git
8bed8fdcb2
new file: DEPLOYMENT.md new file: SECURITY_SECRETS_INVENTORY.md new file: secrets/.env.secrets.example
1.4 KiB
1.4 KiB
Deployment prerequisites (required)
Before running docker compose up, you must provision runtime secrets.
1) Create non-committed secret files
cp secrets/.env.secrets.example secrets/stack-secrets.env
chmod 600 secrets/stack-secrets.env
Create these Docker secret files (all ignored by git):
secrets/nextcloud_db_root_password.txtsecrets/nextcloud_db_password.txtsecrets/nextcloud_admin_password.txtsecrets/nextcloud_smtp_password.txtsecrets/nextcloud_redis_password.txtsecrets/passbolt_db_password.txtsecrets/gramps_db_password.txtsecrets/influxdb_init_password.txtsecrets/prometheus_kuma_basic_auth_password.txt
Recommended permissions:
chmod 600 secrets/*.txt
2) Rotate previously committed credentials
These values were previously hardcoded and must be rotated in upstream systems immediately:
- Database credentials (Nextcloud, Passbolt, Gramps, InfluxDB).
- Nextcloud SMTP app password.
- Authelia reset JWT secret, session secret, storage encryption key.
- Traefik CrowdSec LAPI key.
- Gotify admin password.
- Prometheus Uptime Kuma basic-auth password.
3) Start stack
After secrets are provisioned:
docker compose -f core/docker-compose.yml up -d
docker compose -f monitoring/prometheus/docker-compose.yml up -d
docker compose -f apps/nextcloud/docker-compose.yml up -d