# Self-Hosted Application Stack — SNS Networking

**Entity:** SNS Networking · **Status:** Buildable now

## What it is

A standard set of self-hosted services that replace SaaS for internal ops and
client deployments. Each runs in its own LXC container or VM on Proxmox.

## Service Catalog

| Service | Software | Runs in | FOSS | Replaces |
|---------|----------|---------|------|----------|
| DNS + Ad blocking | AdGuard Home | LXC | Yes | Cloudflare DNS / Pi-hole |
| Reverse proxy | Caddy | LXC | Yes | Nginx Proxy Manager (simpler TLS) |
| File sync | Nextcloud | VM | Yes | Google Drive / Dropbox |
| Passwords | Vaultwarden | LXC | Yes | Bitwarden cloud |
| Wiki / Notes | Outline or BookStack | LXC | Yes | Notion / Confluence |
| Identity (SSO) | Authelia | LXC | Yes | Okta / Auth0 |
| Container registry | Gitea (built-in) | VM | Yes | Docker Hub / ECR |

## Topology

All services sit on `vmbr1` (service VLAN). Caddy is the single ingress point
with automatic Let's Encrypt certs. Internal services use `*.internal.snsnetlabs.com`
via split DNS (AdGuard returns local IPs).

```
Internet → Linode (bastion/WireGuard) → Proxmox vmbr1
                                           │
                                     Caddy (reverse proxy)
                                           │
                    ┌──────────┬───────────┼───────────┬──────────┐
                Nextcloud  Vaultwarden  Outline    Authelia    Gitea
```

## Build Pattern (per service)

1. Clone Debian 12 cloud-init template.
2. Set hostname, static IP on service VLAN, SSH key.
3. Run Ansible role for the specific app (Docker Compose or native install).
4. Add Caddyfile entry for reverse proxy + TLS.
5. Add DNS record in AdGuard (local) or public DNS if external.
6. Add to PBS backup schedule.

## Security Posture

- **Authelia** gates all web UIs behind 2FA (TOTP). No service exposed without auth.
- **Caddy** handles TLS termination — no self-signed certs internally.
- **Vaultwarden** is the only password store; all service credentials live here.
- **Network:** services can't reach the management VLAN. Inter-service traffic is
  explicit (e.g., Nextcloud → Authelia for SSO, nothing else).

## Upgrade Path

- **LDAP/Keycloak:** If client count grows beyond what Authelia file-based users handles,
  swap to Keycloak + LDAP backend.
- **High availability:** Run critical services (Caddy, Vaultwarden, Authelia) as HA pairs
  behind a keepalived VIP.