397 lines
5.7 KiB
Markdown
397 lines
5.7 KiB
Markdown
# Roadmap
|
|
|
|
## Overview
|
|
|
|
This document tracks planned SilverLinux infrastructure improvements.
|
|
|
|
The roadmap focuses on observability, access control, security hardening, platform services and backup maturity.
|
|
|
|
---
|
|
|
|
## Planned Capabilities
|
|
|
|
### Collaboration And Storage
|
|
|
|
#### Nextcloud
|
|
|
|
Purpose:
|
|
|
|
* Self-hosted file sharing
|
|
* Team document storage
|
|
* Optional collaboration layer for internal operations
|
|
|
|
Status:
|
|
|
|
```text
|
|
Completed
|
|
```
|
|
|
|
Deployment:
|
|
|
|
* Docker Compose project: `nextcloud`
|
|
* Management: `slcompose` with Infisical secret injection
|
|
* External access: `cloud.silveressence.net` through Nginx Proxy Manager
|
|
* Internal networking: `nextcloud_nextcloud_internal`
|
|
* Runtime services: `nextcloud`, `nextcloud-db`, `nextcloud-redis`
|
|
|
|
See [docs/nextcloud.md](nextcloud.md) for complete deployment documentation.
|
|
|
|
---
|
|
|
|
### Observability
|
|
|
|
#### Grafana And Prometheus
|
|
|
|
Purpose:
|
|
|
|
* Metrics collection
|
|
* Dashboards and visualization
|
|
* Host and container health monitoring
|
|
* Alerting foundation
|
|
|
|
Status:
|
|
|
|
```text
|
|
Completed
|
|
```
|
|
|
|
Completed components:
|
|
|
|
* Prometheus
|
|
* Grafana
|
|
* Node Exporter
|
|
* cAdvisor
|
|
* Alertmanager
|
|
|
|
Validation:
|
|
|
|
* Prometheus UI validated
|
|
* Prometheus targets validated
|
|
* Grafana datasource connected to Prometheus
|
|
* Initial dashboards created and validated
|
|
* Alertmanager email routing validated
|
|
|
|
Alerting:
|
|
|
|
* Incident grouping implemented
|
|
* Severity-based routing implemented
|
|
* Alert deduplication implemented
|
|
* Multi-recipient email alerts implemented
|
|
|
|
---
|
|
|
|
#### Loki
|
|
|
|
Purpose:
|
|
|
|
* Central log aggregation
|
|
* Log exploration through Grafana
|
|
* Faster incident investigation
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
---
|
|
|
|
#### Sentry
|
|
|
|
Purpose:
|
|
|
|
* Application error tracking
|
|
* Release health visibility
|
|
* Exception diagnostics for deployed apps
|
|
|
|
Status:
|
|
|
|
```text
|
|
Completed
|
|
```
|
|
|
|
Completed components:
|
|
|
|
* Sentry self-hosted distributed deployment (70+ services)
|
|
* Relay for event ingestion
|
|
* Kafka for event streaming
|
|
* ClickHouse for high-performance event storage
|
|
* PostgreSQL for metadata storage
|
|
* Snuba for event processing and query engine
|
|
* Redis for caching and coordination
|
|
* SeaweedFS for object/file storage
|
|
* Web UI and API layer
|
|
* Background workers (taskworker, cron, cleanup, etc.)
|
|
* Nginx proxy integration at sentry.silveressence.net
|
|
|
|
Deployment:
|
|
|
|
* Docker Compose project: sentry-self-hosted
|
|
* Management: upstream Sentry self-hosted `install.sh` workflow
|
|
* External access: sentry.silveressence.net (Nginx Proxy Manager)
|
|
* Internal networking: Isolated sentry-self-hosted_default network
|
|
* Exception to the standard SilverLinux `slcompose` and Infisical service pattern
|
|
|
|
See [docs/sentry.md](sentry.md) for complete deployment documentation.
|
|
|
|
---
|
|
|
|
### Identity And Access
|
|
|
|
#### Authelia
|
|
|
|
Purpose:
|
|
|
|
* Identity and access management for exposed admin areas
|
|
* SSO gateway for sensitive services
|
|
* Additional protection for DbGate, Portainer, Gitea admin areas and OpenProject admin areas
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
---
|
|
|
|
### Security Hardening
|
|
|
|
#### Fail2Ban Upgrade
|
|
|
|
Purpose:
|
|
|
|
* Improve brute-force protection
|
|
* Expand jail coverage beyond SSH where practical
|
|
* Align detection with exposed administrative services
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
---
|
|
|
|
#### CrowdSec
|
|
|
|
Purpose:
|
|
|
|
* Collaborative intrusion detection
|
|
* Behavior-based blocking
|
|
* Additional protection for public endpoints
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
---
|
|
|
|
#### Cloudflare Rate Limiting And WAF
|
|
|
|
Purpose:
|
|
|
|
* Rate limiting for exposed admin areas
|
|
* WAF rules for common attack patterns
|
|
* Brute-force protection before traffic reaches SilverLinux
|
|
|
|
Target areas:
|
|
|
|
* DbGate
|
|
* Portainer
|
|
* Gitea administrator areas
|
|
* OpenProject administrator areas
|
|
* Prototype and demo endpoints where appropriate
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
---
|
|
|
|
### Platform Services
|
|
|
|
#### Harbor
|
|
|
|
Purpose:
|
|
|
|
* Docker image registry
|
|
* Internal image distribution
|
|
* Container artifact management
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
---
|
|
|
|
#### SonarQube
|
|
|
|
Purpose:
|
|
|
|
* Code quality scanning
|
|
* Security scanning
|
|
* Technical debt tracking
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
---
|
|
|
|
#### Backstage
|
|
|
|
Purpose:
|
|
|
|
* Internal developer portal
|
|
* Service catalog
|
|
* Platform documentation entry point
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
---
|
|
|
|
### Performance
|
|
|
|
#### Redis
|
|
|
|
Purpose:
|
|
|
|
* Caching layer for databases and high-traffic application reads
|
|
* Session storage where supported by applications
|
|
* Future scaling support
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
---
|
|
|
|
### Backup And Restore
|
|
|
|
#### Restic
|
|
|
|
Purpose:
|
|
|
|
* Versioned backup jobs
|
|
* Restore workflows
|
|
* Encrypted backups
|
|
* Better backup retention management
|
|
|
|
Status:
|
|
|
|
```text
|
|
Planned
|
|
```
|
|
|
|
Current backup status:
|
|
|
|
```text
|
|
Backup v5.3 production
|
|
```
|
|
|
|
Completed:
|
|
|
|
* Daily cron backup
|
|
* Email reports
|
|
* HTML reports
|
|
* Automatic archive generation
|
|
* Automatic cleanup
|
|
* Backup metrics export
|
|
* Restore validation
|
|
* Lock file protection
|
|
* Disk space validation
|
|
* Central logging
|
|
* Structured failure handling
|
|
|
|
---
|
|
|
|
## Priority Phases
|
|
|
|
### Phase 1 - Immediate Impact
|
|
|
|
Items:
|
|
|
|
* Loki
|
|
* Redis
|
|
* Authelia
|
|
|
|
Completed:
|
|
|
|
* Grafana
|
|
* Prometheus
|
|
* Node Exporter
|
|
* cAdvisor
|
|
* Alertmanager
|
|
* Backup metrics integration
|
|
* Incident intelligence
|
|
|
|
---
|
|
|
|
### Phase 2 - Security And Stability
|
|
|
|
Items:
|
|
|
|
* CrowdSec
|
|
* Fail2Ban upgrade
|
|
* Cloudflare rate limiting and WAF
|
|
|
|
Completed:
|
|
|
|
* Backup v5.3 automation
|
|
* Restore validation
|
|
* Sentry
|
|
|
|
---
|
|
|
|
### Phase 3 - Scale And Enterprise Services
|
|
|
|
Items:
|
|
|
|
* SonarQube
|
|
* Harbor Docker registry
|
|
* Backstage portal
|
|
|
|
Completed:
|
|
|
|
* Nextcloud
|
|
|
|
---
|
|
|
|
## Documentation Requirements
|
|
|
|
Each roadmap item should receive documentation before deployment:
|
|
|
|
* Service purpose
|
|
* Docker Compose location
|
|
* Data and backup paths
|
|
* Network attachments
|
|
* Public exposure policy
|
|
* Authentication model
|
|
* Secrets required
|
|
* Restore procedure
|
|
|
|
---
|
|
|
|
## Related Documentation
|
|
|
|
* docs/services.md
|
|
* docs/security.md
|
|
* docs/network.md
|
|
* docs/backups.md
|
|
* docs/monitoring.md
|
|
* docs/decisions.md
|