The Home’s own list

The listing in Milan was drawn up to decide who could be cut off. The Home drew the opposite list, its own, layer by layer, to find where it could be cut off and close the gaps it could. What follows gathers the move into boxes. A ticked box is a thing done. An empty box is a thing known and not yet done, which is worth more than a thing neither known nor done.

Two names

  • The public name kept on the city’s own registry, so the donors keep writing to it and standing orders name it

  • A second name at a separate registry and registrar, carrying the identity provider, logins and recovery routes

  • Nothing shared between the two registrars: two registries, two invoices, no bank or mailbox in common

  • DNSSEC on both names, a registry lock where offered, the DS records and the move sequence kept offline

The landlord

  • The single tenant split into separate providers, with no one landlord holding a key to the others

  • The grant read in full as a licence to occupy, and the region the tenant sat in confirmed

  • Each layer on its own contract, paid, administered and recovered on its own

Identity

  • An identity provider the Home runs itself, not a tenant of any of the landlords

  • The departed administrator’s account disabled and sessions revoked, a break-glass account in the safe, tested

  • A second factor on everyone, enforced centrally, with recovery through an outside mailbox and a hardware key

  • The three systems that stay outside it, Bestiary, Covenant and the Ledger, each on its own login

Mail

  • Mail at a German provider on its own servers, the four records in the Home’s own zone

  • The mail landlord’s own door kept, so it opens when the identity provider is down

  • The recovery mailbox at a fifth provider, on a domain that is not the Home’s

  • Forwarding blocked, DMARC at reject, the shared mailboxes owned

  • The campaign sender’s American underside reduced or replaced

Files

  • Files on a managed Nextcloud at a German host, the login belonging to the identity provider

  • Sharing off by default, public links forced to expire, federation off, no “Anyone” link possible

  • The export in plain files, with the Home’s own copy on the premises

  • Browser co-editing decided: an office server under the documents, or not

Chat

  • Chat at a Swiss provider on its own servers, the licences the Home issues and revokes

  • Phones the Home owns and can wipe, the medical notes kept in Bestiary and out of the chat

  • Threema OnPrem named as the self-hosted road out if the service stops

The roster

  • The volunteer roster rebuilt on the Home’s own Nextcloud, off a personal account

  • Resident summaries linked to Bestiary rather than copied, owned by the Home and not one person

  • The incident log restricted to the people responsible for it, the candid notes deleted

File transfer

  • Sending and receiving on the Home’s own file store, the links expiring because the store makes them

  • A pocket option at a Swiss provider for the harmless kind

  • A data processing agreement in front of any clinical export, or no export

The sector systems

  • The three sector vendors kept and counted, their agreements current and the dead accounts gone

  • The residents’ records in a lockable room on a supported operating system, named as the largest dependency kept

  • A resident system that is not Microsoft’s, grown off the nightly export

  • Covenant behind the identity provider through SAML, once the price is faced

  • The Bestiary and Ledger records reconciled by an interface, not by hand

The comms room

  • One machine, Linux on the metal, Windows shrunk to a single labelled virtual machine

  • Backups leaving the building by two roads that share nothing, a disk in the safe and a second European host

  • Endpoints on a Slovak product, the server of uncertain purpose imaged and recycled

The money

  • Recurring gifts on SEPA mandates at a Dutch institution, the card network reduced to first gifts

  • The client funds held in a foundation, the cash paths left alone as the most independent thing the Home owned

  • The four new bills read, and put to the funder as a line in the next application

Who can say no

  • Every provider’s contracting entity, jurisdiction, governing law, subprocessors and payment route on one table

  • The one datacentre company under four contracts named, every appeal reachable without the account it appeals for

  • The courts the testimony now sits under named, and the cover protected where a contract can and nowhere else

Nanny Ogg has never written a to-do list in her life. She keeps the whole of it in her head, in the order things are going to go wrong, and the order has not been wrong yet.