Updates TODO

1 files changed, 101 insertions, 102 deletions

diff --git a/TODO.md b/TODO.md
index 75ad09c..2479933 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,59 +1,43 @@
 TODO
 ====
 
-* UseDns disable on sshd_config for vagrant nodes.
-* Support for recursive clones in `bin/mrconfig`.
-* Test!
-* Puppet 3.x support:
-  * http://docs.puppetlabs.com/puppet/latest/reference/environments.html
-  * https://github.com/mitchellh/vagrant/issues/3740
-  * https://search.disconnect.me/searchTerms/serp?search=b5af0f89-a8ba-4601-8deb-6b45c8032414
-  * https://ask.puppetlabs.com/question/10975/for-node-definitionclassification-what-is-the-successor-to-import-nodespp-now-that-import-is-deprecated/
+High priority
+-------------
 
-Puppet modules
---------------
-
-### Security
-
-- knock integration via https://github.com/juasiepo/knockd
-- apache:
-  - try libapache2-modsecurity.
-  - deploy https://git.immerda.ch/csp-report/
-  - disable other_vhosts_access.log
-- loginrecords: deploy module.
-- ssh:
-  - https://stribika.github.io/2015/01/04/secure-secure-shell.html
-  - access restrictions:
-    - denyhosts, but we don't want to log IPs.
-    - using shorewall: http://www.debian-administration.org/articles/250#comment_16
-    - alowed users / groups.
-- backup:
-  - support for $dombr and $dobios on backupninja::sys for servers and physical machines.
-  - sync-backups support for rsyncing from kvms / snapshots.
-- virtual: migrate to kvm/libvirt.
-- websites: freewvs.
-- puppet: masterless puppet:
+- puppet: masterless:
   - keyringer/gpg integration.
     - http://it-dev.web.cern.ch/book/cern-puppet-development-user-guide/puppet-development-work-flow-git/hiera-hierarchical-databa-1
     - https://github.com/compete/hiera_yamlgpg
     - https://github.com/crayfishx/hiera-gpg
+    - https://github.com/StackExchange/blackbox
+    - http://ww.telent.net/2014/2/10/keeping_secrets_in_public_with_puppet
+    - https://puppetlabs.com/blog/encrypt-your-data-using-hiera-eyaml
+    - https://packages.debian.org/jessie/hiera-eyaml
   - how to distribute keys outside the repo (i.e, avoiding all nodes to have all keys?):
     - add a monkeysphere auth subkey to every openpgp key used for backups.
     - make backupninja wrap around monkeysphere: http://web.monkeysphere.info/doc/user-ssh-advanced/
-  - how to manage storeconfigs?
   - http://current.workingdirectory.net/posts/2011/puppet-without-masters/
   - http://andrewbunday.co.uk/2012/12/04/masterless-puppet-wrapper/
   - http://semicomplete.com/presentations/puppet-at-loggly/puppet-at-loggly.pdf.html
   - https://github.com/jordansissel/puppet-examples/tree/master/masterless
-- drupal/wordpress:
-  - cronjob/cli: switch to site user
+- sshd:
+  - https://stribika.github.io/2015/01/04/secure-secure-shell.html
+  - enable ecdsa key
+  - ecdsa priority: alternatives:
+    - unsupport ecdsa in the server
+    - export ecdsa pubkeys
+    - manage client's /root/.ssh/config: `HostKeyAlgorithms ssh-rsa`
+    - force option via rsync/rdiff handlers
+- virtual: migrate to kvm/libvirt.
+- loginrecords: deploy module.
 
-### Fixes
+Medium priority
+---------------
 
-- nodo: support for prosody:
-  - https://github.com/dgoulet/prosody-otr
-  - http://prosody.im/doc/creating_accounts#importing_from_ejabberd
-  - config with good score at https://xmpp.net/index.php
+- backup:
+  - support for $dombr and $dobios on backupninja::sys for servers and physical machines.
+  - sync-backups support for rsyncing from kvms / snapshots.
+- nodo:
   - rename `nodo::base::vserver` and `nodo::role::vserver` to a more generic `virtual` suffix.
   - use prompt.sh from bash-prompt as a submodule.
 - general:
@@ -63,63 +47,15 @@ Puppet modules
     - php ("refactor" branch), remove E_STRICT from production's error_reporting.
     - apache2.
     - sudoers.
-- drupal:
-  - drupal_update: Do you really want to continue with the update process? (y/n):
-    Do you really want to continue with the update process? (y/n): Aborting. [cancel],
-    possibly related to https://www.drupal.org/node/443392
-- sshd/backup:
-  - ecdsa priority: alternatives:
-    - unsupport ecdsa in the server
-    - export ecdsa pubkeys
-    - manage client's /root/.ssh/config: `HostKeyAlgorithms ssh-rsa`
-    - force option via rsync/rdiff handlers
-  - enable ecdsa key
-- etherpad: `You need to set a sessionKey value in settings.json`.
-- websites:
-  - php / wordpress / wp-cli: composer installation and dependencies:
-    - http://getcomposer.org/doc/00-intro.md#installation-nix
-    - https://github.com/wp-cli/wp-cli/wiki/Alternative-Install-Methods
-    - suhosin needs `suhosin.executor.include.whitelist = phar` on `/etc/php5/cli/conf.d/suhosin.ini`.
-  - make rails optional on websites::hosting
-- puppet:
-  - puppetlast.
-  - bug report: debian wheezy puppetmaster-passenger: not honoring certname / envvars LANG issue.
-  - bug report: debian wheezy puppet-common: needs the following patch: http://projects.puppetlabs.com/issues/10963
 - backup: `sync-media-iterate [volume]`.
 - mail:
-  - support for [preventing SPAM connections with bird](http://www.debian-administration.org/article/715/Preventing_SPAM_connections_with_bird.).
-  - use ssl::dhparams, move to 2048 bit and use the standard file names and paths.
+  - use ssl::dhparams, move to 2048 bit and use the standard file names and paths:
     - [Feature #4012: postfix: ship 2048bit dh parameters - Platform - LEAP Issue Tracker](https://leap.se/code/issues/4012)
-  - schleuder: manage `/etc/schleuder/schleuder.conf`, using `superadminaddr: root` or other recipient, to avoid mails
-    sent as `root@localhost`.
-  - deploy https://git.autistici.org/ale/smtp-fp/tree/master
-           https://github.com/EFForg/starttls-everywhere
-  - deploy https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration#Configuration_server_at_ISP
-           https://git-ipuppet.immerda.ch/module-apache/commit/?id=058dbb366b96cae1f8fb0def65f73a698f1c375d
-           https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577616
 
-### Features
+Low priority
+------------
 
-- git:
-  - gitweb clean urls
-  - email notifications
-    - https://packages.debian.org/jessie/git-notifier
-    - https://github.com/mhagger/git-multimail
-    - using OpenPGP?
-- support for http/https proxy inside web nodes
-  - encrypted ssl keys: http://support.f5.com/kb/en-us/solutions/public/11000/400/sol11440.html
-  - make all apache sites listen to 8080
-- git: gitolite:
-  - /root/.config/git/config permission denied ikiwiki issue:
-    - http://www.redmine.org/issues/13631
-    - https://answers.atlassian.com/questions/112982/permission-denied-errors-post-upgrade-to-stash-2
-    - https://bugs.gentoo.org/show_bug.cgi?id=460370
-    - http://rtime.felk.cvut.cz/~sojka/blog/using-ikiwiki-with-gitolite/
-    - related to ikiwiki's post-update hooks which is not getting the $HOME env correctly
-  - [monkeysphere integration](http://gitolite.com/gitolite/g2/monkeysphere.html).
-- mail: mlmmj:
-  - lists with hyphens are not working when mails are sent directly, but work when sent to an alias.
-  - `mail::mlmmj::domain` needs updating or additional domains should be added into `relay_domains`.
+* merge, review, pull requests for all modules.
 - bind: nsupdate / dynamic dns:
   - http://linux.yyz.us/nsupdate/
   - http://linux.yyz.us/dns/ddns-server.html
@@ -127,9 +63,6 @@ Puppet modules
   - http://www.rtfm-sarl.ch/articles/using-nsupdate.html
   - https://github.com/skx/dhcp.io/
 - munin: lvm monitoring.
-- nagios: snmp, nrpe, nsca
-  - http://nagios.sourceforge.net/docs/3_0/addons.html
-  - http://www.math.wisc.edu/~jheim/snmp/
 - pyroscope: torrent workflow: torrent-maker, magnet2torrent and torrent-reseed:
   - http://wiki.rtorrent.org/MagnetUri
   - http://dan.folkes.me/2012/04/19/converting-a-magnet-link-into-a-torrent/
@@ -139,14 +72,80 @@ Puppet modules
   - http://wiki.rtorrent.org/MagnetUri
   - https://github.com/rakshasa/rtorrent/issues/212
   - saving/restoring `.meta` and `~/rtorrent/.session` files.
-- onion:
-  - support for existing hidden service key, generated with tools like https://github.com/katmagic/Shallot
-  - load balancing: http://archives.seul.org/tor/relays/Apr-2011/msg00022.html
+
+- support for http/https proxy inside web nodes
+  - encrypted ssl keys: http://support.f5.com/kb/en-us/solutions/public/11000/400/sol11440.html
+  - make all apache sites listen to 8080
+- git:
+  - gitweb clean urls
+  - email notifications
+    - https://packages.debian.org/jessie/git-notifier
+    - https://github.com/mhagger/git-multimail
+    - using OpenPGP?
 - nodo:
   - decrease http://www.cups.org/doc-1.1/sam.html#Timeout on cupds.conf from laptops that use remote printers set on client.conf
 - syslog-ng: use conf.d
-
-Repo management
----------------
-
-- merge, review, pull requests for all modules.
+- etherpad: `You need to set a sessionKey value in settings.json`.
+- knock integration via https://github.com/juasiepo/knockd
+- apache:
+  - try libapache2-modsecurity.
+  - deploy https://git.immerda.ch/csp-report/
+  - disable other_vhosts_access.log
+- onion:
+  - support for existing hidden service key, generated with tools like https://github.com/katmagic/Shallot
+  - load balancing: http://archives.seul.org/tor/relays/Apr-2011/msg00022.html
+- nagios: snmp, nrpe, nsca
+  - http://nagios.sourceforge.net/docs/3_0/addons.html
+  - http://www.math.wisc.edu/~jheim/snmp/
+- ssh access restrictions:
+  - denyhosts, but we don't want to log IPs.
+  - using shorewall: http://www.debian-administration.org/articles/250#comment_16
+    - alowed users / groups.
+- websites: freewvs.
+- puppet:
+  - puppetlast.
+  - bug report: debian wheezy puppetmaster-passenger: not honoring certname / envvars LANG issue.
+  - bug report: debian wheezy puppet-common: needs the following patch: http://projects.puppetlabs.com/issues/10963
+- mail: mlmmj:
+  - lists with hyphens are not working when mails are sent directly, but work when sent to an alias.
+  - `mail::mlmmj::domain` needs updating or additional domains should be added into `relay_domains`.
+- drupal/wordpress:
+  - cronjob/cli: switch to site user
+  - drupal_update: Do you really want to continue with the update process? (y/n):
+    Do you really want to continue with the update process? (y/n): Aborting. [cancel],
+    possibly related to https://www.drupal.org/node/443392
+- php / wordpress / wp-cli: composer installation and dependencies:
+  - http://getcomposer.org/doc/00-intro.md#installation-nix
+  - https://github.com/wp-cli/wp-cli/wiki/Alternative-Install-Methods
+  - suhosin needs `suhosin.executor.include.whitelist = phar` on `/etc/php5/cli/conf.d/suhosin.ini`.
+- nodo: support for prosody:
+  - https://github.com/dgoulet/prosody-otr
+  - http://prosody.im/doc/creating_accounts#importing_from_ejabberd
+  - config with good score at https://xmpp.net/index.php
+- websites:
+  - make rails, moin, trac, etc optional on websites::hosting
+- git: gitolite:
+  - /root/.config/git/config permission denied ikiwiki issue:
+    - http://www.redmine.org/issues/13631
+    - https://answers.atlassian.com/questions/112982/permission-denied-errors-post-upgrade-to-stash-2
+    - https://bugs.gentoo.org/show_bug.cgi?id=460370
+    - http://rtime.felk.cvut.cz/~sojka/blog/using-ikiwiki-with-gitolite/
+    - related to ikiwiki's post-update hooks which is not getting the $HOME env correctly
+  - [monkeysphere integration](http://gitolite.com/gitolite/g2/monkeysphere.html).
+- mail:
+  - support for [preventing SPAM connections with bird](http://www.debian-administration.org/article/715/Preventing_SPAM_connections_with_bird.).
+  - schleuder: manage `/etc/schleuder/schleuder.conf`, using `superadminaddr: root` or other recipient, to avoid mails
+    sent as `root@localhost`.
+  - deploy https://git.autistici.org/ale/smtp-fp/tree/master
+           https://github.com/EFForg/starttls-everywhere
+  - deploy https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration#Configuration_server_at_ISP
+           https://git-ipuppet.immerda.ch/module-apache/commit/?id=058dbb366b96cae1f8fb0def65f73a698f1c375d
+           https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577616
+  - support for [preventing SPAM connections with bird](http://www.debian-administration.org/article/715/Preventing_SPAM_connections_with_bird.).
+  - schleuder: manage `/etc/schleuder/schleuder.conf`, using `superadminaddr: root` or other recipient, to avoid mails
+    sent as `root@localhost`.
+  - deploy https://git.autistici.org/ale/smtp-fp/tree/master
+           https://github.com/EFForg/starttls-everywhere
+  - deploy https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration#Configuration_server_at_ISP
+           https://git-ipuppet.immerda.ch/module-apache/commit/?id=058dbb366b96cae1f8fb0def65f73a698f1c375d
+           https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577616