# MVP Checklist

## Planning

- [x] Confirm target environment: Linux only or mixed infrastructure
- [x] Confirm server access method: SSH, Docker API, or local agent
- [x] Confirm which services may be managed from the panel
- [x] Confirm MVP bot scope: notifications only or notifications plus commands
- [x] Confirm user roles and permission boundaries
- [x] Confirm where secrets will be stored

## Repository Setup

- [x] Create `backend/`
- [x] Create `frontend/`
- [x] Create `bot/`
- [x] Create `docs/`
- [x] Add `.env.example`
- [x] Add `docker-compose.yml`
- [x] Add top-level `README.md`

## Backend Foundation

- [x] Add FastAPI app entrypoint
- [x] Add configuration loader
- [x] Add structured logging
- [x] Add database session setup
- [x] Add migration setup
- [x] Add health endpoint
- [x] Add test framework setup

## Authentication and Roles

- [x] Create user model
- [x] Add password hashing
- [x] Add login endpoint
- [x] Add refresh token flow
- [x] Add current user endpoint
- [x] Add role checks for protected endpoints
- [x] Add bootstrap admin creation flow

## Server Management

- [x] Create server model
- [x] Add server CRUD endpoints
- [x] Add server connectivity check
- [x] Add server health endpoint
- [x] Add basic metrics collection
- [x] Add server list UI
- [x] Add server details UI

## Service Management

- [x] Define allowed service list model or config
- [x] Add service status endpoint
- [x] Add service start action
- [x] Add service stop action
- [x] Add service restart action
- [x] Route actions through worker or task queue
- [x] Add UI action buttons with loading and error states

## Logs and Audit

- [x] Add recent logs endpoint
- [x] Limit log output safely
- [x] Create audit log model
- [x] Record all control actions
- [x] Add audit list endpoint
- [x] Add audit list UI

## Telegram Integration

- [x] Create bot service skeleton
- [x] Add bot config via environment variables
- [x] Implement Telegram user linking
- [x] Send test notification
- [x] Add `/start` command
- [x] Add `/status` command
- [x] Add `/services` command
- [x] Add restricted `/restart` command
- [x] Log bot-triggered actions in audit trail

## Frontend

- [x] Add login page
- [x] Add dashboard page
- [x] Add servers page
- [x] Add server details page
- [x] Add services page
- [x] Add logs page
- [x] Add settings page
- [x] Add auth guard
- [x] Add API client layer
- [x] Add loading, empty, and error states

## Security

- [x] Store secrets in environment variables only
- [x] Avoid arbitrary shell command execution
- [x] Restrict actions to approved operations
- [x] Add audit logging for sensitive actions
- [x] Validate all input from UI and Telegram
- [x] Review token lifetime and session invalidation

## Deployment

- [x] Add development Docker Compose setup
- [x] Add production environment variable template
- [x] Add reverse proxy config
- [x] Add backend service definition
- [x] Add bot service definition
- [x] Document startup procedure
- [x] Document rollback procedure

## Testing and Validation

- [x] Add API tests for auth
- [x] Add API tests for server CRUD
- [x] Add API tests for service actions
- [x] Add API tests for authorization failures
- [x] Add smoke test for bot notification flow
- [x] Validate `docker compose config`
- [x] Run backend tests
- [x] Run frontend build

## Release Readiness

- [x] Setup documentation is complete
- [x] API documentation is complete enough for frontend work
- [x] Known limitations are documented
- [x] Admin onboarding steps are documented
- [x] Telegram setup steps are documented
- [x] MVP acceptance criteria are checked