PhilandClaude Opus 5.5
0c14ee5b1d
The READMEs, CLAUDE.md and todo.md still described Authentik, services removed long ago (Ghost, MMDL, Postiz, Pinchflat...) and two servers. Now they list the 24 services actually deployed (checked against docker ps), explain that netcup and docker-01 are one machine, document Gondulf, StarPunk, Listmonk, Gokapi and dockcheck, and use bin/deploy throughout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
59 lines
2.2 KiB
Markdown
59 lines
2.2 KiB
Markdown
# Infrastructure Improvements TODO
|
|
|
|
Current state (2026-10-31): 24 services in 6 categories, all compose files
|
|
templated, Pocket ID as SSO (Authentik retired), multi-agent guard rails
|
|
(`bin/worktree`, `bin/deploy`, `bin/vault-run`, `deploy-guard.yml`).
|
|
|
|
## Done
|
|
- Split the docker role into categories with category and service tags.
|
|
- Central variables in `group_vars/all/` (`domains.yml`, `infrastructure.yml`,
|
|
`vault.yml`).
|
|
- Converted every static compose file to a template.
|
|
- Removed unused services, most recently Authentik, Calibre-Web, dir2opds,
|
|
kosync, Sneaky Klaus and Audiobookshelf podcasts.
|
|
- Reserved address range on the `lava` network so fixed IPs can't be taken.
|
|
- Automatic container updates with dockcheck for labelled containers.
|
|
|
|
## Open
|
|
|
|
### Reusable template patterns
|
|
Many compose templates repeat the same network, restart and label blocks.
|
|
Pull the shared parts into includes or macros.
|
|
|
|
### Health checks
|
|
Only Pocket ID, Gondulf, Dawarich, Listmonk and Syncthing define health checks
|
|
in their templates. Add them to the rest where the image supports it.
|
|
|
|
### Backups
|
|
Only Paperless-ngx and GoToSocial back up (daily to S3 with
|
|
`offen/docker-volume-backup`, 7-day retention). Still to do:
|
|
- Database dumps for the Postgres/MongoDB/CouchDB services.
|
|
- Volume backups for the file-based services (Kavita, Audiobookshelf, Gitea,
|
|
Pocket ID, …).
|
|
- A tested restore.
|
|
|
|
### Network segmentation
|
|
Every service shares the `lava` network. Consider separate frontend, backend
|
|
and database networks.
|
|
|
|
### Security hardening
|
|
- Add `no-new-privileges` and dropped capabilities where images allow it
|
|
(only Manyfold has them now). Cronmaster runs as root.
|
|
- fail2ban (or Caddy rate limits) in front of login pages.
|
|
|
|
### CI with Gitea Actions
|
|
Syntax check and `--check` runs on push, using the existing Gitea runner.
|
|
|
|
### Configuration drift detection
|
|
Catch manual changes on the server, e.g. a scheduled `bin/deploy --check`.
|
|
|
|
### Service start order
|
|
Apps that use Pocket ID don't wait for it to be up.
|
|
|
|
### Ansible clean-up
|
|
- Replace the deprecated `apt_key` task for Docker's repo (it also fetches the
|
|
Ubuntu key for a Debian repo).
|
|
- Use `ansible.builtin.` names everywhere.
|
|
- The Dockge compose file is templated twice (`tasks/main.yml` and
|
|
`tasks/infrastructure/main.yml`).
|