# Future Plans

## Priority Overview

| Priority | Item | Blocked on |
|---|---|---|
| High | Backup system (Restic) | Choosing backup destination |
| High | Security review | — |
| Medium | Migration to permanent VPS | Company incorporation |
| Medium | SMTP / Email | ProtonMail setup after incorporation |
| Medium | CI/CD pipeline | — |
| Low | Monitoring | — |
| Low | Group-based access control | Not needed yet (4 people) |
| Low | Move SSH to non-standard port | — |
| Low | Outline branding (remove badge) | Cosmetic, parked |

## High Priority

### Backup System (Restic)
- Daily automated backup of all Docker volumes to object storage
- Systemd timer (not cron)
- Retention policy: 7 daily, 4 weekly, 6 monthly
- Test restore procedure documented
- **Blocked on**: choosing a backup destination (S3 / Backblaze B2 / SFTP)

### Security Review
- Firewall audit — verify only intended ports are exposed
- Container hardening — run containers as non-root where possible
- Secret management — move passwords/secrets out of `group_vars/all.yml` into Ansible Vault or environment files
- Review Dex/LLDAP security configuration
- Fail2ban rules review
- Check for unnecessary services or open ports
- HTTPS headers audit (HSTS, CSP, etc.)

## Medium Priority

### Migration to Permanent VPS

Once company incorporation is complete and bank account is set up.

```mermaid
sequenceDiagram
    participant Old as Old VPS
    participant Backup as Backup Storage
    participant New as New VPS
    participant DNS

    Old->>Backup: Final backup snapshot
    Note over New: Provision Debian 13
    New->>New: Run bootstrap.yml
    New->>New: Run deploy.yml
    Backup->>New: Restore volumes
    DNS->>New: Update A record to new IP
    Note over New: Verify SSL certs renew
    Note over Old: Decommission
```

### CI/CD Pipeline
- Automated deployment on git push
- Documentation pipeline (Markdown to Outline, or similar)
- Options to evaluate: Gitea Actions, Drone CI, or simple webhook-based deploy

### SMTP / Email
- Set up ProtonMail for cloud-elves.eu (after incorporation)
- Configure Outline and Gitea to send transactional emails
- Update Let's Encrypt contact email from personal to company address

## Low Priority

### Monitoring
- Resource monitoring (CPU, memory, disk)
- Uptime monitoring for all services
- Options: simple solution like Uptime Kuma, or external service

### Group-Based Access Control
- Configure Dex to pass LLDAP groups to applications
- Restrict certain services to specific groups (e.g., admin-only tools)
- Not needed now (4 people, everyone needs access everywhere)

### Move SSH to Non-Standard Port
- Move host sshd from 22 to a high port (e.g., 2200)
- Reduces log noise from automated scanners
- Free up port 22 for Gitea SSH (nicer clone URLs)

### Outline Branding
- Remove "Built with Outline" badge on public share pages
- Parked for now — cosmetic only