# TODO / Backlog

## Rethink the tier model — decouple tier from business type
**Goal:** tiers should NOT be tied to a kind of business. Which "tier" (and whether a
client's site is self-hosted or runs on Google's free services) is a decision made
**between me and the client**, case by case — not something baked into a demo.

Implications to work through:
- [x] **Demos are stack-agnostic starters.** ~~Drop tier/stack labels and jargon (self-hosted,
  Cal.com, Google-Stack, "≈ 0 €") from the public-facing demos & chooser.~~ DONE 2026-06-25:
  chooser reworded; all three demo pages neutralised — demo bars now read "Beispielseite · So
  könnte Ihr Online-Auftritt aussehen", booking widgets relabelled to generic
  "Online-Terminbuchung"/"Sichere Buchung", Google-Kalender/Cal.com/self-hosted/Tier labels
  removed from rendered copy *and* HTML comments, demo booking dates now render on the current
  week via JS so nothing looks stale.
- [ ] After a client signs, **I decide hosting**: self-host the page on the homelab, or stand it
  up on the client's free Google account. The CRM already has `tier` + `stack_notes` columns
  to record that decision per client.
- [ ] Revisit the `Clients.tier` field semantics: keep A/B as an internal effort/price band, or
  replace with something hosting-agnostic (e.g. `hosting = google | selfhosted`, `plan = …`).
- [ ] Onboarding form + workflow currently ask for Tier A/B — realign once the model is settled.

## Onboard dashboard → manage Leads & Clients (CRUD) — DONE 2026-06-25
Built as a DB-first back-office (architecture pivot: **Postgres is the source of truth**, Sheets
is a one-way mirror — see `backoffice/` and the `smb-db-source-of-truth` memory). Live at
**onboard.mivanchenko.de/crm** behind the existing basic-auth.
- [x] **Read:** Leads & Clients tables, served by `smb-crm` straight from Postgres.
- [x] **Add:** "+ Neu" modal per entity; auto-IDs (C-#### / L-epoch), renewal auto-compute.
- [x] **Edit:** per-row ✎ modal, token-protected PATCH.
- [x] **Delete:** per-row 🗑 (token-protected), audit-logged — replaces the scratchpad cleanup.
- [x] Behind Caddy basic-auth; mutations gated by `CRM_API_TOKEN`; all changes audit-logged.
- [x] One-way **DB→Sheets mirror** keeps the Sheet overview current after every change.
- [x] **n8n ingest swap:** `lead-intake` & `onboarding` now POST into the DB API (not Sheets);
  Telegram notify unchanged. `renewal-reminder` still reads Sheets (fine — Sheets mirrors DB).

Follow-ups (not yet done):
- [ ] Extend CRUD UI beyond Leads/Clients (projects, bookings, invoices, activity) if useful.
  Dashboard (`backoffice/app/static/index.html`) still only has Leads/Clients tabs.
- [x] Daily backup of the `smb-db` Postgres volume — DONE: `deploy/backup/smb-db-backup.sh`
  (`pg_dump` + gzip, keeps 14 days, cron on the homelab).
- [ ] Make the DB→Sheets overwrite atomic (currently clear-then-write; brief mid-write window a
  reader could catch the cleared sheet — harmless for a human overview).

## Other
- [ ] Harden n8n auth: compose still has deprecated `N8N_BASIC_AUTH_*` with password `password`
  (legacy/ignored by modern n8n owner-login). Confirm the owner account is strong; remove the
  dead env.
- [ ] Orders: the pizzeria demo posts orders into the `Leads` tab via the lead-intake webhook as a
  stop-gap. Build a proper **Orders** flow + sheet tab (items, total, mode, status) when the
  order-management product is real.
- [x] Booking-sync workflow — DONE, but not as originally scoped: the plan to split
  Tier-B-Cal.com-webhook / Tier-A-GCal-poll was superseded by the tier-decoupling above. Instead,
  one shared **Easy!Appointments** instance handles booking for every client (`deploy/booking/`),
  wired via `n8n/booking-sync.json` (webhook → `POST /api/bookings` → Telegram), and
  `n8n/onboarding.json` auto-provisions each new client's EA service+provider.

## Done
- [x] 2026-06-25 — Latency fix (n8n executions 1–4 min → ~6 s; DNS + PostHog telemetry).
- [x] 2026-06-25 — Chooser reworded to client-friendly, jargon-free copy.
- [x] 2026-06-25 — Pizzeria demo with online ordering added.
- [x] 2026-06-25 — Barbershop "Google Kalender" dot-overlap styling fixed.
- [x] 2026-06-25 — All three demo pages neutralised (stack-agnostic, non-stale dates).
- [x] 2026-06-25 — DB-first back office: Postgres source of truth + Sheets mirror + CRUD + n8n
  ingest swap (lead-intake/onboarding → DB API). Live at onboard.mivanchenko.de/crm.
- [x] 2026-07-14 — Shared self-hosted booking: Easy!Appointments stack (`deploy/booking/`),
  auto-provisioning wired into the onboarding workflow, `booking-sync` workflow syncing bookings
  to the CRM.
- [x] 2026-07-14 — Per-client deploy tooling: `deploy/clients/` isolated-stack model +
  `new-client.sh` scaffolder; back-office updates.