silverlinux-infra/docs/roadmap.md

Roadmap

Overview

This document tracks planned SilverLinux infrastructure improvements.

The roadmap focuses on observability, access control, security hardening, platform services and backup maturity.

---

Planned Capabilities

Collaboration And Storage

Nextcloud

Purpose:

• Self-hosted file sharing
• Team document storage
• Optional collaboration layer for internal operations

Status:

Completed

Deployment:

• Docker Compose project: nextcloud
• Management: slcompose with Infisical secret injection
• External access: cloud.silveressence.net through Nginx Proxy Manager
• Internal networking: nextcloud_nextcloud_internal
• Runtime services: nextcloud, nextcloud-db, nextcloud-redis

See docs/nextcloud.md for complete deployment documentation.

---

Observability

Grafana And Prometheus

Purpose:

• Metrics collection
• Dashboards and visualization
• Host and container health monitoring
• Alerting foundation

Status:

Completed

Completed components:

• Prometheus
• Grafana
• Node Exporter
• cAdvisor
• Alertmanager

Validation:

• Prometheus UI validated
• Prometheus targets validated
• Grafana datasource connected to Prometheus
• Initial dashboards created and validated
• Alertmanager email routing validated

Alerting:

• Incident grouping implemented
• Severity-based routing implemented
• Alert deduplication implemented
• Multi-recipient email alerts implemented

---

Loki

Purpose:

• Central log aggregation
• Log exploration through Grafana
• Faster incident investigation

Status:

Planned

---

Sentry

Purpose:

• Application error tracking
• Release health visibility
• Exception diagnostics for deployed apps

Status:

Completed

Completed components:

• Sentry self-hosted distributed deployment (70+ services)
• Relay for event ingestion
• Kafka for event streaming
• ClickHouse for high-performance event storage
• PostgreSQL for metadata storage
• Snuba for event processing and query engine
• Redis for caching and coordination
• SeaweedFS for object/file storage
• Web UI and API layer
• Background workers (taskworker, cron, cleanup, etc.)
• Nginx proxy integration at sentry.silveressence.net

Deployment:

• Docker Compose project: sentry-self-hosted
• Management: slcompose orchestrator with Infisical secret injection
• External access: sentry.silveressence.net (Nginx Proxy Manager)
• Internal networking: Isolated sentry-self-hosted_default network

See docs/sentry.md for complete deployment documentation.

---

Identity And Access

Authelia

Purpose:

• Identity and access management for exposed admin areas
• SSO gateway for sensitive services
• Additional protection for DbGate, Portainer, Gitea admin areas and OpenProject admin areas

Status:

Planned

---

Security Hardening

Fail2Ban Upgrade

Purpose:

• Improve brute-force protection
• Expand jail coverage beyond SSH where practical
• Align detection with exposed administrative services

Status:

Planned

---

CrowdSec

Purpose:

• Collaborative intrusion detection
• Behavior-based blocking
• Additional protection for public endpoints

Status:

Planned

---

Cloudflare Rate Limiting And WAF

Purpose:

• Rate limiting for exposed admin areas
• WAF rules for common attack patterns
• Brute-force protection before traffic reaches SilverLinux

Target areas:

• DbGate
• Portainer
• Gitea administrator areas
• OpenProject administrator areas
• Prototype and demo endpoints where appropriate

Status:

Planned

---

Platform Services

Harbor

Purpose:

• Docker image registry
• Internal image distribution
• Container artifact management

Status:

Planned

---

SonarQube

Purpose:

• Code quality scanning
• Security scanning
• Technical debt tracking

Status:

Planned

---

Backstage

Purpose:

• Internal developer portal
• Service catalog
• Platform documentation entry point

Status:

Planned

---

Performance

Redis

Purpose:

• Caching layer for databases and high-traffic application reads
• Session storage where supported by applications
• Future scaling support

Status:

Planned

---

Backup And Restore

Restic

Purpose:

• Versioned backup jobs
• Restore workflows
• Encrypted backups
• Better backup retention management

Status:

Planned

Current backup status:

Backup v5.3 production

Completed:

• Daily cron backup
• Email reports
• HTML reports
• Automatic archive generation
• Automatic cleanup
• Backup metrics export
• Restore validation
• Lock file protection
• Disk space validation
• Central logging
• Structured failure handling

---

Priority Phases

Phase 1 - Immediate Impact

Items:

• Loki
• Redis
• Authelia

Completed:

• Grafana
• Prometheus
• Node Exporter
• cAdvisor
• Alertmanager
• Backup metrics integration
• Incident intelligence

---

Phase 2 - Security And Stability

Items:

• CrowdSec
• Fail2Ban upgrade
• Cloudflare rate limiting and WAF

Completed:

• Backup v5.3 automation
• Restore validation
• Sentry

---

Phase 3 - Scale And Enterprise Services

Items:

• SonarQube
• Harbor Docker registry
• Backstage portal

Completed:

• Nextcloud

---

Documentation Requirements

Each roadmap item should receive documentation before deployment:

• Service purpose
• Docker Compose location
• Data and backup paths
• Network attachments
• Public exposure policy
• Authentication model
• Secrets required
• Restore procedure

---

Related Documentation

• docs/services.md
• docs/security.md
• docs/network.md
• docs/backups.md
• docs/monitoring.md
• docs/decisions.md