v0.5.0 — Production Hardening

Fifth release of the infra repository: Production Hardening, end to end - container-level, documentation, and host-level.

Added

• docs/roadmap.md - single source of truth for phase-by-phase scope/status and roadmap revision history (previously duplicated inside project-specification.md), with a Guiding Principles section ("write once, deploy anywhere") and an explicit Out of Scope section (Kubernetes, Terraform, Ansible - deferred to v2.x)
• scripts/harden-host.sh - role-driven UFW firewall (management/app/agent, each with a different port set), Fail2ban (sshd + nginx-limit-req + nginx-botsearch jails), unattended-upgrades, and an opt-in-only --harden-ssh flag
• SSH is always allowed - including the current session's actual port, auto-detected - before any default-deny firewall policy, to avoid locking the operator out of a remote host

Changed

• Container-level hardening applied across all four stacks (docker/portainer/, docker/registry/, jenkins/, docker/app/): healthcheck-based depends_on (condition: service_healthy), stop_grace_period, resource limits, a restart-policy split (stateless unless-stopped/always vs. stateful/expensive-to-crash-loop on-failure:5), and ${VAR:?message} environment validation
• nginx/app.conf and jenkins/nginx.conf: rate limiting, a Permissions-Policy header, a starter Content-Security-Policy (app only - Jenkins manages its own), and file-based logging so Fail2ban has something to tail
• README.md and docs/project-specification.md no longer embed the roadmap inline - both point to docs/roadmap.md
• Roadmap scope expanded per an architecture change request: v0.6.0/v0.7.0/v0.9.0 all gained additional items - see docs/roadmap.md's Revision History

Notes

• harden-host.sh has not been run against a real host yet - --harden-ssh in particular should only be used after confirming key-based SSH access works, from a second terminal
• No custom Jenkins-login Fail2ban jail - no bundled filter exists for its log format, and one written without a running Jenkins to test against would be unreliable

What's next

v0.6.0 - Operations (backup.sh, restore.sh, update.sh, cleanup.sh, backup/restore verification, log rotation).

Full changelog: CHANGELOG.md