from the server

Related Documentation

  • docs/server.md
  • docs/network.md
  • docs/roadmap.md
  • docs/monitoring.md
  • docs/domains.md
  • docs/security.md
  • docs/backups.md
Reference in New Issue View Git Blame Copy Permalink