Infrastructure tasks go unnoticed as long as everything works and nobody asks about them. Only when the server goes down or data is gone does the accusation come: When was the last backup actually made?
When the admin is busy (with other things)
Most teams have one: “the admin”. One person who is responsible for printers, laptops, VPN and software licenses all at once. Of course a colleague’s broken email sync takes priority. Redmine runs quietly in the background, and so does the update that has been overdue for months.
The problem: “it runs” does not mean “it is secure”, “it is up to date” or “it can be restored in an emergency”.
Security updates were not installed because there was never time for them. Backups run somehow, but nobody has tested whether they really work. And if customer projects or employee data are stored in Redmine, your company is obliged to prove that this data is protected. But “the admin takes a look now and then” is not a documented process.
Anyone who is fully occupied with operational tasks every day cannot run a professional server operation on the side. This is not a question of competence, but of capacity.
When custom developments become a (cost) trap
Another pattern makes the problem worse: custom developments.
Yes, Redmine can be customized, that is one of its advantages. Teams or agencies build individual extensions that deliver exactly what is needed. Paid once, works, done. That is how many decision makers think.
What is rarely taken into account is the ongoing maintenance:
- When Redmine is supposed to be updated, the extension suddenly stops working.
- Whoever originally built it may no longer be with the company, or the budget is not as loose as it was a year ago.
And this is where the real cost trap lies: The initial development was paid for, so it feels finished. Nobody has in mind that software needs continuous maintenance. With predictable consequences:
- The extension is not updated, everything stays at the old state.
- So does Redmine, no matter how many bug fixes or security updates have been released in the meantime.
Not always as a conscious decision, but because it is hard to justify spending money again when you have already paid. This is how systems freeze for years, and with them all unpatched security vulnerabilities.
What helps: clear responsibilities
These are two patterns we encounter regularly. Managed hosting does not solve every problem, but it creates exactly what is missing in both scenarios: clear responsibility.
We make sure that operation is monitored and that backups are created daily and stored encrypted. We know where they are, how to restore them in an emergency, and we take care of it promptly. It is less about replacing the admin than about taking over a task nobody really had in hand before.
Conclusion
Ask yourselves two questions:
- When did we last make a backup, and test a restore?
- When was Redmine last updated? Or are there blockers that have prevented it for a while?
The answers often say more than any risk analysis. And if the answer is “I don’t know” or “yes, we have reasons not to update”, it is a good time to change that.