# Roadmap ## Overview This document tracks planned SilverLinux infrastructure improvements. The roadmap focuses on observability, access control, security hardening, platform services and backup maturity. --- ## Planned Capabilities ### Collaboration And Storage #### Nextcloud Purpose: * Self-hosted file sharing * Team document storage * Optional collaboration layer for internal operations Status: ```text Completed ``` Deployment: * Docker Compose project: `nextcloud` * Management: `slcompose` with Infisical secret injection * External access: `cloud.silveressence.net` through Nginx Proxy Manager * Internal networking: `nextcloud_nextcloud_internal` * Runtime services: `nextcloud`, `nextcloud-db`, `nextcloud-redis` See [docs/nextcloud.md](nextcloud.md) for complete deployment documentation. --- ### Observability #### Grafana And Prometheus Purpose: * Metrics collection * Dashboards and visualization * Host and container health monitoring * Alerting foundation Status: ```text Completed ``` Completed components: * Prometheus * Grafana * Node Exporter * cAdvisor * Alertmanager Validation: * Prometheus UI validated * Prometheus targets validated * Grafana datasource connected to Prometheus * Initial dashboards created and validated * Alertmanager email routing validated Alerting: * Incident grouping implemented * Severity-based routing implemented * Alert deduplication implemented * Multi-recipient email alerts implemented --- #### Loki Purpose: * Central log aggregation * Log exploration through Grafana * Faster incident investigation Status: ```text Planned ``` --- #### Sentry Purpose: * Application error tracking * Release health visibility * Exception diagnostics for deployed apps Status: ```text Completed ``` Completed components: * Sentry self-hosted distributed deployment (70+ services) * Relay for event ingestion * Kafka for event streaming * ClickHouse for high-performance event storage * PostgreSQL for metadata storage * Snuba for event processing and query engine * Redis for caching and coordination * SeaweedFS for object/file storage * Web UI and API layer * Background workers (taskworker, cron, cleanup, etc.) * Nginx proxy integration at sentry.silveressence.net Deployment: * Docker Compose project: sentry-self-hosted * Management: slcompose orchestrator with Infisical secret injection * External access: sentry.silveressence.net (Nginx Proxy Manager) * Internal networking: Isolated sentry-self-hosted_default network See [docs/sentry.md](sentry.md) for complete deployment documentation. --- ### Identity And Access #### Authelia Purpose: * Identity and access management for exposed admin areas * SSO gateway for sensitive services * Additional protection for DbGate, Portainer, Gitea admin areas and OpenProject admin areas Status: ```text Planned ``` --- ### Security Hardening #### Fail2Ban Upgrade Purpose: * Improve brute-force protection * Expand jail coverage beyond SSH where practical * Align detection with exposed administrative services Status: ```text Planned ``` --- #### CrowdSec Purpose: * Collaborative intrusion detection * Behavior-based blocking * Additional protection for public endpoints Status: ```text Planned ``` --- #### Cloudflare Rate Limiting And WAF Purpose: * Rate limiting for exposed admin areas * WAF rules for common attack patterns * Brute-force protection before traffic reaches SilverLinux Target areas: * DbGate * Portainer * Gitea administrator areas * OpenProject administrator areas * Prototype and demo endpoints where appropriate Status: ```text Planned ``` --- ### Platform Services #### Harbor Purpose: * Docker image registry * Internal image distribution * Container artifact management Status: ```text Planned ``` --- #### SonarQube Purpose: * Code quality scanning * Security scanning * Technical debt tracking Status: ```text Planned ``` --- #### Backstage Purpose: * Internal developer portal * Service catalog * Platform documentation entry point Status: ```text Planned ``` --- ### Performance #### Redis Purpose: * Caching layer for databases and high-traffic application reads * Session storage where supported by applications * Future scaling support Status: ```text Planned ``` --- ### Backup And Restore #### Restic Purpose: * Versioned backup jobs * Restore workflows * Encrypted backups * Better backup retention management Status: ```text Planned ``` Current backup status: ```text Backup v5.3 production ``` Completed: * Daily cron backup * Email reports * HTML reports * Automatic archive generation * Automatic cleanup * Backup metrics export * Restore validation * Lock file protection * Disk space validation * Central logging * Structured failure handling --- ## Priority Phases ### Phase 1 - Immediate Impact Items: * Loki * Redis * Authelia Completed: * Grafana * Prometheus * Node Exporter * cAdvisor * Alertmanager * Backup metrics integration * Incident intelligence --- ### Phase 2 - Security And Stability Items: * CrowdSec * Fail2Ban upgrade * Cloudflare rate limiting and WAF Completed: * Backup v5.3 automation * Restore validation * Sentry --- ### Phase 3 - Scale And Enterprise Services Items: * SonarQube * Harbor Docker registry * Backstage portal Completed: * Nextcloud --- ## Documentation Requirements Each roadmap item should receive documentation before deployment: * Service purpose * Docker Compose location * Data and backup paths * Network attachments * Public exposure policy * Authentication model * Secrets required * Restore procedure --- ## Related Documentation * docs/services.md * docs/security.md * docs/network.md * docs/backups.md * docs/monitoring.md * docs/decisions.md