2 changed files with 34 additions and 155 deletions
@@ -50,8 +50,15 @@
          "HACK",
          "NOTE",
          "XXX",
-          "DONE"
+          "DONE",
+          "[ ]",
+          "[x]"
        ],
+        "todo-tree.regex.regex": "(//|#|<!--|;|/\\*|^|^\\s*(-|\\d+.))\\s*($TAGS)",
+        "todo-tree.highlights.customHighlight": {
+          "[ ]": { "background": "#ff000080", "icon": "issue-opened" },
+          "[x]": { "background": "#00ff0080", "icon": "check" }
+        },
        "todo-tree.tree.showScanModeButton": true,
        "todo-tree.filtering.includeGlobs": [
          "**/docs/TASKS.md",
@@ -324,28 +324,12 @@ entstanden sind — nicht mehr getrennt pflegen, stattdessen die Issues aktuell
    ist oder Root Cause des Ausfalls isoliert wurde (Browser-Konsolen-Repro nötig).

 ### Database Hardening
- [ ] **External/Dedicated PostgreSQL Deployment**
-  - Option 1: CloudNativePG Operator (open-source, auf K3S)
-  - Option 2: Managed Hetzner Postgres
-  - Separate aus ESS matrix-stack embedded Postgres
-  - HA + Replication
-  - Est. Effort: 1–2 days
-  - Priority: **HIGH** (reliability)
+- [ ] **External/Dedizierte PostgreSQL-Migration** → [Issue #9](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/9)

- [ ] **Database Backup Strategy**
-  - Daily automated backups (PgBackRest oder velero)
-  - Off-site backup storage (S3 / Hetzner Storage Box)
-  - Monthly verified restores (test restore → verify data integrity)
-  - Backup + restore documentation
-  - Est. Effort: 2–3 days
-  - Priority: **CRITICAL** (disaster recovery)
-
- [ ] **Synapse Media PVC Backups**
-  - Separate backup pipeline für `/data/media_store` PVC
-  - Reason: Media oft >100GB, sollte nicht im DB-Backup sein
-  - Velero + Restic für block-level backup
-  - Est. Effort: 1 day
-  - Priority: **HIGH** (data preservation)
+(Database Backup Strategy und Synapse Media PVC Backups waren hier ursprünglich als eigene
+Punkte gelistet - beide erledigt und geschlossen, siehe [#6](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/6)
+und [#15](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/15), Details in
+[[00-TASKS]] Wiki bzw. Release v0.16.0.)

 ### Network Security
 - [x] **NetworkPolicies – K8s-Layer Segmentation** (2026-07-28, Closes #10)
@@ -372,78 +356,25 @@ entstanden sind — nicht mehr getrennt pflegen, stattdessen die Issues aktuell
  - `authentik-postgresql`'s Bitnami-Chart-Policy (Port 5432, quelloffen) bewusst nicht
    angefasst/dupliziert, da Helm-verwaltet.

- [ ] **Pod Security Admission (Restricted)**
-  - Apply to `matrix` & `authentik` namespaces
-  - Enforce: non-root, no privileged, read-only root fs
-  - Test: Ensure no chart breakage
-  - Est. Effort: 1 day
-  - Priority: **MEDIUM** (hardening)
+- [ ] **Pod Security Admission (Restricted)** → [Issue #16](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/16)

 ### Federation & Access Control
- [ ] **Federation-Allowlist oder Closed Federation**
-  - Decision: Which servers to federate with?
-  - If allowlist: explicit `federation_domain_whitelist`
-  - If closed: `allow_public_rooms_without_join_rules: false`
-  - Synapse config in `synapse-values.yaml`
-  - Est. Effort: 4 hours
-  - Priority: **MEDIUM** (security policy)
+- [ ] **Federation-Allowlist oder Closed Federation** → [Issue #17](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/17)

 ### Moderation & Anti-Abuse
- [ ] **Mjolnir/Draupnir Bot Deployment**
-  - Open-source moderation bot für Matrix
-  - Reason: Invitation-based, aber Federation kann Spam bringen
-  - Auto-ban known bad servers/users
-  - Spam-detection rules
-  - HelmChart oder custom Deployment
-  - Est. Effort: 1–2 days
-  - Priority: **MEDIUM** (ops safety)
-
- [ ] **Content Scanner for Media**
-  - matrix-content-scanner + ClamAV antivirus
-  - Scan uploaded media for malware
-  - Block suspicious files
-  - Est. Effort: 1–2 days
-  - Priority: **LOW–MEDIUM** (optional but good practice)
+- [ ] **Mjolnir/Draupnir Moderationsbot** → [Issue #18](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/18)
+- [ ] **Content Scanner für Media** → [Issue #19](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/19)

 ### Secrets Management
- [ ] **External-Secrets Operator oder SOPS für Flux**
-  - Current: SOPS with age encryption
-  - Consideration: External-Secrets for cloud-native (AWS Secrets Manager, Hetzner Vault, etc.)
-  - OR: Improve SOPS rotation strategy
-  - Decision needed: Keep SOPS or upgrade?
-  - Est. Effort: 2–3 days (if switching)
-  - Priority: **LOW** (current SOPS setup working)
+- [ ] **External-Secrets Operator vs. SOPS-Setup** → [Issue #20](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/20)

 ### Image & Dependency Management
- [ ] **Renovate / Dependabot Setup**
-  - Auto-update Helm Chart versions
-  - Auto-update Container Image Tags
-  - Monitor for security patches
-  - Est. Effort: 4 hours
-  - Priority: **MEDIUM** (maintenance)
-
- [ ] **Trivy Image Scanning**
-  - Scan images in Flux HelmReleases for CVEs
-  - Block deployment if critical CVE found
-  - CI/CD hook in git workflow
-  - Est. Effort: 8 hours
-  - Priority: **LOW–MEDIUM** (security posture)
-
- [ ] **Monitor ESS & Element Security Advisories**
-  - Subscribe to `element-hq` security mailing list
-  - Monitor `#matrix-community` security channels
-  - Auto-alerts on new CVEs/patches
-  - Est. Effort: Ongoing (low maintenance)
-  - Priority: **MEDIUM** (security awareness)
+- [ ] **Renovate/Dependabot Setup** → [Issue #21](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/21)
+- [ ] **Trivy Image Scanning** → [Issue #31](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/31)
+- [ ] **Security Advisory Monitoring (ESS/Element)** → [Issue #22](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/22)

 ### Container Security
- [ ] **Disable automountServiceAccountToken Everywhere**
-  - Audit all Deployments/StatefulSets
-  - Disable for: Synapse, ElementWeb, MAS, Postgres, Authentik (where not needed)
-  - Add `automountServiceAccountToken: false` to spec.template.spec
-  - Test: Ensure no breakage
-  - Est. Effort: 4 hours
-  - Priority: **MEDIUM** (least-privilege)
+- [ ] **automountServiceAccountToken deaktivieren wo nicht benötigt** → [Issue #23](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/23)

 ---

@@ -453,83 +384,24 @@ entstanden sind — nicht mehr getrennt pflegen, stattdessen die Issues aktuell
 - [x] **Hetzner Cloud Firewall** – Default-Deny inbound, siehe "Phase 7" oben. **Done.**
 - [x] **SSH Hardening** – Key-only, Root-Login disabled, Port 2248, siehe "Phase 7" oben. **Done.**

- [ ] **unattended-upgrades**
-  - Enable automatic security updates
-  - Configure: APT::Periodic::Update-Package-Lists "1";
-  - Configure: APT::Periodic::Unattended-Upgrade "1";
-  - Configure: APT::Periodic::AutocleanInterval "7";
-  - Est. Effort: 30 min
-  - Priority: **HIGH** (set & forget)
-
- [ ] **K3S API Security**
-  - Current: K3S API listening on :6443 on all interfaces (default)
-  - Hardening:
-    - Option 1: Firewall restrict :6443 to localhost only
-    - Option 2: K3S --bind-address + --advertise-address to WireGuard IP
-    - Option 3: kubectl access only via jumphost/bastion
-  - Est. Effort: 2 hours
-  - Priority: **HIGH** (API is high-value target)
-
- [ ] **auditd for File Integrity & Syscall Audit**
-  - Monitor: /etc, ~/.kube, /var/lib/rancher/k3s
-  - Audit rules für sensitive file changes
-  - Low overhead, good signal/noise ratio
-  - Output to syslog / centralized logging
-  - Est. Effort: 2 hours
-  - Priority: **MEDIUM** (forensics + compliance)
-
- [ ] **Kernel Hardening (sysctl)**
-  - Apply hardening recommendations from Lynis
-  - Key settings:
-    - kernel.kptr_restrict=2 (hide kernel pointers)
-    - kernel.dmesg_restrict=1 (restrict dmesg)
-    - net.ipv4.tcp_syncookies=1 (SYN flood protection)
-    - net.ipv4.conf.all.rp_filter=1 (reverse path filtering)
-    - net.ipv4.conf.all.send_redirects=0
-    - net.ipv6.conf.all.disable_ipv6=0 (or =1 if no IPv6 needed)
-  - Persist via /etc/sysctl.d/99-hardening.conf
-  - Est. Effort: 2 hours
-  - Priority: **MEDIUM** (defense in depth)
-
- [ ] **Lynis Security Baseline**
-  - Run `lynis audit system`
-  - Review recommendations
-  - Implement high-priority findings
-  - Aim for score >80
-  - Re-run quarterly
-  - Est. Effort: 4 hours (initial) + 1 hour quarterly
-  - Priority: **MEDIUM** (baseline verification)
+- [ ] **unattended-upgrades** → [Issue #24](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/24)
+- [ ] **K3s API Security Hardening** → [Issue #25](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/25)
+- [ ] **auditd (File Integrity & Syscall Audit)** → [Issue #26](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/26)
+- [ ] **Kernel Hardening (sysctl)** → [Issue #27](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/27)
+- [ ] **Lynis Security Baseline** → [Issue #28](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/28)

 ### Cluster Layer (K3S / Kubernetes)
- [ ] **CrowdSec Integration**
-  - Install CrowdSec agent on host
-  - Connect to CrowdSec Hub (commercial platform, free tier available)
-  - Feed auth.log, syslog → CrowdSec for attack detection
-  - Auto-block IPs via local firewall or Hetzner Firewall API
-  - Est. Effort: 4 hours
-  - Priority: **MEDIUM** (proactive threat response)
-
- [ ] **Falco Runtime Monitoring**
-  - Install Falco DaemonSet in K3S
-  - Monitor: Shell spawning in containers, suspicious syscalls, privilege escalation
-  - Output to Loki / syslog
-  - Alert on anomalies
-  - Est. Effort: 1 day
-  - Priority: **MEDIUM** (runtime detection)
+- [ ] **CrowdSec Integration** → [Issue #29](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/29)
+- [ ] **Falco Runtime Monitoring** → [Issue #30](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/issues/30)

 ---

-## 🎯 Meilensteine (Milestones)
+## 🎯 Versionierung

-| Meilenstein | Beschreibung | Status | ETA |
-|------------|-------------|--------|-----|
-| **M1: Basis-Setup** | K3S + Flux + ESS deployed | ✅ Done | - |
-| **M2: Core Matrix** | Themes, Scripts, Policies | ✅ Done | - |
-| **M3: WebRTC & Monitoring** | TURN + Alloy/Prometheus/Loki | ✅ Done | - |
-| **M4: Identity Provider** | Authentik Stage 1+2 (pending Stage 2) | 🔄 In Progress | ~1–2 days |
-| **M5: Production-Ready** | DB Backups, NetworkPolicies, Security Hardening | 📋 Backlog | ~2–3 weeks |
-| **M6: Advanced Features** | Element Call Fork, Content Scanner, Mjolnir | 📋 Backlog | ~4+ weeks |
-| **M7: Enterprise-Ready** | Full compliance (DSGVO), HA setup, Disaster Recovery | 🎯 Future | ~8+ weeks |
+Seit 2026-07-28 SemVer statt der alten m1-m7-Meilensteine - siehe
+[Releases](https://rohana.axion1337.de/sorb/axion1337.chat-gitops/releases) für die volle,
+detaillierte Historie (aktuell bis v0.17.0) und [[00-TASKS]] im Wiki für die Konvention
+(MINOR = neue Fähigkeit, PATCH = Fix/Tuning/Doku).

 ---