todo.md: add netns-related tasks

TODO.md

@@ -20,6 +20,8 @@
 - rsync to ssh target fails because of restrictive sandboxing
 - `/mnt/.servo_ftp` retries every 10s, endlessly, rather than doing a linear backoff
   - repro by `systemctl stop sftpgo` on servo, then watching `mnt-.servo_ftp.{mount,timer}` on desko
+- `ovpns` (and presumably `doof`) net namespaces aren't firewalled
+  - not great because things like `bitmagnet` expose unprotected admin APIs by default!
 
 ## REFACTORING:
 - fold hosts/modules/ into toplevel modules/
@@ -28,6 +30,10 @@
   - ~/dev becomes a link to ~/ref/cat/mine
 - fold hosts/common/home/ssh.nix -> hosts/common/users/colin.nix
 - don't hardcode IP addresses so much in servo
+- modules/netns: migrate `sane.netns.$NS.services = [ FOO ]` option to be `systemd.services.$FOO.sane.netns = NS`
+  - then change the ExecStartPre check to not ping `ipinfo.net` or whatever.
+    either port all of `sane-ip-check` to use a self-hosted reflector,
+    or settle for something like `test -eq "$(ip route get ...)" "$expectedGateway"`
 
 ### sops/secrets
 - user secrets could just use `gocryptfs`, like with ~/private?