ce-infra/docs/future-plans.md

Future Plans

Priority Overview

Priority	Item	Status
High	Backup & restore	Done — scripts/backup.sh and scripts/restore.sh, tested end-to-end
High	CI/CD	Done — Gitea Actions with act_runner, see docs/gitea-actions-guide.md
High	Security review	Not started
Medium	Automated remote backups (Restic)	Blocked on choosing backup destination
Medium	Migration to permanent VPS	Blocked on company incorporation
Medium	SMTP / Email	Blocked on ProtonMail setup after incorporation
Low	Monitoring	—
Low	Group-based access control	Not needed yet (4 people)
Low	Move SSH to non-standard port	—
Low	Outline branding (remove badge)	Cosmetic, parked

Completed

Backup & Restore

• Manual backup/restore scripts in scripts/ — tested end-to-end
• See docs/backup-restore.md for full procedure

CI/CD — Gitea Actions

• Gitea Actions enabled with act_runner
• GitHub Actions compatible workflow syntax
• See docs/gitea-actions-guide.md for usage guide

High Priority

Automated Remote Backups (Restic)

• Automate the existing backup script to run daily and push to remote storage
• Systemd timer (not cron)
• Retention policy: 7 daily, 4 weekly, 6 monthly
• Blocked on: choosing a backup destination (S3 / Backblaze B2 / SFTP)

Security Review

• Firewall audit — verify only intended ports are exposed
• Container hardening — run containers as non-root where possible
• Secret management — move passwords/secrets out of group_vars/all.yml into Ansible Vault or environment files
• Review Dex/LLDAP security configuration
• Fail2ban rules review
• Check for unnecessary services or open ports
• HTTPS headers audit (HSTS, CSP, etc.)

Medium Priority

Migration to Permanent VPS

Once company incorporation is complete and bank account is set up.

sequenceDiagram
    participant Old as Old VPS
    participant Backup as Backup Storage
    participant New as New VPS
    participant DNS

    Old->>Backup: Final backup snapshot
    Note over New: Provision Debian 13
    New->>New: Run bootstrap.yml
    New->>New: Run deploy.yml
    Backup->>New: Restore volumes
    DNS->>New: Update A record to new IP
    Note over New: Verify SSL certs renew
    Note over Old: Decommission

SMTP / Email

• Set up ProtonMail for cloud-elves.eu (after incorporation)
• Configure Outline and Gitea to send transactional emails
• Update Let's Encrypt contact email from personal to company address

Low Priority

Monitoring

• Resource monitoring (CPU, memory, disk)
• Uptime monitoring for all services
• Options: simple solution like Uptime Kuma, or external service

Group-Based Access Control

• Configure Dex to pass LLDAP groups to applications
• Restrict certain services to specific groups (e.g., admin-only tools)
• Not needed now (4 people, everyone needs access everywhere)

Move SSH to Non-Standard Port

• Move host sshd from 22 to a high port (e.g., 2200)
• Reduces log noise from automated scanners
• Free up port 22 for Gitea SSH (nicer clone URLs)

Outline Branding

• Remove "Built with Outline" badge on public share pages
• Parked for now — cosmetic only