b1a35783bb
- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1) - Merge Web + Software + Cloud → SNS Digital (planned) - SNS Support unchanged (planned) - Add infra/ folder with 16 FOSS-first buildable designs - Update all agent knowledge, division briefs, legal structure - Restructure businesses/ from 7 to 3 operating folders
60 lines
2.5 KiB
Markdown
60 lines
2.5 KiB
Markdown
# Self-Hosted Application Stack — SNS Networking
|
|
|
|
**Entity:** SNS Networking · **Status:** Buildable now
|
|
|
|
## What it is
|
|
|
|
A standard set of self-hosted services that replace SaaS for internal ops and
|
|
client deployments. Each runs in its own LXC container or VM on Proxmox.
|
|
|
|
## Service Catalog
|
|
|
|
| Service | Software | Runs in | FOSS | Replaces |
|
|
|---------|----------|---------|------|----------|
|
|
| DNS + Ad blocking | AdGuard Home | LXC | Yes | Cloudflare DNS / Pi-hole |
|
|
| Reverse proxy | Caddy | LXC | Yes | Nginx Proxy Manager (simpler TLS) |
|
|
| File sync | Nextcloud | VM | Yes | Google Drive / Dropbox |
|
|
| Passwords | Vaultwarden | LXC | Yes | Bitwarden cloud |
|
|
| Wiki / Notes | Outline or BookStack | LXC | Yes | Notion / Confluence |
|
|
| Identity (SSO) | Authelia | LXC | Yes | Okta / Auth0 |
|
|
| Container registry | Gitea (built-in) | VM | Yes | Docker Hub / ECR |
|
|
|
|
## Topology
|
|
|
|
All services sit on `vmbr1` (service VLAN). Caddy is the single ingress point
|
|
with automatic Let's Encrypt certs. Internal services use `*.internal.snsnetlabs.com`
|
|
via split DNS (AdGuard returns local IPs).
|
|
|
|
```
|
|
Internet → Linode (bastion/WireGuard) → Proxmox vmbr1
|
|
│
|
|
Caddy (reverse proxy)
|
|
│
|
|
┌──────────┬───────────┼───────────┬──────────┐
|
|
Nextcloud Vaultwarden Outline Authelia Gitea
|
|
```
|
|
|
|
## Build Pattern (per service)
|
|
|
|
1. Clone Debian 12 cloud-init template.
|
|
2. Set hostname, static IP on service VLAN, SSH key.
|
|
3. Run Ansible role for the specific app (Docker Compose or native install).
|
|
4. Add Caddyfile entry for reverse proxy + TLS.
|
|
5. Add DNS record in AdGuard (local) or public DNS if external.
|
|
6. Add to PBS backup schedule.
|
|
|
|
## Security Posture
|
|
|
|
- **Authelia** gates all web UIs behind 2FA (TOTP). No service exposed without auth.
|
|
- **Caddy** handles TLS termination — no self-signed certs internally.
|
|
- **Vaultwarden** is the only password store; all service credentials live here.
|
|
- **Network:** services can't reach the management VLAN. Inter-service traffic is
|
|
explicit (e.g., Nextcloud → Authelia for SSO, nothing else).
|
|
|
|
## Upgrade Path
|
|
|
|
- **LDAP/Keycloak:** If client count grows beyond what Authelia file-based users handles,
|
|
swap to Keycloak + LDAP backend.
|
|
- **High availability:** Run critical services (Caddy, Vaultwarden, Authelia) as HA pairs
|
|
behind a keepalived VIP.
|