ce-infra/docs/future-plans.md

Future Plans

Priority Overview

Priority	Item	Blocked on
High	Backup system (Restic)	Choosing backup destination
High	Security review	—
Medium	Migration to permanent VPS	Company incorporation
Medium	SMTP / Email	ProtonMail setup after incorporation
Medium	CI/CD pipeline	—
Low	Monitoring	—
Low	Group-based access control	Not needed yet (4 people)
Low	Move SSH to non-standard port	—
Low	Outline branding (remove badge)	Cosmetic, parked

High Priority

Backup System (Restic)

• Daily automated backup of all Docker volumes to object storage
• Systemd timer (not cron)
• Retention policy: 7 daily, 4 weekly, 6 monthly
• Test restore procedure documented
• Blocked on: choosing a backup destination (S3 / Backblaze B2 / SFTP)

Security Review

• Firewall audit — verify only intended ports are exposed
• Container hardening — run containers as non-root where possible
• Secret management — move passwords/secrets out of group_vars/all.yml into Ansible Vault or environment files
• Review Dex/LLDAP security configuration
• Fail2ban rules review
• Check for unnecessary services or open ports
• HTTPS headers audit (HSTS, CSP, etc.)

Medium Priority

Migration to Permanent VPS

Once company incorporation is complete and bank account is set up.

sequenceDiagram
    participant Old as Old VPS
    participant Backup as Backup Storage
    participant New as New VPS
    participant DNS

    Old->>Backup: Final backup snapshot
    Note over New: Provision Debian 13
    New->>New: Run bootstrap.yml
    New->>New: Run deploy.yml
    Backup->>New: Restore volumes
    DNS->>New: Update A record to new IP
    Note over New: Verify SSL certs renew
    Note over Old: Decommission

CI/CD Pipeline

• Automated deployment on git push
• Documentation pipeline (Markdown to Outline, or similar)
• Options to evaluate: Gitea Actions, Drone CI, or simple webhook-based deploy

SMTP / Email

• Set up ProtonMail for cloud-elves.eu (after incorporation)
• Configure Outline and Gitea to send transactional emails
• Update Let's Encrypt contact email from personal to company address

Low Priority

Monitoring

• Resource monitoring (CPU, memory, disk)
• Uptime monitoring for all services
• Options: simple solution like Uptime Kuma, or external service

Group-Based Access Control

• Configure Dex to pass LLDAP groups to applications
• Restrict certain services to specific groups (e.g., admin-only tools)
• Not needed now (4 people, everyone needs access everywhere)

Move SSH to Non-Standard Port

• Move host sshd from 22 to a high port (e.g., 2200)
• Reduces log noise from automated scanners
• Free up port 22 for Gitea SSH (nicer clone URLs)

Outline Branding

• Remove "Built with Outline" badge on public share pages
• Parked for now — cosmetic only