skhub

What skhub is

skhub is the deployment role (optional/skhub) inside SKStacks, SKWorld's Ansible + Docker Swarm sovereign infrastructure framework. It stands up a self-hosted Nextcloud instance, pinned by SHA-256 digest end to end, so the fleet gets its own files, chat, video calls, and office documents without handing any of it to a collaboration SaaS vendor.

Every image is pinned by digest, never a bare tag, and every setting comes from a per-environment vault file, never hardcoded into the playbook.

§Why this is the right way to run it

skhub is not "Nextcloud with defaults." It is Nextcloud run the way a sovereign fleet actually needs it run, with the rough edges found and fixed under real load, not assumed away.

1. Sovereign by default, not by promise. File data, chat, video signaling, and documents all run on infrastructure the operator controls. There is no collaboration SaaS vendor in the data path, and the storage backend decision (NFS, external S3, or the fleet's own skstor) is made once, deliberately, up front, because Nextcloud only reads its S3 configuration on first install.
2. SSO that doesn't break the clients. Nextcloud is as much an API (WebDAV, CalDAV, OCS, notify_push, Talk signaling) as it is a web app, so skhub deliberately skips a reverse-proxy SSO middleware that would break every one of those clients. Sign-in goes through Nextcloud's own user_oidc app against the fleet's Authentik instance (sksso), with automatic group mapping, a documented deprovisioning path, and a break-glass local login for recovery. Automation keeps local app passwords, never an SSO identity.
3. Measured fixes, not guesses. The stock ClamAV config's database-reload memory spike was measured at +94% RSS; the tuned config removes that spike entirely while keeping the same signature database resident. NFS latency was measured causing real slowdowns (an admin integrity check took over five minutes over NFS in one case, and database-adjacent NFS latency measured as high as roughly 124ms round-trip in another), which is why skhub offers an option to pin the code tree and database/Redis data onto local disk on a specific node instead.
4. Deploys fail loudly, not silently. A "mount drift" check refuses a deploy that would silently drop a live, still-in-use external storage mount. A config mistake shows up before it touches the running stack, not after someone notices a storage connection is gone.
5. Real federation, not a marketing checkbox. Two separate skhub instances, each with its own Talk HPB, can federate chat, reactions, and calls over the OCM protocol between separate operator estates. File sharing federates separately through normal Nextcloud federated shares. This is tested end to end, not assumed to work.
6. Nothing ships on claims alone. New skhub capability is release-gated by a dedicated lab stage in the project's own test harness (skstack06), which exercises the feature end to end against a real, disposable Nextcloud + Talk + Collabora stack: a real TURN allocation through the TLS-over-443 path, a real SMTP delivery through a lab mail server, a real bind-mount drop-and-refuse. This lab has already caught real bugs, including a healthcheck timing issue that made Nextcloud's first install crash-loop on a busy host.

Chat and video that work off the LAN

With the optional Talk HPB enabled, Nextcloud Talk gets its own TURN/STUN relay (eturnal), so calls work from outside the local network, not just inside it. A TLS-over-443 fallback keeps calls working on networks that block the raw TURN port, and port sizing follows a simple rule of thumb: roughly 2 x N² relay ports for an N-person call outside the LAN.

§How it fits the workflow

skhub is the fleet's "files, chat, video, docs" layer. It is built to sit next to the fleet's own workflow engine (skflow, built on Windmill), the fleet's own SSO (sksso, Authentik), and the fleet's own local-inference gateway (skgateway), rather than standing alone.

Backups and release process

A nightly db-backup sidecar dumps the database on a fixed wall-clock schedule (for example 03:00 in a chosen timezone, DST-correct), rather than just "every N hours from whenever it started," so backups land at a predictable time every night.

skhub deploys through a standard Ansible playbook (deploy_skhub-<env>.yml) run per environment, dev, staging, prod, with every setting coming from a per-environment vault file. New capability is release-gated by the skstack06 lab harness before it is considered released, an evidenced practice with real bugs caught, not an aspirational claim.

Part of the ecosystem

skhub holds the files. skwrit is the matter engine that turns taught processes into verified, published paperwork, and publishes its finished documents straight into skhub. Both are part of SKWorld, the sovereign AI ecosystem where you own the whole stack, from silicon to soul.