Infrastructure
Known Gaps
Transparent register of infrastructure and operational gaps.
Known Gaps
Current gaps, planned work, and accepted staging limitations. No fake deadlines.
Gap register
| # | Gap | Status | Notes |
|---|---|---|---|
| 1 | Production application environment not deployed | OPEN | DNS records exist; no app stack |
| 2 | Mail VM not fully configured | OPEN | Network ready; no Stalwart |
| 3 | Stalwart mail server incomplete | PLANNED | Architectural decision made |
| 4 | PTR record incomplete | PLANNED | mail.getbytebite.co → 88.99.0.97 |
| 5 | SPF / DKIM / DMARC incomplete | PLANNED | Mail DNS partially configured |
| 6 | AWS SES production domain verification incomplete | PLANNED | App SES client scaffolded; production verify still open |
| 7 | Hetzner port 25 work potentially required | OPEN | Not verified |
| 8 | Scheduled automatic PostgreSQL restore drill | OPEN | Manual script verified; no systemd timer |
| 9 | Backup failure alerting | OPEN | Logs exist; no external notification |
| 10 | Off-host full infrastructure disaster recovery incomplete | OPEN | PostgreSQL DR verified; VM/host rebuild incomplete |
| 11 | Traefik configuration off-host backup | OPEN | Local snapshots only on APP VM |
| 12 | Production PostgreSQL backup policy | OPEN | Staging policy verified; production not deployed |
| 13 | Object storage not deployed (staging/production media) | OPEN | Local MinIO uploads wired; B2 used for DB backups only; staging/prod B2 media undeployed |
| 14 | Staging access protection (Traefik BasicAuth) | IMPLEMENTED | Enable via Dokploy STAGING_BASIC_AUTH_USERS |
| 15 | Dashboard dot-path SPA fallback (HTTP 200 for /.env, etc.) | OPEN | Security semantics issue |
| 16 | Unknown storefront tenant returns HTTP 200 instead of 404 | ACCEPTED FOR STAGING | Application/SEO hardening item |
| 17 | Centralized monitoring/alerting incomplete | OPEN | No uptime/infra metrics |
| 18 | Dokploy/Traefik DNS-01 wiring must survive upgrades | OPEN | Ops risk — see upgrade checklist |
| 19 | Production custom-domain TLS not implemented | PLANNED | Schema supports CUSTOM_DOMAIN |
| 20 | Production environment not validated | BLOCKED | Depends on production deployment |
| 21 | BYTEBITE-MAIL-01 specs unknown | UNKNOWN | VM ID, CPU, RAM, disk |
| 22 | Firewall rules not documented | UNKNOWN | Hetzner/Proxmox level |
| 23 | Cloudflare token source IP restriction | UNKNOWN | Optional hardening — may or may not be configured |
| 24 | Traefik API external accessibility | UNKNOWN | insecure: true in static config only |
| 25 | Root helper script for Traefik recreation | PLANNED | Not present in repository |
| 26 | Marketing landing page is a Coming Soon placeholder | PLANNED | ADR-022. apps/landing serves staging.getbytebite.co. Production hosts getbytebite.co and www.getbytebite.co wait for the production stack |
Completed items (2026-09-08)
| Item | Status |
|---|---|
| Staging PostgreSQL off-host backup (Restic → B2) | Implemented |
| Staging PostgreSQL off-host restore | Verified |
| Daily automated backup (systemd timer) | Implemented |
| Weekly retention / prune / integrity check | Implemented |
| Manual restore drill script | Verified |
Status definitions
| Status | Meaning |
|---|---|
| OPEN | Known issue with no resolution yet |
| PLANNED | Architectural decision made; not deployed |
| IMPLEMENTED | In place; may still require an env var or host step |
| ACCEPTED FOR STAGING | Known limitation acceptable in staging |
| BLOCKED | Cannot proceed until dependency is resolved |
| UNKNOWN | Cannot be established from repository or verified facts |
Production blockers
Production cannot go live until at minimum:
- Production application deployment on Dokploy
- Production PostgreSQL backup policy defined, implemented, and tested (staging backup exists but production policy is separate)
- Object storage for application media (Backblaze B2 per ADR-018)
- Mail infrastructure (SES for transactional; Stalwart if mailbox needed)
- Production TLS strategy (apex + custom domains)
- Monitoring and alerting (including backup failure alerting)
- Security hardening review (WAF, access controls, dot-path fixes)
BYTEBITE_DEPLOY_ENV=production(indexing enabled; landing headingComing Soon, Production)- No staging demo seeds in production database
See Production deployment for the full checklist.
Related
- Security — security-specific gaps
- Backups — backup architecture and limitations
- Environments — environment status
- Operations — maintenance procedures