88 lines
2.9 KiB
Markdown
88 lines
2.9 KiB
Markdown
# Future Plans
|
|
|
|
## Priority Overview
|
|
|
|
| Priority | Item | Blocked on |
|
|
|---|---|---|
|
|
| High | Backup system (Restic) | Choosing backup destination |
|
|
| High | Security review | — |
|
|
| Medium | Migration to permanent VPS | Company incorporation |
|
|
| Medium | SMTP / Email | ProtonMail setup after incorporation |
|
|
| Medium | CI/CD pipeline | — |
|
|
| Low | Monitoring | — |
|
|
| Low | Group-based access control | Not needed yet (4 people) |
|
|
| Low | Move SSH to non-standard port | — |
|
|
| Low | Outline branding (remove badge) | Cosmetic, parked |
|
|
|
|
## High Priority
|
|
|
|
### Backup System (Restic)
|
|
- Daily automated backup of all Docker volumes to object storage
|
|
- Systemd timer (not cron)
|
|
- Retention policy: 7 daily, 4 weekly, 6 monthly
|
|
- Test restore procedure documented
|
|
- **Blocked on**: choosing a backup destination (S3 / Backblaze B2 / SFTP)
|
|
|
|
### Security Review
|
|
- Firewall audit — verify only intended ports are exposed
|
|
- Container hardening — run containers as non-root where possible
|
|
- Secret management — move passwords/secrets out of `group_vars/all.yml` into Ansible Vault or environment files
|
|
- Review Dex/LLDAP security configuration
|
|
- Fail2ban rules review
|
|
- Check for unnecessary services or open ports
|
|
- HTTPS headers audit (HSTS, CSP, etc.)
|
|
|
|
## Medium Priority
|
|
|
|
### Migration to Permanent VPS
|
|
|
|
Once company incorporation is complete and bank account is set up.
|
|
|
|
```mermaid
|
|
sequenceDiagram
|
|
participant Old as Old VPS
|
|
participant Backup as Backup Storage
|
|
participant New as New VPS
|
|
participant DNS
|
|
|
|
Old->>Backup: Final backup snapshot
|
|
Note over New: Provision Debian 13
|
|
New->>New: Run bootstrap.yml
|
|
New->>New: Run deploy.yml
|
|
Backup->>New: Restore volumes
|
|
DNS->>New: Update A record to new IP
|
|
Note over New: Verify SSL certs renew
|
|
Note over Old: Decommission
|
|
```
|
|
|
|
### CI/CD Pipeline
|
|
- Automated deployment on git push
|
|
- Documentation pipeline (Markdown to Outline, or similar)
|
|
- Options to evaluate: Gitea Actions, Drone CI, or simple webhook-based deploy
|
|
|
|
### SMTP / Email
|
|
- Set up ProtonMail for cloud-elves.eu (after incorporation)
|
|
- Configure Outline and Gitea to send transactional emails
|
|
- Update Let's Encrypt contact email from personal to company address
|
|
|
|
## Low Priority
|
|
|
|
### Monitoring
|
|
- Resource monitoring (CPU, memory, disk)
|
|
- Uptime monitoring for all services
|
|
- Options: simple solution like Uptime Kuma, or external service
|
|
|
|
### Group-Based Access Control
|
|
- Configure Dex to pass LLDAP groups to applications
|
|
- Restrict certain services to specific groups (e.g., admin-only tools)
|
|
- Not needed now (4 people, everyone needs access everywhere)
|
|
|
|
### Move SSH to Non-Standard Port
|
|
- Move host sshd from 22 to a high port (e.g., 2200)
|
|
- Reduces log noise from automated scanners
|
|
- Free up port 22 for Gitea SSH (nicer clone URLs)
|
|
|
|
### Outline Branding
|
|
- Remove "Built with Outline" badge on public share pages
|
|
- Parked for now — cosmetic only
|