# Eternity Project TODO

- [x] Dockerized Flask publishing service with persistent storage.
- [x] Local accounts, administrator approval, and TOTP MFA.
- [x] QR-based MFA enrollment for iPhone and Android authenticators.
- [x] Email addresses, member password changes, and expiring password-reset links.
- [ ] Configure production SMTP credentials and verify outgoing email delivery. See the SMTP delivery steps in [README.md](README.md); complete after the test email is received.
- [ ] Run `./scripts/rotate-admin.ps1`, then sign in as `admin` and scan the new MFA QR code to complete authenticator enrollment.
- [x] Add CSRF protection to all state-changing forms.
- [ ] Add automated database backups and test restoration.
- [ ] Configure TLS reverse proxy and production domain for `eternityproject.fi`.