# TODO

Global backlog for bugabinga.net infrastructure.

## Personal site

- Decide apex / `www` DNS routing for `bugabinga.net`.
- Serve `sites/personal/` via Caddy once DNS is clear.
- Decide whether `site.bugabinga.net` remains browse root or becomes preview/staging.
- Archive or delete old GitHub `bugabinga/bugabinga.net` site repository after content is fully migrated.

## Authentication gateway

- Evaluate Authelia vs Authentik for protecting selected public services.
- Document which services should stay public vs require SSO.
- Decide identity backend, MFA requirements, bypass rules, and recovery process.
- Prototype Caddy integration before enabling globally.

## Simple secrets store

- Replace scattered `secrets.auto.tfvars`/manual host files with one tiny encrypted repo file.
- Prefer `age`/`sops`-style local encryption over Vault-class server infrastructure.
- Target flow: edit encrypted secrets locally → render generated files during deploy → never commit plaintext.
- Keep OpenTofu state secret exposure in mind; avoid passing app API keys through state once renderer exists.
- Document bootstrap/recovery: where private age key lives, backup method, rotation steps.

## Deployment API

- Spec: `.system/specs/BB-SPEC-5TQ2M8HD-singleton-service-deployment-api/index.md`.
- Build a host-local deployment service that owns enrolled Quadlet release activation, probation, and rollback.
- Fence infrastructure apply, `AutoUpdate`, and weekly GC away from enrolled units and retained images.
- Return the published manifest digest from Luci registry publishing so a job can deploy by digest.
- Enroll applications one by one; toad stays generic, with singleton image-digest updates per enrolled service.

## Nugu theming

- Investigate consistent Nugu theming across all supported services.
- Track per-service theming mechanism and persistence model.
- Avoid one-off manual UI edits; prefer config, volumes, or managed assets.

## n8n service

- Add n8n as managed Podman quadlet service.
- Decide public hostname and auth posture before exposure.
- Plan persistent volumes, backup needs, env/secrets, and update policy.
- Add Homepage card/widget if useful.

## Deployment churn

- Reduce noisy `null_resource` replacement from coarse trigger hashes.
- Split `scripts/local/klops.sh` into focused deploy scripts or hash per subcommand.
- Remove broad `filesha256("${path.module}/main.tf")` triggers from unrelated deploy resources.
- Use narrow triggers: WireGuard config/script, Homepage templates/script, quadlets/restart script, CI quadlets/CI scripts, site files/site script, Caddyfile/Caddy script.
- Goal: Caddy or one service change must not rerun WireGuard, CI, and site deploys.

## Repository update workflow

- Think through and document how this infrastructure repo should be updated safely.
- Cover dependency/provider/container update process.
- Cover secrets/state handling and rollback expectations.
- Cover how to import/migrate manually-created klops state into managed OpenTofu resources.
- Add routine commands/checklist for `tofu fmt`, `tofu validate`, `tofu plan`, and post-deploy smoke tests.