# Eternity Project TODO

- [x] Dockerized Flask publishing service with persistent storage.
- [x] Local accounts, administrator approval, and TOTP MFA.
- [x] QR-based MFA enrollment for iPhone and Android authenticators.
- [x] Email addresses, member password changes, and expiring password-reset links.
- [ ] Configure production SMTP credentials and verify outgoing email delivery.
- [ ] Change the initial `admin` password and enroll its authenticator.
- [ ] Add CSRF protection to all state-changing forms.
- [ ] Add automated database backups and test restoration.
- [ ] Configure TLS reverse proxy and production domain for `eternityproject.fi`.