sns-network-solutions/self-hosted-apps.md at b1a35783bb4fb08dc565ee67bf8ea29c8c18fcc0

Samuel James b1a35783bb Consolidate 7 divisions to 3: Networking, Digital, Support

- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1)
- Merge Web + Software + Cloud → SNS Digital (planned)
- SNS Support unchanged (planned)
- Add infra/ folder with 16 FOSS-first buildable designs
- Update all agent knowledge, division briefs, legal structure
- Restructure businesses/ from 7 to 3 operating folders

2026-07-18 13:08:23 -05:00

2.5 KiB

Raw Blame History

Entity: SNS Networking · Status: Buildable now

What it is

A standard set of self-hosted services that replace SaaS for internal ops and client deployments. Each runs in its own LXC container or VM on Proxmox.

Service Catalog

Service	Software	Runs in	FOSS	Replaces
DNS + Ad blocking	AdGuard Home	LXC	Yes	Cloudflare DNS / Pi-hole
Reverse proxy	Caddy	LXC	Yes	Nginx Proxy Manager (simpler TLS)
File sync	Nextcloud	VM	Yes	Google Drive / Dropbox
Passwords	Vaultwarden	LXC	Yes	Bitwarden cloud
Wiki / Notes	Outline or BookStack	LXC	Yes	Notion / Confluence
Identity (SSO)	Authelia	LXC	Yes	Okta / Auth0
Container registry	Gitea (built-in)	VM	Yes	Docker Hub / ECR

Topology

All services sit on vmbr1 (service VLAN). Caddy is the single ingress point with automatic Let's Encrypt certs. Internal services use *.internal.snsnetlabs.com via split DNS (AdGuard returns local IPs).

Internet → Linode (bastion/WireGuard) → Proxmox vmbr1
                                           │
                                     Caddy (reverse proxy)
                                           │
                    ┌──────────┬───────────┼───────────┬──────────┐
                Nextcloud  Vaultwarden  Outline    Authelia    Gitea

Build Pattern (per service)

Clone Debian 12 cloud-init template.
Set hostname, static IP on service VLAN, SSH key.
Run Ansible role for the specific app (Docker Compose or native install).
Add Caddyfile entry for reverse proxy + TLS.
Add DNS record in AdGuard (local) or public DNS if external.
Add to PBS backup schedule.

Security Posture

Authelia gates all web UIs behind 2FA (TOTP). No service exposed without auth.
Caddy handles TLS termination — no self-signed certs internally.
Vaultwarden is the only password store; all service credentials live here.
Network: services can't reach the management VLAN. Inter-service traffic is explicit (e.g., Nextcloud → Authelia for SSO, nothing else).

Upgrade Path

LDAP/Keycloak: If client count grows beyond what Authelia file-based users handles, swap to Keycloak + LDAP backend.
High availability: Run critical services (Caddy, Vaultwarden, Authelia) as HA pairs behind a keepalived VIP.

2.5 KiB Raw Blame History

Self-Hosted Application Stack — SNS Networking