ign8saas

Ignite a multi-tenant SaaS control plane on Hetzner Cloud. One VPS runs Caddy (TLS termination + wildcard certs via Cloudflare DNS-01), Vaultwarden (Bitwarden-compatible password vault) and wg-portal (WireGuard admin UI) — reachable at three subdomains of your parent zone.

Quickstart

cp .env.example .env    # fill in Hetzner + Cloudflare credentials
ign8saas up             # provision server + DNS + docker stack

What gets provisioned

For IGN8_DOMAIN=traeck.it you get:

Underneath, on a single Hetzner cax11 VPS in fsn1:

• Docker + Compose plugin (installed via get.docker.com)
• caddy (ghcr.io/caddybuilds/caddy-cloudflare:latest) — ports 80/443, wildcard certs via DNS-01
• vaultwarden (vaultwarden/server:latest) — signups disabled, invitations enabled
• wg-portal (ghcr.io/h44z/wg-portal:latest) — port 51820/udp exposed for WireGuard
• Hetzner firewall: 22 / 80 / 443 / 51820-udp only

State

Local state lives under .ign8saas/ (gitignored):

• .ign8saas/keys/ign8saas — SSH private key for server access
• .ign8saas/state.json — Hetzner IDs, IPv4
• .ign8saas/vaultwarden-init.json — Vaultwarden admin token + wg-portal admin creds (chmod 600, keep safe)

Status

This scaffold delivers the shared infra only. Per-customer onboarding (add-customer, del-customer) is stubbed — see CLAUDE.md for the design notes and the roadmap.

See CLAUDE.md for architecture details.