Security

Comes before Infrastructure deliberately — the first credential this project ever creates (the Infomaniak account itself) should already have somewhere real to live the moment it exists, not sit in a browser's password prompt until a later chapter gets around to Proton Pass.

Security architecture — the credential architecture this whole project rests on: infrastructure credentials, SSH keys, and maintenance service accounts, what each is actually authorized to do, and where the gaps are.

Proton Pass Setup — installing Proton Pass and its CLI, logging in, creating a vault, and the conventions every later credential in this walkthrough follows.

Backups — infrastructure backup is a deliberate gap; setting up service-level backups (Coolify → S3) is the actual answer.

Monitoring and response — what's actually watching for trouble (rate-limiting is done, log monitoring and file-integrity monitoring are still open gaps), and the decision made ahead of time for what happens if this box is ever suspected compromised.