Infrastructure
Known Gaps
Transparent register of infrastructure and operational gaps.
Known Gaps
Current gaps, planned work, and accepted staging limitations. No fake deadlines.
Gap register
| # | Gap | Status | Notes |
|---|---|---|---|
| 1 | Production application environment not deployed | OPEN | DNS records exist; no app stack |
| 2 | Mail VM not fully configured | OPEN | Network ready; no Stalwart |
| 3 | Stalwart mail server incomplete | PLANNED | Architectural decision made |
| 4 | PTR record incomplete | PLANNED | mail.getbytebite.co → 88.99.0.97 |
| 5 | SPF / DKIM / DMARC incomplete | PLANNED | Mail DNS partially configured |
| 6 | AWS SES production setup incomplete | PLANNED | Placeholders in .env.example only |
| 7 | Hetzner port 25 work potentially required | OPEN | Not verified |
| 8 | Off-host PostgreSQL backup/restore not established | OPEN | Critical for production |
| 9 | Off-host full infrastructure disaster recovery incomplete | OPEN | Only local Traefik snapshots |
| 10 | Object storage not deployed (staging/production) | OPEN | MinIO local only |
| 11 | Staging access protection not implemented | OPEN | Cloudflare Access or BasicAuth considered |
| 12 | Dashboard dot-path SPA fallback (HTTP 200 for /.env, etc.) | OPEN | Security semantics issue |
| 13 | Unknown storefront tenant returns HTTP 200 instead of 404 | ACCEPTED FOR STAGING | Application/SEO hardening item |
| 14 | Centralized monitoring/alerting incomplete | OPEN | No uptime/infra metrics |
| 15 | Dokploy/Traefik DNS-01 wiring must survive upgrades | OPEN | Ops risk — see upgrade checklist |
| 16 | Production custom-domain TLS not implemented | PLANNED | Schema supports CUSTOM_DOMAIN |
| 17 | Production environment not validated | BLOCKED | Depends on production deployment |
| 18 | BYTEBITE-MAIL-01 specs unknown | UNKNOWN | VM ID, CPU, RAM, disk |
| 19 | Firewall rules not documented | UNKNOWN | Hetzner/Proxmox level |
| 20 | Dokploy automated PostgreSQL backups | UNKNOWN | Not verified |
| 21 | Cloudflare token source IP restriction | UNKNOWN | Optional hardening — may or may not be configured |
| 22 | Traefik API external accessibility | UNKNOWN | insecure: true in static config only |
| 23 | Root helper script for Traefik recreation | PLANNED | Not present in repository |
Status definitions
| Status | Meaning |
|---|---|
| OPEN | Known issue with no resolution yet |
| PLANNED | Architectural decision made; not deployed |
| ACCEPTED FOR STAGING | Known limitation acceptable in staging |
| BLOCKED | Cannot proceed until dependency is resolved |
| UNKNOWN | Cannot be established from repository or verified facts |
Production blockers
Production cannot go live until at minimum:
- Production application deployment on Dokploy
- Off-host PostgreSQL backup and restore strategy
- Object storage (Backblaze B2 per ADR-018)
- Mail infrastructure (SES for transactional; Stalwart if mailbox needed)
- Production TLS strategy (apex + custom domains)
- Monitoring and alerting
- Security hardening review (WAF, access controls, dot-path fixes)
BYTEBITE_DEPLOY_ENVunset (indexing enabled)- No staging demo seeds in production database
See Production deployment for the full checklist.
Related
- Security — security-specific gaps
- Backups — backup limitations
- Environments — environment status
- Operations — maintenance procedures