94 lines
3.2 KiB
Markdown
94 lines
3.2 KiB
Markdown
# Future Plans
|
|
|
|
## Priority Overview
|
|
|
|
| Priority | Item | Status |
|
|
|---|---|---|
|
|
| High | Backup & restore | Done — `scripts/backup.sh` and `scripts/restore.sh`, tested end-to-end |
|
|
| High | CI/CD | Done — Gitea Actions with act_runner, see `docs/gitea-actions-guide.md` |
|
|
| High | Security review | Not started |
|
|
| Medium | Automated remote backups (Restic) | Blocked on choosing backup destination |
|
|
| Medium | Migration to permanent VPS | Blocked on company incorporation |
|
|
| Medium | SMTP / Email | Blocked on ProtonMail setup after incorporation |
|
|
| Low | Monitoring | — |
|
|
| Low | Group-based access control | Not needed yet (4 people) |
|
|
| Low | Move SSH to non-standard port | — |
|
|
| Low | Outline branding (remove badge) | Cosmetic, parked |
|
|
|
|
## Completed
|
|
|
|
### Backup & Restore
|
|
- Manual backup/restore scripts in `scripts/` — tested end-to-end
|
|
- See `docs/backup-restore.md` for full procedure
|
|
|
|
### CI/CD — Gitea Actions
|
|
- Gitea Actions enabled with act_runner
|
|
- GitHub Actions compatible workflow syntax
|
|
- See `docs/gitea-actions-guide.md` for usage guide
|
|
|
|
## High Priority
|
|
|
|
### Automated Remote Backups (Restic)
|
|
- Automate the existing backup script to run daily and push to remote storage
|
|
- Systemd timer (not cron)
|
|
- Retention policy: 7 daily, 4 weekly, 6 monthly
|
|
- **Blocked on**: choosing a backup destination (S3 / Backblaze B2 / SFTP)
|
|
|
|
### Security Review
|
|
- Firewall audit — verify only intended ports are exposed
|
|
- Container hardening — run containers as non-root where possible
|
|
- Secret management — move passwords/secrets out of `group_vars/all.yml` into Ansible Vault or environment files
|
|
- Review Dex/LLDAP security configuration
|
|
- Fail2ban rules review
|
|
- Check for unnecessary services or open ports
|
|
- HTTPS headers audit (HSTS, CSP, etc.)
|
|
|
|
## Medium Priority
|
|
|
|
### Migration to Permanent VPS
|
|
|
|
Once company incorporation is complete and bank account is set up.
|
|
|
|
```mermaid
|
|
sequenceDiagram
|
|
participant Old as Old VPS
|
|
participant Backup as Backup Storage
|
|
participant New as New VPS
|
|
participant DNS
|
|
|
|
Old->>Backup: Final backup snapshot
|
|
Note over New: Provision Debian 13
|
|
New->>New: Run bootstrap.yml
|
|
New->>New: Run deploy.yml
|
|
Backup->>New: Restore volumes
|
|
DNS->>New: Update A record to new IP
|
|
Note over New: Verify SSL certs renew
|
|
Note over Old: Decommission
|
|
```
|
|
|
|
### SMTP / Email
|
|
- Set up ProtonMail for cloud-elves.eu (after incorporation)
|
|
- Configure Outline and Gitea to send transactional emails
|
|
- Update Let's Encrypt contact email from personal to company address
|
|
|
|
## Low Priority
|
|
|
|
### Monitoring
|
|
- Resource monitoring (CPU, memory, disk)
|
|
- Uptime monitoring for all services
|
|
- Options: simple solution like Uptime Kuma, or external service
|
|
|
|
### Group-Based Access Control
|
|
- Configure Dex to pass LLDAP groups to applications
|
|
- Restrict certain services to specific groups (e.g., admin-only tools)
|
|
- Not needed now (4 people, everyone needs access everywhere)
|
|
|
|
### Move SSH to Non-Standard Port
|
|
- Move host sshd from 22 to a high port (e.g., 2200)
|
|
- Reduces log noise from automated scanners
|
|
- Free up port 22 for Gitea SSH (nicer clone URLs)
|
|
|
|
### Outline Branding
|
|
- Remove "Built with Outline" badge on public share pages
|
|
- Parked for now — cosmetic only
|