Roadmap: per-host git identity, per-repo perms via LDAP service accounts

docs/roadmap.md

@@ -13,6 +13,7 @@
 - [ ] Sweep `/mnt/nas/home/*.retired/` after stability check.
 - [ ] Delete `/mnt/nas/home/` once empty.
 - [ ] Mohg inventory + migration.
+- [ ] Malenia (mac) re-onboard. NFS mount currently unreliable from malenia → otelcollector mac install deferred. Investigate NFS/SMB/AFP mount options or switch to a different sync mechanism.
 
 ## Phase 2 — CI
 
@@ -21,6 +22,7 @@
 - [ ] First end-to-end pipeline: push to `Charlie/ddclient` → webhook → redeploy on morgott.
 - [ ] Build pipelines on `amacocian/*` source repos to push images to gitea registry (replaces "build on laptop").
 - [ ] Per-stack `deploy.yaml` workflows in every `Charlie/<stack>`.
+- [ ] Multi-host matrix workflow for shared stacks (`otelcollector`, `portainer-agent`).
 
 ## Phase 3 — Automation
 
@@ -36,3 +38,32 @@
 - [ ] Rename `/mnt/nas/media-server/` → `/mnt/nas/media/` and update mediacompose `.env`.
 - [ ] Rename `/mnt/nas/ldap/` → `/mnt/nas/ldap-certs/`.
 - [ ] Move `/mnt/nas/portainer/data/` → `/mnt/nas/data/portainer/` (when portainer migrates).
+
+## Phase 5 — Cross-cutting concerns (backlog)
+
+These don't block earlier phases, but capture them now so they're not forgotten.
+
+### Centralization
+
+- [ ] **Centralize `deploy.sh`.** Every shared stack ships a copy of the same script (see [strategy.md → Shared stacks](strategy.md)). Options: a small repo `Charlie/charlie-tools` cloned to `/usr/local/share/charlie/` on every host, with `deploy.sh` invoked as a single host-installed binary. Stacks then just declare their compose layout; the host's `charlie-deploy` script picks the right files. Decide before the next "shared stack" arrives.
+- [ ] **Centralize shell setup.** `Charlie/shell` repo with `profile.d/`, `inputrc`, etc., cloned to `/usr/local/share/charlie-shell/` (or `/etc/profile.d/charlie.sh` sourcing a NAS path). Same delivery channel as `charlie-tools`.
+- [ ] **Centralize host-level scripts.** `sync-ca.sh`, future temp/storage metric collectors (after `server-mgmt-utils` is dismantled), maybe a `charlie-host-bootstrap` to handle SSSD / docker / mounts. Likely lives under `Charlie/charlie-tools` or a sibling.
+
+### Observability
+
+- [ ] **Grafana provisioning git-backed.** Was previously synced from github; that integration was removed when migrating off github. Restore via Gitea — either grafana's native git provisioner or a workflow that syncs `Charlie/grafana-dashboards` → grafana's `provisioning/dashboards/` directory on morgott. Dashboards become version-controlled assets.
+
+### Secrets
+
+- [ ] **Decide on secrets sourcing for runners + stacks.** Candidates: vaultwarden as source-of-truth + a runner-side fetch step that materialises `.env` per job, Gitea Actions secrets (per-repo), SOPS-encrypted-in-repo. Investigate before any deploy pipeline that needs to write a `.env`.
+
+### Identity & access
+
+- [ ] **Auto-mount user home folders on SSH connect.** Currently each user's `$HOME` is local to the host they SSH into. Want each user's home to be a NAS-backed share automounted on connect (NFS or autofs + LDAP user attribute). Should pair with the LDAP-backed SSSD setup (`Charlie/ldap`). Design before more users land.
+- [ ] **Per-host git identity.** Each host needs its own credential to talk to Gitea — currently we paste a PAT inline. Decide: per-host PAT stored in the host's keyring, host-keyed SSH key registered as a deploy key on each `Charlie/<stack>` (rotation pain), or one "host-fleet" service account in Gitea with org-scope read + per-stack write.
+- [ ] **Per-repo permissions via LDAP-backed service accounts.** Use `Charlie/ldap` to provision service accounts (e.g. `svc-runner-morgott`, `svc-deploy-mediacompose`) that Gitea recognises through OIDC. Per-repo `read` / `write` / `admin` roles map to LDAP groups. Replaces the current "everything pushes as `amacocian`" pattern. Required before runners go live so a compromised runner has bounded blast radius.
+
+### Cleanup
+
+- [ ] **Server-mgmt-utils.** Mostly dead. Extract the temp/storage metric scripts into either `Charlie/otelcollector/scripts/` (so otel can scrape them) or a new `Charlie/host-scripts` repo. Then archive the original.
+- [ ] **`plist/`** — classify and decide.