SilverSolutions/silverlinux-infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ea638c0eae670dfe343803e1621e7fdc35a7162d
silverlinux-infra/docs/services.md
T

856 lines
11 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Services
## Overview
This document lists all services running on SilverLinux and their purpose.
Generated state reference:
```text
2026-06-25 infrastructure review
```
---
## Running Services
### PostgreSQL
Purpose:
* Primary shared database platform
* Application data storage
Used by:
* Gitea
* OpenProject
Status:
```text
Running
```
---
### Microsoft SQL Server Express
Purpose:
* Secondary database platform for SQL Server compatibility
* Support future applications requiring Microsoft SQL Server
* Extend the platform beyond PostgreSQL-only workloads
Image:
```text
mcr.microsoft.com/mssql/server:2022-latest
```
Network:
```text
internal
```
Exposure:
* Port 1433 is not published
* Not routed through Nginx Proxy Manager
* Private database access only
Status:
```text
Operational
```
---
### Gitea
URL:
```text
https://git.silveressence.net
```
Purpose:
* Source control
* Git repositories
* Pull requests
* Issue tracking
Status:
```text
Running
```
---
### OpenProject
URL:
```text
https://team.silveressence.net
```
Purpose:
* Project management
* Work packages
* Time tracking
* Team collaboration
Status:
```text
Running
```
---
### Jitsi Meet
URL:
```text
https://meet.silveressence.net
```
Purpose:
* Video conferencing
* Team meetings
* Customer meetings
Status:
```text
Running
```
---
### Portainer
URL:
```text
https://portainer.silveressence.net
```
Purpose:
* Docker administration
* Stack deployment
* Container monitoring
Status:
```text
Running
```
---
### Nginx Proxy Manager
Purpose:
* Reverse proxy
* SSL termination
* Domain routing
* Certificate management
Status:
```text
Running
```
---
### Prometheus
Purpose:
* Metrics collection
* Alert rule engine
* Monitoring data storage
* Scrape targets for system, Docker and backup metrics
Scrapes:
* Prometheus
* Node Exporter
* cAdvisor
* SilverLinux backup metrics
Alert categories:
* Backup
* System pressure
* Monitoring health
* Database availability
* Container health
Status:
```text
Running
```
---
### Grafana
Purpose:
* Monitoring dashboards
* Metrics visualization
* Prometheus datasource frontend
Dashboards:
* Custom backup dashboard
* Custom system dashboard
* Docker monitoring dashboard
Note:
The imported Prometheus 2.0 Overview dashboard is not compatible with the installed Prometheus version `3.5.4`. This is a third-party dashboard compatibility issue, not an infrastructure problem.
Status:
```text
Running
```
---
### Alertmanager
Purpose:
* Alert routing
* Email notifications
* Incident grouping
* Alert deduplication
* Severity-based routing
Recipients:
* `oclick021@gmail.com`
* `martin@silversolutions.nl`
Incident groups:
* `backup_failure`
* `system_pressure`
* `storage_pressure`
* `database_outage`
* `monitoring_failure`
* `container_health`
Status:
```text
Running
```
---
### Node Exporter
Purpose:
* Host metrics collection
* CPU, memory and disk metrics
* Textfile Collector endpoint for SilverLinux backup metrics
Status:
```text
Running
```
---
### cAdvisor
Purpose:
* Docker container metrics
* Container CPU, memory and runtime visibility
Status:
```text
Running
```
---
### BaGet
URL:
```text
https://nuget.silveressence.net
```
Purpose:
* Private NuGet repository
* Internal Silver.* package distribution
* Package source for CI/CD
* Package source for team development
Access:
* Routed through Nginx Proxy Manager
Status:
```text
Running
```
---
### Gitea Actions Runner
Location:
```text
/srv/docker/gitea-runner
```
Image:
```text
gitea/act_runner:latest
```
Runner Name:
```text
silverlinux-runner
```
Type:
```text
Global Runner
```
Labels:
* `ubuntu-latest`
* `ubuntu-24.04`
* `ubuntu-22.04`
Status:
```text
Operational
```
---
### Exact Syncer Demo
Purpose:
* Demo `.NET 9` Blazor application for Exact Online integration
* Provides a user interface for connecting Exact webhooks
* Syncs changes from a main division to dependent sub-divisions
Behavior:
* When the main division relation changes, the app updates related sub-divisions with Exact data
* Example: a change in main division Relation 1 propagates to divisions 2–10
Runtime:
* Hostname: `exactsyncer.silveressence.net`
* Container: `exact-syncer`
* Port: `8080`
Deployment notes:
* Demo version for clients to evaluate Exact Online sync behavior
* Can be recreated as a dedicated instance for new customers
Status:
```text
Operational demo
```
---
### BobAutoWas Exact Syncer Instance
Purpose:
* Client-specific Exact Syncer instance for BobAutoWas
* Recreated from the Exact Syncer demo for customer delivery
* Provides the same webhook-driven and division-sync workflow
Behavior:
* Uses the same Exact Online master/sub-division sync model as the demo
* Intended for client preview and delivery use
Runtime:
* Hostname: `cicd.silveressence.net`
* Container: `bobsAutowas`
* Port: `8080`
Deployment notes:
* Dedicated customer-facing instance of Exact Syncer
* Managed as an active demo/product instance
Status:
```text
Active client instance
```
---
### DbGate
URL:
```text
https://dbgate.silveressence.net
```
Purpose:
* Browser-based PostgreSQL administration
* Browser-based MSSQL administration
* Database explorer and debugging interface
Networks:
* `internal` for private database connectivity
* `proxy` for Nginx Proxy Manager
Security:
* Publicly reachable through the proxy layer
* HTTPS enforced
* DbGate username and password required
* Authentication must remain hardened and periodically verified
* Database ports remain private
Status:
```text
Operational
```
---
### Nextcloud
URL:
```text
https://cloud.silveressence.net
```
Purpose:
* Private cloud storage
* File sharing
* Team document storage
* Nextcloud notification email
Runtime:
* `nextcloud` using `nextcloud:29-apache`
* `nextcloud-db` using `postgres:16`
* `nextcloud-redis` using `redis:7-alpine`
Networks:
* `proxy` for Nginx Proxy Manager access to the web container
* `nextcloud_nextcloud_internal` for private Nextcloud, PostgreSQL and Redis traffic
Storage:
* `nextcloud_nextcloud_data`
* `nextcloud_nextcloud_db`
Exposure:
* Routed through Nginx Proxy Manager
* No Nextcloud stack ports were published to the host in the 2026-07-08 runtime snapshot
* Database and Redis containers are internal-only
Status:
```text
Operational
```
See [docs/nextcloud.md](nextcloud.md) for complete deployment documentation.
---
### Sentry
URL:
```text
https://sentry.silveressence.net
```
Purpose:
* Centralized error tracking and observability
* Application exception diagnostics
* Release health visibility
* Performance monitoring
Architecture:
* Distributed system with 70+ services
* Components: Relay, Kafka, Snuba, ClickHouse, PostgreSQL, Redis, SeaweedFS
* Self-hosted deployment
Entry container:
* `sentry-self-hosted-nginx-1` using `nginx:1.31.0-alpine`
* Publishes `0.0.0.0:9000 -> 80/tcp`
* Nginx Proxy Manager forwards to `sentry-self-hosted-nginx-1:80`
Networks:
* `proxy` for Nginx Proxy Manager access
* `sentry-self-hosted_default` for internal service communication
Management:
* Installed with upstream Sentry self-hosted `install.sh`
* Install directory: `/srv/docker/sentry`
* Managed according to the upstream Sentry self-hosted workflow
* Exception to the standard SilverLinux `slcompose` and Infisical pattern
* Single atomic upstream deployment unit
Data Storage:
* PostgreSQL for metadata
* ClickHouse for high-performance event storage
* Redis for caching and coordination
* SeaweedFS for attachments and objects
Backup Requirements:
* `/srv/docker/sentry`
* PostgreSQL database volume
* ClickHouse data volume
* Sentry configuration files
* SeaweedFS data
* Persistent Kafka data (if enabled)
Status:
```text
Running
```
See [docs/sentry.md](sentry.md) for complete deployment documentation.
---
### Xray (Direct Production)
Purpose:
* Primary production VLESS endpoint
* Direct OVH internet routing for stable public access
* Separate from VPN-routed traffic to protect production stability
Classification:
```text
Primary production connectivity layer
```
Networks:
* `proxy`
Runtime ports:
```text
0.0.0.0:32443 -> 8080/tcp
```
Image:
```text
ghcr.io/xtls/xray-core:latest
```
Runtime note:
* Direct production Xray is unmodified and isolated from the VPN routing setup.
* The `xray_default` network exists, but the running `xray` container was attached only to `proxy` in the 2026-06-24 runtime snapshot.
Security:
* Public tunneling endpoint exposure must be monitored
* Access policy and abuse monitoring must be reviewed regularly
* Not classified as an application backend service
Status:
```text
Operational
```
---
### VPN Gateway (Gluetun PIA)
Purpose:
* Containerized VPN gateway for Private Internet Access (PIA)
* Routes selected containers through WireGuard without affecting host networking
* Provides an isolated VPN execution layer for safe experimentation
Container:
```text
gluetun-pia
```
VPN Provider:
* Private Internet Access (PIA)
Mode:
* Custom WireGuard configuration generated by PIA
Notes:
* No VPN software runs on the host
* Prevents SSH lockout and host routing table override issues
* Only selected services use this VPN gateway
Status:
```text
Operational VPN gateway
```
---
### VPN-Routed Xray (xray-pia)
Purpose:
* Secondary VLESS endpoint routed through the PIA VPN gateway
* Maintains a separate service path from the direct production Xray endpoint
Container:
```text
xray-pia
```
Runtime ports:
```text
0.0.0.0:32444 -> 32444/tcp
```
Network mode:
* `container:gluetun-pia`
Routing:
* Client -> `xray-pia` (32444) -> `gluetun-pia` -> PIA WireGuard VPN -> Internet
Notes:
* Fully isolated from host networking
* Does not impact the direct production Xray endpoint
* Supports future multiple VPN exit points
Status:
```text
Operational secondary VPN endpoint
```
---
## Shared Infrastructure
### Docker
Purpose:
* Container hosting
* Service isolation
Status:
```text
Running
```
---
### Internal Docker Network
Purpose:
* Private communication between services
Status:
```text
Running
```
---
### Proxy Docker Network
Purpose:
* HTTP and HTTPS service exposure through Nginx Proxy Manager
* Shared public routing layer for web-facing services
Status:
```text
Running
```
---
### Isolated Docker Networks
Purpose:
* Keep specialized infrastructure stacks isolated from application backends
* Separate Jitsi, Xray and CI/CD runner traffic from shared database traffic
Networks:
* `jitsi-docker-jitsi-meet-aa76415_meet.jitsi`
* `xray_default`
* `gitea-runner_default`
Status:
```text
Running
```
---
### Shared Secrets
Source:
```text
Infisical
```
Purpose:
* SMTP credentials
* Database passwords
* Application secrets
Status:
```text
Active
```
Legacy note:
* `/srv/secrets/company.env` is no longer part of the active secret model and should be removed if it still exists.
---
## Removed Services
## Planned Services
See:
```text
docs/roadmap.md
```
Phase 1:
* Loki
* Redis
* Authelia
Phase 2:
* CrowdSec
* Restic
* Fail2Ban upgrade
* Cloudflare rate limiting and WAF
Phase 3:
* SonarQube
* Harbor
* Backstage
---
### Plane.so
Reason:
OpenProject was selected as the primary project management platform. Plane.so is not used and will not be used.
Status:
```text
Removed
```
Cleanup:
* Containers removed
* Nginx Proxy Manager route removed
* Unused SSL certificate removed from the server
---
## Related Documentation
* docs/server.md
* docs/network.md
* docs/roadmap.md
* docs/monitoring.md
* docs/domains.md
* docs/security.md
* docs/backups.md
Reference in New Issue View Git Blame Copy Permalink