Production-harden the stack for Hetzner deployment

[maximilianschmid]

Summary

Makes the same repo deployable to a Hetzner Cloud VPS (x86, 8 GB, e.g. CPX31) while keeping local dev unchanged. Dev keeps working via the auto-loaded docker-compose.override.yaml; prod runs with docker-compose.prod.yaml (selected via COMPOSE_FILE in .env on the server).

Traefik / TLS

• Let's Encrypt ACME (HTTP-01) in prod via traefik/dynamic-prod.yaml + resolver flags; mkcert .test setup moved to traefik/dynamic-dev.yaml
• Global entrypoint-level HTTP→HTTPS redirect (removes all per-site *-http routers)
• HSTS + security-headers middleware in prod
• Basic auth in front of /typo3 on all sites (EOL TYPO3/PHP versions) — matches only /typo3 and /typo3/..., not /typo3temp//typo3conf which serve frontend assets
• phpMyAdmin: no public route in prod, bound to 127.0.0.1:8081 (SSH tunnel)

Apache

• Default catch-all vhost now denies everything — previously its DocumentRoot was /var/www/html/ (the parent of ALL sites) with Options Indexes, i.e. a full directory listing for any unmatched Host header
• Real-domain ServerAlias entries so one vhost file serves dev + prod
• mod_remoteip restores real client IPs behind Traefik; log format uses %a
• -Indexes, ServerTokens Prod, ServerSignature Off

PHP / MySQL

• expose_php = Off, session.cookie_httponly = 1, FPM pools sized for 8 GB (max_children 10)
• MySQL healthcheck gates dependent services; prod raises InnoDB buffer pool to 1G via compose command override

Ops / secrets

• json-file log rotation (10m × 3) on every service
• backup/backup-mysql.sh: nightly per-DB dumps, 14-day retention (cron line in README)
• initdb.d/01-create-databases.sql untracked (contained plaintext passwords); .example template committed; typo3.htpasswd + ACME state gitignored. The previously committed DB passwords are burned and must be rotated on deploy (README covers it)
• README: full "Deploy to Hetzner" runbook (firewall, DNS cutover, LE staging-first, restore procedure)

Note: companion fixes live in wwwroot/ (gitignored site content, carried to prod via rsync): each site's .htaccess SSL redirect now checks X-Forwarded-Proto (was an infinite loop behind Traefik on real domains), and the TYPO3 env configs apply the Docker DB/proxy settings for real domains too (previously real domains hit dead Mittwald DB hosts → 500/503).

Test plan

• docker compose config validates for dev and prod file combinations
• Full local stack: all three sites 200 over HTTPS through Traefik (.test and real hostnames at the Apache layer)
• HTTP→HTTPS 301 via entrypoint redirect
• Unknown Host: Traefik 404; Apache default vhost 403 (no directory listing)
• phpMyAdmin 401 without credentials
• Apache logs show real client IP (mod_remoteip)
• Backup script dumps all DBs, gzip integrity verified
• ACME cert issuance — only testable on the server (staging CA first, per README)

🤖 Generated with Claude Code