# Infrastructure Improvements TODO

Current state (2026-10-31): 24 services in 6 categories, all compose files
templated, Pocket ID as SSO (Authentik retired), multi-agent guard rails
(`bin/worktree`, `bin/deploy`, `bin/vault-run`, `deploy-guard.yml`).

## Done
- Split the docker role into categories with category and service tags.
- Central variables in `group_vars/all/` (`domains.yml`, `infrastructure.yml`,
  `vault.yml`).
- Converted every static compose file to a template.
- Removed unused services, most recently Authentik, Calibre-Web, dir2opds,
  kosync, Sneaky Klaus and Audiobookshelf podcasts.
- Reserved address range on the `lava` network so fixed IPs can't be taken.
- Automatic container updates with dockcheck for labelled containers.

## Open

### Reusable template patterns
Many compose templates repeat the same network, restart and label blocks.
Pull the shared parts into includes or macros.

### Health checks
Only Pocket ID, Gondulf, Dawarich, Listmonk and Syncthing define health checks
in their templates. Add them to the rest where the image supports it.

### Backups
Only Paperless-ngx and GoToSocial back up (daily to S3 with
`offen/docker-volume-backup`, 7-day retention). Still to do:
- Database dumps for the Postgres/MongoDB/CouchDB services.
- Volume backups for the file-based services (Kavita, Audiobookshelf, Gitea,
  Pocket ID, …).
- A tested restore.

### Network segmentation
Every service shares the `lava` network. Consider separate frontend, backend
and database networks.

### Security hardening
- Add `no-new-privileges` and dropped capabilities where images allow it
  (only Manyfold has them now). Cronmaster runs as root.
- fail2ban (or Caddy rate limits) in front of login pages.

### CI with Gitea Actions
Syntax check and `--check` runs on push, using the existing Gitea runner.

### Configuration drift detection
Catch manual changes on the server, e.g. a scheduled `bin/deploy --check`.

### Service start order
Apps that use Pocket ID don't wait for it to be up.

### Ansible clean-up
- Replace the deprecated `apt_key` task for Docker's repo (it also fetches the
  Ubuntu key for a Debian repo).
- Use `ansible.builtin.` names everywhere.
- The Dockge compose file is templated twice (`tasks/main.yml` and
  `tasks/infrastructure/main.yml`).