(in no special order)

General:
- ipv6 support (besides frontend-backend apache connection)
  requires important changes at ERP5 level
- resilience
- make mariadb user accounts accept connections only from relevant IPs
  or make x509 mandatory (needs ZMySQLD*A support)
- make postfix log inside partition
- document postfix parameters (only once it actually works)

Monitoring:
- daily slow-query digest
  make percona toolkit available in mysql instance and decide how to send digest
- daily apachedex

Backups:
- flush binlogs independently from full backups (in addition to anyway flushing them on full backup creation)
- rotate tidstorage consistency points
- make mysql backup path an instance parameter
- make srv/backup/zodb the default value for a parameter (zodb{ 'backup_root': ...} or so) to have a single value to modify to relocate zodb backups of a partition
- make srv/backup/logrotate customisable (per partition, otherwise files will overwrite each other)
