silverlinux-infra/docs/AI_CONTEXT.md

SilverLinux AI Context

Purpose

SilverLinux is the primary self-hosted infrastructure server for Silver Solutions.

The goal is to host all development, collaboration, deployment and internal tooling.

Server

Hostname: silverlinux

OS: Ubuntu Server 24.04 LTS

Provider: OVH

Public IP: 51.255.83.140

Core Services

• PostgreSQL
• Microsoft SQL Server 2022 Express
• Gitea
• OpenProject
• Jitsi Meet
• Portainer
• Nginx Proxy Manager
• BaGet
• Gitea Actions Runner (silverlinux-runner)
• DbGate
• Xray
• Prometheus
• Grafana
• Node Exporter
• cAdvisor

Domains

git.silveressence.net -> Gitea

team.silveressence.net -> OpenProject

meet.silveressence.net -> Jitsi

portainer.silveressence.net -> Portainer

nuget.silveressence.net -> BaGet (through Nginx Proxy Manager)

dbgate.silveressence.net -> DbGate (through Nginx Proxy Manager)

Xray -> Public tunneling endpoint through proxy network

Secrets

Secrets are stored in:

/srv/secrets/company.env

Never hardcode credentials.

Always use env_file.

Docker Networks

proxy internal jitsi-docker-jitsi-meet-aa76415_meet.jitsi xray_default gitea-runner_default

MSSQL is attached only to internal. DbGate is attached to both internal and proxy.

Jitsi uses jitsi-docker-jitsi-meet-aa76415_meet.jitsi for its internal cluster and proxy for web access. Xray is currently attached to proxy; xray_default exists but had no running containers attached in the 2026-06-24 runtime snapshot.

Authentication

Gitea:

• Local accounts
• OpenID disabled
• Google OAuth planned
• GitHub OAuth planned

OpenProject:

• Local accounts

CI/CD

Gitea Actions is enabled globally.

The global self-hosted runner is operational at /srv/docker/gitea-runner with the name silverlinux-runner.

Silver 2.0 uses .gitea/workflows/package.yml to publish NuGet packages to BaGet when a push to net-8-version has a commit message containing [Package].

The runner registration token is stored in /srv/secrets/company.env. The BaGet publishing key is stored as the repository Actions secret BAGET_API_KEY.

Databases

PostgreSQL 17 and Microsoft SQL Server 2022 Express are operational.

MSSQL uses hostname mssql on the internal Docker network. Port 1433 is not published.

DbGate provides authenticated HTTPS administration for MSSQL and PostgreSQL at https://dbgate.silveressence.net.

Xray is a connectivity layer, not an application backend. It runs from ghcr.io/xtls/xray-core:latest and publishes 0.0.0.0:32443 -> 8080/tcp. Its endpoint exposure and access policy should be reviewed during security checks.

Monitoring

The monitoring stack is operational.

Components:

• Prometheus
• Grafana
• Node Exporter
• cAdvisor

Validated:

• Prometheus UI
• Prometheus targets
• Node Exporter
• cAdvisor
• Backup metrics
• Grafana datasource

Grafana has custom backup, system and Docker monitoring dashboards.

Backup

Backup v2 is operational.

Implemented:

• Daily cron backup
• HTML reports
• Email reports through Postfix and Gmail SMTP
• Automatic archive generation
• Automatic cleanup
• Prometheus metrics export
• Restore validation

Verified:

• PostgreSQL
• MSSQL
• Gitea
• BaGet
• OpenProject assets
• Docker configuration

Documentation

Read all files in:

docs/

and the README.md of each service folder before making infrastructure recommendations.

Roadmap:

• Phase 1 completed: Grafana, Prometheus, Node Exporter, cAdvisor, backup metrics integration
• Phase 1 remaining: Loki, Redis, Authelia
• Phase 2 completed: Backup v2 automation, restore validation
• Phase 2 remaining: CrowdSec, Sentry, Fail2Ban upgrade, Cloudflare rate limiting and WAF
• Phase 3: SonarQube, Harbor, Backstage, Nextcloud

See:

docs/roadmap.md

Important Decisions

• Plane.so removed
• OpenProject selected
• Centralized secrets implemented
• Nginx Proxy Manager selected
• PostgreSQL selected as shared database platform
• BaGet deployed at nuget.silveressence.net through Nginx Proxy Manager
• Gitea Actions and a global self-hosted runner selected for package publishing
• MSSQL Express deployed alongside PostgreSQL
• DbGate selected as the database administration portal
• Xray introduced as a tunneling and connectivity layer
• Multi-network segmentation formalized: internal, proxy and isolated infrastructure networks