# Eternity Project TODO

- [x] Dockerized Flask publishing service with persistent storage.
- [x] Local accounts, administrator approval, and TOTP MFA.
- [x] QR-based MFA enrollment for iPhone and Android authenticators.
- [x] Email addresses, member password changes, and expiring password-reset links.
- [ ] Configure production SMTP credentials and verify outgoing email delivery. Run `python ./scripts/check-smtp.py`, then complete after the delivery test in [README.md](README.md) is received.
- [ ] Run `./scripts/rotate-admin.ps1` on Windows or `sh ./scripts/rotate-admin.sh` on Linux/macOS, then sign in as `admin` and scan the new MFA QR code to complete authenticator enrollment.
- [x] Add CSRF protection to all state-changing forms.
- [ ] Add automated database backups and test restoration.
- [ ] Configure TLS reverse proxy and production domain for `eternityproject.fi`.