some discussion notes on the project

service/crm.md

@@ -288,15 +288,10 @@ infrastructure. It can also be used to perform an audit on the current implement
 
 ## Overview
 
-<!-- describe the overall project. should include a link to a ticket -->
-<!-- that has a launch checklist -->
-
 <!-- if this is an old project being documented, summarize the known -->
 <!-- issues with the project. to quote the "audit procedure":
 
- 5. When was the last security review done on the project? What was
-    the outcome? Are there any security issues currently? Should it
-    have another security review?
+TODO:
 
  6. When was the last risk assessment done? Something that would cover
     risks from the data stored, the access required, etc.
@@ -309,6 +304,30 @@ infrastructure. It can also be used to perform an audit on the current implement
 
 -->
 
+The CiviCRM deployment is complex and feels a bit brittle. The
+separation between the CiviCRM backend and the middleware API evolved
+from an initial strict, two-server setup, into the current three-parts
+component after the static site frontend was added around 2020. The
+original two-server separation was performed out of a concern for
+security: we were worried about exposing CiviCRM to the public,
+because we felt the attack surface of both Drupal and CiviCRM was too
+wide to be reasonably defended against a determined attacker.
+
+The downside is, obviously, a lot of complexity, which also makes the
+service more fragile. The Redis monitoring, for example, was added
+after we discovered the `ipsec` tunnel would sometimes fail, which
+would completely break donations.
+
+Obviously, if either the donation middleware or CiviCRM fails,
+donations go down as well, so we have actually two single point of
+failures in that design.
+
+A security review should probably be performed to make sure React,
+Drupal, its modules, CiviCRM, and other dependencies, are all up to
+date. Other components like Apache, Redis, or MariaDB are managed
+through Debian package, and supported by the Debian security team, so
+should be fairly up to date, in terms of security issues.
+
 TODO: clarify which versions of CiviCRM, Drupal, Yarn, NVM, PHP,
 Redis, and who knows what else are deployed, and whether it matters.