b1a35783bb
- Merge Infrastructure + Secure + Systems → SNS Networking (Business #1) - Merge Web + Software + Cloud → SNS Digital (planned) - SNS Support unchanged (planned) - Add infra/ folder with 16 FOSS-first buildable designs - Update all agent knowledge, division briefs, legal structure - Restructure businesses/ from 7 to 3 operating folders
2.5 KiB
2.5 KiB
Self-Hosted Application Stack — SNS Networking
Entity: SNS Networking · Status: Buildable now
What it is
A standard set of self-hosted services that replace SaaS for internal ops and client deployments. Each runs in its own LXC container or VM on Proxmox.
Service Catalog
| Service | Software | Runs in | FOSS | Replaces |
|---|---|---|---|---|
| DNS + Ad blocking | AdGuard Home | LXC | Yes | Cloudflare DNS / Pi-hole |
| Reverse proxy | Caddy | LXC | Yes | Nginx Proxy Manager (simpler TLS) |
| File sync | Nextcloud | VM | Yes | Google Drive / Dropbox |
| Passwords | Vaultwarden | LXC | Yes | Bitwarden cloud |
| Wiki / Notes | Outline or BookStack | LXC | Yes | Notion / Confluence |
| Identity (SSO) | Authelia | LXC | Yes | Okta / Auth0 |
| Container registry | Gitea (built-in) | VM | Yes | Docker Hub / ECR |
Topology
All services sit on vmbr1 (service VLAN). Caddy is the single ingress point
with automatic Let's Encrypt certs. Internal services use *.internal.snsnetlabs.com
via split DNS (AdGuard returns local IPs).
Internet → Linode (bastion/WireGuard) → Proxmox vmbr1
│
Caddy (reverse proxy)
│
┌──────────┬───────────┼───────────┬──────────┐
Nextcloud Vaultwarden Outline Authelia Gitea
Build Pattern (per service)
- Clone Debian 12 cloud-init template.
- Set hostname, static IP on service VLAN, SSH key.
- Run Ansible role for the specific app (Docker Compose or native install).
- Add Caddyfile entry for reverse proxy + TLS.
- Add DNS record in AdGuard (local) or public DNS if external.
- Add to PBS backup schedule.
Security Posture
- Authelia gates all web UIs behind 2FA (TOTP). No service exposed without auth.
- Caddy handles TLS termination — no self-signed certs internally.
- Vaultwarden is the only password store; all service credentials live here.
- Network: services can't reach the management VLAN. Inter-service traffic is explicit (e.g., Nextcloud → Authelia for SSO, nothing else).
Upgrade Path
- LDAP/Keycloak: If client count grows beyond what Authelia file-based users handles, swap to Keycloak + LDAP backend.
- High availability: Run critical services (Caddy, Vaultwarden, Authelia) as HA pairs behind a keepalived VIP.