Roadmap

Synced read-only from /home/synnet/synvirt-platform/docs-internal/roadmap.md. Edit at the source, not here.

Roadmap

MVP goal: a visitor can understand SynVirt, see the product, download it, find documentation and get support without leaving the ecosystem — on one server, but architected to split across hosts without touching app code.

Attack order: Phase 0 → M0 → M1 → M2 → M3 → M4 → M5 → M6 → M7 → M8.

Phase 0 — Devbox ✅ done

Reproducible dev environment on Ubuntu Server (24.04 dev / 26.04 prod).

• devbox-bootstrap.sh (idempotent)
• compose.yaml + dev/prod overrides
• Multi-database Postgres init (per-service role + owner)
• Caddy tls internal for *.synvirt.test
• SOPS/age secret layout, Taskfile, monorepo skeleton
• Acceptance verified on the box 2026-06-28 (bootstrap, task up, CA trusted, 4 DBs present, sqlx migrate run)

M0 — Foundations ✅ done

Monorepo, design tokens, base UI (shadcn), i18n (en/es), dark/light, Storybook, Next.js 16 app scaffolded.

• Next.js 16 (App Router, Turbopack) scaffolded in apps/web; / (en) and /es prerender statically and serve through Caddy at synvirt.test
• Design tokens in @synvirt/ui/tokens.css (raw palette + shadcn-style semantic aliases), Tailwind v4 CSS-first theme in @synvirt/ui/theme.css (replaces the old packages/config Tailwind v3 preset)
• Base UI in @synvirt/ui: Button, Card, Badge (shadcn pattern: cva + radix Slot + cn); components.json ready for shadcn add
• i18n en/es via next-intl (localePrefix: as-needed, src/proxy.ts)
• Dark/light via next-themes (data-theme attribute, default dark)
• Storybook 10 (react-vite) in packages/ui with dark/light toolbar (task storybook)

M1 — Identity & SSO

Keycloak realm (synvirt-web, synvirt-portal-api, synvirt-discourse), OIDC login in Next.js, MFA + passkeys/WebAuthn, Google + Microsoft providers. Risk: test Keycloak↔Discourse SSO early.

M2 — Marketing site + CMS

Payload CMS embedded in web. Collections: Pages, BlogPosts, Releases, FAQs, CaseStudies, Banners, SecurityAdvisories (stub). Homepage + Product + Architecture + Pricing (preliminary) + Blog. ES/EN, dark/light, green Lighthouse.

2026-07-15 — CMS core pulled forward (the owner needs the content admin before M1): Payload 3.86 embedded in apps/web with local email/password auth — Keycloak SSO still lands in M1. en/es localization mirroring next-intl, users/media collections (media on local disk per ADR-0003), home global driving the landing with 60 s ISR, initial migration in apps/web/src/migrations/ and a seed from the static messages (pnpm payload run src/seed.ts). Admin at https://synvirt.mx/admin (SynVirt-branded: wordmark + brand-blue primary actions). Same day: cdn.synvirt.mx — Caddy serves apps/web/media directly (read-only bind mount, 7-day cache) and a Payload afterRead hook rewrites media URLs to CDN_URL; smoke test in apps/web/src/scripts/cdn-smoke.ts. Remaining M2 scope (full collections, marketing pages, blog) unchanged.

M3 — Portal API core

Axum + SQLx + OpenAPI (utoipa) → generates packages/api-client. Entities: Organizations, Users (Keycloak sub mirror), Subscriptions, Licenses, Downloads, SupportCases, AuditLog. JWT auth via Keycloak JWKS.

M4 — Customer Portal UI

Dashboard + 9 MVP modules (org, subscriptions, licenses, downloads, support, security, notifications). Soft warnings over hard restrictions.

M5 — Downloads & artifact integrity

S3-compatible storage returns here (pgsty/minio fork, Garage or cloud S3/R2 — see ADR-0003 amendment); signed URLs issued by portal-api after entitlement check. Per-artifact SHA-256, signature, size, build ID, channel, arch. Never serve binaries from the web server’s disk. Move Payload media from local disk to the same backend (@payloadcms/storage-s3).

M6 — Commerce (Stripe + Odoo)

Stripe Checkout + Billing; webhooks → entitlement + Odoo push (idempotent). SPEI/transfer + quote + PO manual flow. Pricing page wired to Stripe products.

M7 — Docs + Community + Status

Fumadocs (versioned: 1.0/, latest/, release-notes/). Discourse self-hosted (official discourse_docker, NOT in base compose) + DiscourseConnect SSO. Structured bug-report form → support case. status.synvirt.mx hosted separately.

M8 — Search · Analytics · SEO · Hardening · Launch

Meilisearch universal search + command palette. Privacy-friendly analytics (Plausible/Umami). SEO. Network segmentation verified, SOPS secrets, rate limit, WAF/Turnstile, verified backups, runbooks. Deploy on 10.10.26.4 via Cloudflare Tunnel → Caddy. Launch checklist.

Later (post-MVP)

• Phase 2: orgs, advanced license admin, offline activation, full support cases, HCL, Knowledge Base, security advisories, public roadmap, installs.
• Phase 3: partner portal, Academy/certifications, marketplace, Enterprise trials, opt-in telemetry, Trust Center, Lifecycle Matrix, Security Center.