From 8ca2122cb3cb40d5bbde9b643389e5cd508f0fc1 Mon Sep 17 00:00:00 2001
From: Phil <phil@thesatelliteoflove.com>
Date: Fri, 6 Jun 2025 11:46:07 -0600
Subject: [PATCH] add: comprehensive infrastructure improvement roadmap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Document prioritized improvements for Ansible infrastructure including:
- Docker role reorganization into logical service groups
- Variable management standardization
- Security hardening and backup strategies
- CI/CD automation opportunities
- Network segmentation and monitoring enhancements

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 todo.md | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 116 insertions(+)
 create mode 100644 todo.md

diff --git a/todo.md b/todo.md
new file mode 100644
index 0000000..9821945
--- /dev/null
+++ b/todo.md
@@ -0,0 +1,116 @@
+# Infrastructure Improvements TODO
+
+## High Priority (Quick Wins)
+
+### 1. Split the massive docker role ⚠️ IN PROGRESS
+- **Current Issue**: `roles/docker/tasks/main.yml` has 20+ services in one file (176 lines)
+- **Solution**: Break into logical service groups:
+  ```
+  roles/docker/tasks/
+  ├── main.yml (orchestrator)
+  ├── infrastructure/ (caddy, authentik, dockge)
+  ├── development/ (gitea, codeserver, conduit)
+  ├── media/ (audiobookshelf, calibre, ghost, pinchflat)
+  ├── productivity/ (paperless, baikal, syncthing, tasksmd)
+  └── monitoring/ (glance, changedetection, appriseapi)
+  ```
+
+### 2. Standardize variable management
+- **Current Issue**: Secrets in single encrypted file, no clear variable hierarchy
+- **Solution**: Create proper variable structure:
+  ```
+  group_vars/
+  ├── all/
+  │   ├── common.yml (shared config)
+  │   └── secrets.yml (vault encrypted)
+  ├── docker/
+  │   ├── services.yml (service configs)
+  │   └── networking.yml (network settings)
+  ```
+
+### 3. Template consolidation
+- **Current Issue**: Many compose templates repeat patterns
+- **Solution**: Create reusable template includes with standard service template structure
+
+## Security & Reliability
+
+### 4. Add health checks
+- **Issue**: Most services lack proper healthcheck configurations in compose templates
+- **Solution**: Implement comprehensive health monitoring with standardized healthcheck patterns
+
+### 5. Implement backup strategy
+- **Issue**: No automated backups for 25+ services and their data
+- **Solution**: Add backup role with:
+  - Database dumps for PostgreSQL services
+  - Volume backups for file-based services
+  - Rotation policies
+  - Restoration testing
+
+### 6. Network segmentation
+- **Issue**: All services share one Docker network
+- **Solution**: Separate into:
+  - `frontend` (Public-facing services)
+  - `backend` (Internal services only)
+  - `database` (Database access only)
+
+### 7. Security hardening
+- Remove unnecessary `user: root` from services
+- Add security contexts to all containers
+- Implement least-privilege access patterns
+- Add fail2ban for authentication services
+
+## Automation Opportunities
+
+### 8. CI/CD with Gitea Actions
+- Leverage self-hosted Gitea for:
+  - Ansible syntax validation
+  - Service configuration testing
+  - Automated deployment triggers
+  - Rollback capabilities
+
+### 9. Configuration drift detection
+- Add validation tasks to catch manual changes
+- Implement configuration validation with proper assertions
+
+### 10. Service dependency management
+- **Issue**: Some services depend on Authentik SSO but no startup ordering
+- **Solution**: Implement dependency checking and startup ordering
+
+### 11. Ansible best practices
+- Replace deprecated `apt_key` with proper patterns
+- Use `ansible.builtin` FQCN consistently
+- Add `check_mode` support
+- Implement proper idempotency checks
+
+### 12. Documentation automation
+- Auto-generate service inventory
+- Create service documentation templates
+- Implement automated documentation updates
+
+## Implementation Roadmap
+
+### Week 1: Foundation
+- [x] Document improvements in todo.md
+- [ ] Reorganize docker role structure
+- [ ] Implement variable hierarchy
+- [ ] Standardize templates
+
+### Week 2: Security & Monitoring  
+- [ ] Add health checks
+- [ ] Implement backup strategy
+- [ ] Security hardening
+
+### Week 3: Automation
+- [ ] CI/CD pipeline setup
+- [ ] Configuration validation
+- [ ] Documentation automation
+
+### Week 4: Advanced Features
+- [ ] Network segmentation
+- [ ] Dependency management
+- [ ] Monitoring dashboard
+
+## Notes
+- Current architecture is solid but needs better organization for long-term maintainability
+- Focus on high-impact, low-effort improvements first
+- Leverage existing infrastructure (Gitea, Authentik) for automation
\ No newline at end of file