docs: add merge priority order with security hardening as #1 priority

- Updated roadmap phase status (Phase 4 complete)
- Added merge priority table with PR #28 (security) at top
- Documented that security must merge before new services exposed
- Added deployment command reference

.planning/ROADMAP.md

@@ -13,7 +13,9 @@ None
 - ✅ **Phase 1: Foundation Setup** - Establish core NixOS configuration with flakes
 - ✅ **Phase 2: Docker Service Integration** - Integrate Docker Compose services
 - ✅ **Phase 3: AI Assistant Integration** - Enable AI-assisted infrastructure management
-- [ ] **Phase 4: Internet Access & MCP** - MCP server for web access
+- ✅ **Phase 4: Internet Access & MCP** - MCP server for web access
+- 🚨 **Security Hardening** - CRITICAL: Firewall, fail2ban, SSH hardening (PR #28)
+- [ ] **Phase 5: TAK Server** - Research, implementation, and validation
 
 
 ## Phase Details
@@ -133,8 +135,25 @@ Plans:
 
 ## Progress
 
+**Merge Priority Order** (CRITICAL - merge in this order):
+
+| Priority | PR | Description | Status | Notes |
+|----------|-----|-------------|--------|-------|
+| 🚨 1 | #28 | **Security hardening** (firewall, fail2ban, SSH) | Open | **MERGE FIRST** - protects all other services |
+| 2 | #22 | Matrix bridge dependency fix | Open | Blocks Hermes functionality |
+| 3 | #21 | Backup network creation fix | Open | Infrastructure fix |
+| 4 | #25 | Hermes voice GPU support | Open | Feature enhancement |
+| 5 | #24 | uConsole CM5 host | Open | New hardware support |
+| 6 | #23 | NixOS deployment infrastructure | Open | Deployment tooling |
+| 7 | #1 | AI worker restricted access | Open | Legacy PR (superseded by hardening) |
+
 **Execution Order:**
-Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7
+Phases execute in numeric order: 1 → 2 → 3 → 4 → Security → 5 → 6 → 7
+
+**Merge vs Phase Execution:**
+- PRs can merge independently (no strict phase ordering for merges)
+- **EXCEPTION:** Security hardening (#28) must merge before any new services are exposed
+- After security merge, deploy with: `nh os switch --flake .#lazyworkhorse`
 
 | Phase | Milestone | Plans Complete | Status | Completed |
 |-------|-----------|----------------|--------|-----------|

flake.nix

@@ -12,10 +12,6 @@
       url = "git+https://git.lix.systems/lix-project/lix?ref=main";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # uConsole CM5 hardware support
-    nixos-uconsole.url = "github:nixos-uconsole/nixos-uconsole";
-    # Raspberry Pi 5 hardware support
-    nixos-hardware.url = "github:nixos/nixos-hardware/master";
     self.submodules = true;
   };
 
@@ -83,20 +79,6 @@
               ./hosts/cyt-pi/hardware-configuration.nix
             ];
           };
-
-          uConsole = nixpkgs.lib.nixosSystem {
-            specialArgs = { inherit self keys paths inputs; };
-            modules = [
-              {
-                nixpkgs.overlays = overlays;
-                nixpkgs.config.allowUnfree = true;
-                nixpkgs.hostPlatform = "aarch64-linux";
-                nix.package = lix.packages."aarch64-linux".default;
-              }
-              ./hosts/uconsole/configuration.nix
-              ./hosts/uconsole/hardware-configuration.nix
-            ];
-          };
         };
         devShells.${system}.default = devShell;
       };

hosts/uconsole/configuration.nix

@@ -1,139 +0,0 @@
-{ config, lib, pkgs, paths, self, keys, inputs, ... }:
-
-{
-  # --- CORE HARDWARE (CM5 / RPi5) ---
-  imports = [
-    inputs.nixos-uconsole.nixosModules.uconsole
-    inputs.nixos-hardware.nixosModules.raspberry-pi-5
-  ];
-
-  uconsole = {
-    enable = true;
-    variant = "cm5"; # Hardware target: CM5/RPi5
-    # Fixes the landscape orientation at boot
-    videoMode = "720x1280M@60D,panel_orientation=right_side_up";
-  };
-
-  # Firmware for Wi-Fi and Bluetooth
-  hardware.enableRedistributableFirmware = true;
-  hardware.raspberry-pi."5".apply-overlays-dtmerge.enable = true;
-  
-  # Enable GPU acceleration (VideoCore VII)
-  hardware.graphics.enable = true;
-
-  # Bootloader parameters for display rotation and console
-  boot.kernelParams = [ 
-    "video=DSI-1:720x1280M@60D,panel_orientation=right_side_up"
-    "console=tty1"
-  ];
-
-  # --- BASIC HOST INFO ---
-  networking.hostName = "uConsole";
-  networking.networkmanager.enable = true;
-  time.timeZone = "America/Montreal";
-  i18n.defaultLocale = "en_CA.UTF-8";
-
-  # --- GPS DAEMON ---
-  services.gpsd = {
-    enable = true;
-    devices = [ "/dev/ttyAMA0" ]; # Default port for RPi5/CM5 GPS
-    nowait = true;
-  };
-
-  # --- USER CONFIGURATION ---
-  users.users.thierry = {
-    isNormalUser = true;
-    description = "Thierry";
-    extraGroups = [ 
-      "wheel"      # Sudo
-      "dialout"    # Access to serial/HAM rigs
-      "plugdev"    # Access to USB SDRs
-      "wireshark"  # Packet capture without root
-      "video"      # Hardware acceleration access
-      "networkmanager"
-    ];
-    openssh.authorizedKeys.keys = [
-      keys.users.gortium.main
-      keys.users.gortium.gitea
-    ];
-  };
-
-  # --- INTERFACE (WAYLAND/SWAY) ---
-  # Sway is recommended for the uConsole's low resources
-  programs.sway = {
-    enable = true;
-    extraOptions = [ "--unsupported-gpu" ]; # Often needed for RPi
-  };
-
-  # --- SOFTWARE TOOLKITS ---
-  environment.systemPackages = with pkgs; [
-    # Base Tools (for your Doom Emacs environment)
-    emacs-pgtk      # Emacs with Wayland support
-    git             # Required for Doom Emacs / Flakes
-    ripgrep         # Fast searching for Emacs/CLI
-    fd              # Better find for Emacs
-    htop            # Resource monitor
-    tmux            # Terminal multiplexer
-    neovim          # Alternative editor
-
-    # HAM RADIO (Digital Modes)
-    js8call         # Weak-signal keyboard messaging
-    wsjtx           # FT8, JT65, etc.
-    fldigi          # Digital modem (PSK, RTTY)
-    pat             # Winlink client (Use 'pat configure' after install)
-    direwolf        # Software TNC for APRS
-    chirp           # Radio programming
-    hamlib          # Rig control (rigctl)
-    trustedqsl      # LotW log signing
-
-    # SDR + RF ANALYSIS
-    sdrpp           # Modern SDR GUI (Best for uConsole)
-    gqrx            # Classic SDR receiver
-    rtl-sdr         # Drivers for RTL2832U
-    inspectrum      # Offline signal analysis
-    soapysdr-with-plugins # Hardware abstraction layer
-
-    # LORA, MESH & RETICULUM
-    meshtastic      # CLI tools for Meshtastic nodes
-    reticulum-network-stack # The RNS stack (rnsd, rnsh)
-    nomadnet        # Reticulum browser/messaging
-    lxmf            # Lightweight Mesh Exchange Protocol
-    sidechannel-rns # Visual UI for Reticulum communication
-
-    # HACKING & SECURITY (Kali-like suite)
-    nmap            # Port scanning
-    metasploit      # Exploitation framework
-    aircrack-ng     # Wi-Fi auditing
-    kismet          # Wireless sniffer (Essential for your Pi Zero project)
-    bettercap       # MITM and network attack tool
-    wireshark       # Protocol analyzer
-    burpsuite       # Web vulnerability scanner
-    hashcat         # Password recovery
-    john            # John the Ripper (password cracking)
-    sqlmap          # Automated SQL injection
-
-    # GPS & OFFLINE MAPPING
-    foxtrotgps      # Lightweight map viewer (Perfect for small screens)
-    viking          # GPS data editor and map viewer
-    gpsbabel        # GPS data conversion
-    marble          # KDE Virtual Globe (supports offline tiles)
-  ];
-
-  # Udev rules for SDR and Radio hardware access
-  services.udev.packages = [ 
-    pkgs.rtl-sdr 
-    pkgs.librtlsdr 
-  ];
-
-  # Enable Wireshark privilege separation
-  programs.wireshark.enable = true;
-
-  # Enable OpenSSH
-  services.openssh = {
-    enable = true;
-    settings.PermitRootLogin = "prohibit-password";
-  };
-
-  # System state version
-  system.stateVersion = "23.11";
-}

hosts/uconsole/hardware-configuration.nix

@@ -1,30 +0,0 @@
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "sdhci_pci" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  # uConsole CM5 specific filesystem (SD card boot)
-  fileSystems."/" =
-    { device = "/dev/disk/by-label/NIXOS_SD";
-      fsType = "ext4";
-      options = [ "noatime" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/FIRMWARE";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-
-  # uConsole CM5 is ARM64
-  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
-  hardware.enableRedistributableFirmware = true;
-}

lib/keys.nix

@@ -18,9 +18,5 @@
       gitea = "";
       bootstrap = "age1r796v2uldtspawyh863pks74sd2pwcan8j4e4pjzsvkmr3vjja9qpz5ste";
     };
-    # uConsole CM5 - key to be generated on first boot
-    uconsole = {
-      main = "";
-    };
   };
 }