## Checklist trimestrielle — Pile opérateur (C1–C5)

### C1

- [ ] C1-E1 Inventaire Proxmox
- [ ] C1-E2 Santé Ceph + capacité
- [ ] C1-E3 Restore test (preuve)
- [ ] C1-E4 TrueNAS (si activé)

### C2

- [ ] C2-E1 Export OPNsense + matrice flux
- [ ] C2-E2 Test non-bypass / adjacent-only
- [ ] C2-E3 Inventaire PowerDNS + ΔLog
- [ ] C2-E4 WireGuard (pairs + logs + runbook)

### C3

- [ ] C3-E1 Export Keycloak + RBAC
- [ ] C3-E2 BPM “auditeur” (exports)
- [ ] C3-E3 Checks Icinga + historique
- [ ] C3-E4 Prometheus targets + Alertmanager rules
- [ ] C3-E5 Dashboards Grafana (exports)
- [ ] C3-E6 Loki (labels/rétention/requêtes)

### C4

- [ ] C4-E1 Règles Forgejo (PR/branches) + ΔLog
- [ ] C4-E2 Logs Forgejo Actions (CI)
- [ ] C4-E3 Harbor (RBAC/rétention/provenance)
- [ ] C4-E4 Vault (policies/audit/rotation)
- [ ] C4-E5 IaC validation (lint/plan attaché PR)

### C5

- [ ] C5-E1 Config NGINX + ModSecurity + TLS
- [ ] C5-E2 Logs NGINX (preuve médiation)
- [ ] C5-E3 FastAPI (OpenAPI/logs/admission/quotas)
- [ ] C5-E4 Unbound (ACL/logs)
- [ ] C5-E5 Runner IaC (logs apply + liens PR→exécution)