diff --git a/README.md b/README.md
index 89a383b..d363b48 100644
--- a/README.md
+++ b/README.md
@@ -28,5 +28,13 @@ Repository structure:
 - **secrets/**  
   Age-encrypted secrets managed and deployed via agenix.
 
-- **var/**  
+- **var/**
   Shared constants and values used across the configuration.
+
+## TODO
+
+- **WireGuard key:** Manage `/var/secrets/wg.key` via agenix.
+- **Forgejo:** Provision the `hd` user (with email, admin flag) and SSH keys via a systemd service.
+- **Firefox sync server** (`host/roam/firefox-sync.nix`)**:** Containerize.
+- **systemd-resolved** (`mod/desktop/network.nix`)**:** Enable DoH.
+- **Remote builder** (`mod/build-machines.nix`)**:** declarative SSH jump server.
diff --git a/host/roam/services.nix b/host/roam/services.nix
index f10f2e0..a80c5ea 100644
--- a/host/roam/services.nix
+++ b/host/roam/services.nix
@@ -58,7 +58,7 @@
     };
 
     minecraft-server = {
-      enable = true;
+      enable = false; # TODO: whitelist
       package = pkgs.papermcServers.papermc-1_21_9;
       eula = true;
       declarative = true;