Initial commit

README.md

@@ -1,2 +1,59 @@
 # server-config
 
+Core infrastructure stack for multiple independent web apps on one server.
+
+## Includes
+
+- Traefik reverse proxy with automatic TLS certificates (Let's Encrypt)
+- Shared PostgreSQL database
+- Shared Adminer instance behind Traefik + basic auth
+- Shared Docker network so app repositories can join this stack
+
+## Setup
+
+1. Copy `.env.dist` to `.env`.
+2. Set real domains and credentials in `.env`.
+3. Generate auth hashes with `htpasswd -nbB admin 'your-password'`.
+4. Escape every `$` in hashes as `$$` before putting them into `.env`.
+5. Start the stack:
+
+```bash
+docker compose up -d
+```
+
+On first initialization of the Postgres volume, the `POSTGRES_USER` from `.env` becomes the bootstrap superuser (default: `admin`).
+
+## For app repositories
+
+Each app should connect to the same external Docker network:
+
+```yaml
+networks:
+  web:
+    external: true
+    name: web
+```
+
+Use the shared Postgres host `postgres` on that network with credentials from this stack's `.env`.
+
+## Postgres note
+
+This stack uses the latest Postgres image behavior (v18+), so the volume is mounted at `/var/lib/postgresql`.
+
+## Create DB user per app
+
+Use the helper script to create (or update) a dedicated DB user and create a dedicated database:
+
+```bash
+./scripts/create-db-user.sh project1_db project1_user
+```
+
+Or provide your own password:
+
+```bash
+./scripts/create-db-user.sh project1_db project1_user "your-strong-password"
+```
+
+The script creates restricted app users (`NOSUPERUSER`, `NOCREATEDB`, `NOCREATEROLE`, `NOREPLICATION`) and limits default DB access by revoking `PUBLIC` access.
+
+Note: Postgres cannot natively block "Adminer UI login" for a user while still allowing that same user/password for app DB connections. If you need this hard enforcement, the next step is a custom Adminer plugin that only allows selected DB usernames (for example only `admin`).