# Future Plans

## Priority Overview

| Priority | Item | Status |
|---|---|---|
| High | Backup & restore | Done — `scripts/backup.sh` and `scripts/restore.sh`, tested end-to-end |
| High | CI/CD | Done — Gitea Actions with act_runner, see `docs/gitea-actions-guide.md` |
| High | Security review | Not started |
| Medium | Automated remote backups (Restic) | Blocked on choosing backup destination |
| Medium | Migration to permanent VPS | Blocked on company incorporation |
| Medium | SMTP / Email | Blocked on ProtonMail setup after incorporation |
| Low | Monitoring | — |
| Low | Group-based access control | Not needed yet (4 people) |
| Low | Move SSH to non-standard port | — |
| Low | Outline branding (remove badge) | Cosmetic, parked |

## Completed

### Backup & Restore
- Manual backup/restore scripts in `scripts/` — tested end-to-end
- See `docs/backup-restore.md` for full procedure

### CI/CD — Gitea Actions
- Gitea Actions enabled with act_runner
- GitHub Actions compatible workflow syntax
- See `docs/gitea-actions-guide.md` for usage guide

## High Priority

### Automated Remote Backups (Restic)
- Automate the existing backup script to run daily and push to remote storage
- Systemd timer (not cron)
- Retention policy: 7 daily, 4 weekly, 6 monthly
- **Blocked on**: choosing a backup destination (S3 / Backblaze B2 / SFTP)

### Security Review
- Firewall audit — verify only intended ports are exposed
- Container hardening — run containers as non-root where possible
- Secret management — move passwords/secrets out of `group_vars/all.yml` into Ansible Vault or environment files
- Review Dex/LLDAP security configuration
- Fail2ban rules review
- Check for unnecessary services or open ports
- HTTPS headers audit (HSTS, CSP, etc.)

## Medium Priority

### Migration to Permanent VPS

Once company incorporation is complete and bank account is set up.

```mermaid
sequenceDiagram
    participant Old as Old VPS
    participant Backup as Backup Storage
    participant New as New VPS
    participant DNS

    Old->>Backup: Final backup snapshot
    Note over New: Provision Debian 13
    New->>New: Run bootstrap.yml
    New->>New: Run deploy.yml
    Backup->>New: Restore volumes
    DNS->>New: Update A record to new IP
    Note over New: Verify SSL certs renew
    Note over Old: Decommission
```

### SMTP / Email
- Set up ProtonMail for cloud-elves.eu (after incorporation)
- Configure Outline and Gitea to send transactional emails
- Update Let's Encrypt contact email from personal to company address

## Low Priority

### Monitoring
- Resource monitoring (CPU, memory, disk)
- Uptime monitoring for all services
- Options: simple solution like Uptime Kuma, or external service

### Group-Based Access Control
- Configure Dex to pass LLDAP groups to applications
- Restrict certain services to specific groups (e.g., admin-only tools)
- Not needed now (4 people, everyone needs access everywhere)

### Move SSH to Non-Standard Port
- Move host sshd from 22 to a high port (e.g., 2200)
- Reduces log noise from automated scanners
- Free up port 22 for Gitea SSH (nicer clone URLs)

### Outline Branding
- Remove "Built with Outline" badge on public share pages
- Parked for now — cosmetic only