chore(ops): harden deployment and runtime setup

2026-07-03 22:59:08 +02:00 · 2026-07-03 22:59:08 +02:00 · c35bd5877e
commit c35bd5877e
parent 1d7e7c41c9
30 changed files with 534 additions and 61 deletions
--- a/.DS_Store
+++ b/.DS_Store
--- a/.dockerignore
+++ b/.dockerignore
@ -8,3 +8,6 @@ README.md
 data/*.json
 public/uploads/images/*
 !public/uploads/images/.gitkeep
+*.tmp
+*.temp
+.DS_Store
--- a/.env.example
+++ b/.env.example
@ -1,11 +1,27 @@
-NEXT_PUBLIC_SITE_URL=http://localhost:3010
+# Public base URL used for canonical URLs, sitemap, robots.txt and absolute metadata.
+# Local example: http://localhost:3010
+# Production example: https://funktechnik-schubert.de
+NEXT_PUBLIC_SITE_URL=

-# Admin Foundation
-ADMIN_EMAIL=admin@funktechnik-schubert.local
-ADMIN_PASSWORD=change-me
-ADMIN_SESSION_SECRET=change-me-with-a-long-random-secret
+# Admin login email address. Required for /admin.
+ADMIN_EMAIL=
+
+# Admin login password. Required for /admin.
+# Use a long unique password and never commit a real value.
+ADMIN_PASSWORD=
+
+# Secret for signing the HttpOnly admin session cookie. Required.
+# Use a long random value, for example generated by: openssl rand -base64 48
+ADMIN_SESSION_SECRET=
+
+# Set to true in production behind HTTPS so admin cookies are Secure.
+# Use false only for local HTTP development.
 AUTH_COOKIE_SECURE=false

-# Optional spaetere Integration. Nicht im Browser verwenden.
+# Optional future server-side Olympus intake endpoint.
+# Leave empty until the Olympus integration is explicitly implemented.
 OLYMPUS_INTAKE_API_URL=
+
+# Optional future server-side Olympus intake token.
+# Leave empty until the Olympus integration is explicitly implemented.
 OLYMPUS_INTAKE_API_TOKEN=
--- a/.gitignore
+++ b/.gitignore
@ -5,9 +5,13 @@ dist
 .env
 .env.local
 npm-debug.log*
-data/*.json
+data/contact-inquiries.json
+data/repair-inquiries.json
+data/site-settings.json
+data/smtp-settings.json
 public/uploads/images/*
 !public/uploads/.gitkeep
 !public/uploads/images/.gitkeep
-data/
 .DS_Store
+*.tmp
+*.temp
--- a/16
+++ b/16
@ -14,16 +14,22 @@ FROM node:22-alpine AS runner
 WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
+ENV NEXT_PUBLIC_APP_VERSION=0.2.2
+ENV DOCKER_ENV=true
+ENV PORT=3010

 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs

-COPY --from=builder /app/public ./public
-COPY --from=builder /app/.next/standalone ./
-COPY --from=builder /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/scripts/runtime-start.js ./runtime-start.js
+
+RUN mkdir -p /app/data /app/public/uploads/images /app/.next/cache \
+  && chown -R nextjs:nodejs /app/data /app/public/uploads /app/.next/cache

 USER nextjs
 EXPOSE 3010
-ENV PORT=3010

-CMD ["node", "server.js"]
+CMD ["node", "runtime-start.js"]
--- a/README.md
+++ b/README.md
@ -13,6 +13,8 @@ Eigenständige öffentliche Firmenwebsite für Funktechnik Schubert. Dieses Proj
 - Nginx/Reverse-Proxy-fähig
 - SEO Metadata, Sitemap und robots.txt

+Version: `0.2.2`
+
 ## Seiten

 - `/` Startseite
@ -38,6 +40,7 @@ Eigenständige öffentliche Firmenwebsite für Funktechnik Schubert. Dieses Proj

 ```bash
 npm install
+cp .env.example .env
 npm run dev
 ```

@ -47,6 +50,14 @@ Die Website läuft lokal unter:
 http://localhost:3010
 ```

+Für den Admin-Bereich müssen in `.env` mindestens gesetzt sein:
+
+```text
+ADMIN_EMAIL
+ADMIN_PASSWORD
+ADMIN_SESSION_SECRET
+```
+
 ## Checks

 ```bash
@ -73,6 +84,14 @@ Port:
 3010:3010
 ```

+Die Runtime-Daten werden über Docker-Volumes gespeichert:
+
+- `funktechnik-data` → `/app/data`
+- `funktechnik-uploads` → `/app/public/uploads/images`
+- `funktechnik-next-cache` → `/app/.next/cache`
+
+Dadurch sind keine manuellen `chmod`- oder `chown`-Befehle notwendig.
+
 ## Umgebung

 `.env.example` kopieren:
@ -83,13 +102,13 @@ cp .env.example .env

 Variablen:

- `NEXT_PUBLIC_SITE_URL`
- `ADMIN_EMAIL`
- `ADMIN_PASSWORD`
- `ADMIN_SESSION_SECRET`
- `AUTH_COOKIE_SECURE`
- `OLYMPUS_INTAKE_API_URL`
- `OLYMPUS_INTAKE_API_TOKEN`
+- `NEXT_PUBLIC_SITE_URL`: öffentliche Basis-URL für SEO, Sitemap und Metadaten
+- `ADMIN_EMAIL`: Admin-Login E-Mail
+- `ADMIN_PASSWORD`: Admin-Login Passwort
+- `ADMIN_SESSION_SECRET`: langer Zufallswert zum Signieren der Admin-Session
+- `AUTH_COOKIE_SECURE`: `true` in Produktion mit HTTPS, lokal `false`
+- `OLYMPUS_INTAKE_API_URL`: vorbereitet für spätere serverseitige Olympus-Anbindung
+- `OLYMPUS_INTAKE_API_TOKEN`: vorbereitet für spätere serverseitige Olympus-Anbindung

 Die Olympus-Variablen sind nur für eine spätere serverseitige Integration vorbereitet. Sie werden nicht im Browser verwendet.

@ -106,6 +125,7 @@ Für lokale Entwicklung kann `AUTH_COOKIE_SECURE=false` bleiben. Produktiv muss
 - `POST /api/admin/settings`
 - `POST /api/admin/smtp`
 - `GET/POST /api/admin/media`
+- `GET /api/health`

 Aktuell validieren die Routen serverseitig, geben klare JSON-Antworten zurück und schreiben nur technische Metadaten in Server-Logs. Es werden keine Nachrichteninhalte oder Tokens geloggt. Kontakt- und Reparaturanfragen werden lokal unter `data/*.json` gespeichert und nicht versioniert.

@ -127,6 +147,97 @@ Funktionen:

 SMTP-Versand, Publishing von Website-Inhalten und Olympus-Übernahme sind bewusst noch nicht aktiv gekoppelt.

+## Runtime Data
+
+Im Repository liegen nur:
+
+```text
+data/.gitkeep
+data/contact-inquiries.example.json
+data/repair-inquiries.example.json
+```
+
+Echte Runtime-Dateien werden nicht committed:
+
+```text
+data/contact-inquiries.json
+data/repair-inquiries.json
+data/site-settings.json
+data/smtp-settings.json
+```
+
+Uploads unter `public/uploads/images/` werden ebenfalls nicht committed.
+
+## Healthcheck
+
+```bash
+scripts/healthcheck.sh
+```
+
+Oder direkt:
+
+```bash
+curl http://localhost:3010/api/health
+```
+
+Antwort:
+
+```json
+{
+  "status": "ok",
+  "version": "0.2.2",
+  "storage": "ok",
+  "admin": "configured",
+  "timestamp": "..."
+}
+```
+
+## Deployment
+
+```bash
+scripts/deploy.sh
+```
+
+Das Skript führt aus:
+
+- `docker compose config`
+- `docker compose build`
+- `docker compose up -d`
+- Healthcheck über `/api/health`
+
+Produktiv muss die `.env` auf dem Zielsystem gepflegt werden. Secrets werden nicht ins Repository aufgenommen.
+
+## Update
+
+```bash
+git pull
+docker compose config
+docker compose build
+docker compose up -d
+scripts/healthcheck.sh
+```
+
+## Backup
+
+```bash
+scripts/backup.sh
+```
+
+Das Backup enthält `data/` und `public/uploads/`. Die `.env` wird bewusst nicht automatisch gesichert. Sie muss separat sicher abgelegt werden.
+
+## Restore
+
+```bash
+scripts/restore.sh backups/funktechnik-data-YYYYMMDD-HHMMSS.tar.gz
+```
+
+Danach Container neu starten:
+
+```bash
+docker compose up -d
+scripts/healthcheck.sh
+```
+
 ## Nginx

 Siehe `nginx.example.conf`.
--- a/app/admin/login/page.tsx
+++ b/app/admin/login/page.tsx
@ -1,5 +1,6 @@
 import type { Metadata } from "next";
 import AdminLoginForm from "@/components/admin/AdminLoginForm";
+import { adminConfigurationStatus } from "@/lib/runtime/config";

 export const metadata: Metadata = {
  title: "Admin Login | Funktechnik Schubert",
@ -9,5 +10,5 @@ export const metadata: Metadata = {
 export default async function AdminLoginPage({ searchParams }: { searchParams: Promise<{ next?: string }> }) {
  const params = await searchParams;
  const nextPath = params.next?.startsWith("/admin") ? params.next : "/admin";
-  return <AdminLoginForm nextPath={nextPath} />;
+  return <AdminLoginForm nextPath={nextPath} adminConfigured={adminConfigurationStatus() === "configured"} />;
 }
--- a/app/admin/system/page.tsx
+++ b/app/admin/system/page.tsx
@ -1,9 +1,17 @@
 import { redirect } from "next/navigation";
 import AdminShell from "@/components/admin/AdminShell";
 import { requireAdminSession } from "@/lib/admin/auth";
+import { adminConfigurationStatus, appVersion, checkStorage, dataDirectory, isDockerEnvironment, olympusStatus, smtpStatus, uploadDirectory } from "@/lib/runtime/config";

 export default async function AdminSystemPage() {
  if (!await requireAdminSession()) redirect("/admin/login");
+  let storage = "ok";
+
+  try {
+    await checkStorage();
+  } catch {
+    storage = "error";
+  }

  return (
    <AdminShell>
@ -11,26 +19,28 @@ export default async function AdminSystemPage() {
        <p className="eyebrow">Betrieb</p>
        <h1>System</h1>
      </div>
-      <div className="admin-detail-grid">
-        <section className="admin-card">
-          <h2>Technik</h2>
-          <ul className="list">
-            <li>Next.js 16 App Router</li>
-            <li>TypeScript strict</li>
-            <li>HttpOnly Admin-Session</li>
-            <li>Lokale Foundation-Datenablage in JSON-Dateien</li>
-          </ul>
-        </section>
-        <section className="admin-card">
-          <h2>Vorbereitet</h2>
-          <ul className="list">
-            <li>Olympus-Integration bleibt deaktiviert</li>
-            <li>SMTP-Konfiguration ohne Versandlogik</li>
-            <li>Medien-Upload mit Dateityp- und Größenprüfung</li>
-            <li>SEO- und Inhaltsverwaltung als Admin-Grundlage</li>
-          </ul>
-        </section>
-      </div>
+      <section className="admin-card">
+        <h2>Runtime Informationen</h2>
+        <dl className="system-list">
+          <div><dt>Version</dt><dd>{appVersion}</dd></div>
+          <div><dt>Node Version</dt><dd>{process.version}</dd></div>
+          <div><dt>Docker Environment</dt><dd>{isDockerEnvironment() ? "ja" : "nein"}</dd></div>
+          <div><dt>Storage Status</dt><dd>{storage}</dd></div>
+          <div><dt>Data Directory</dt><dd>{dataDirectory}</dd></div>
+          <div><dt>Upload Directory</dt><dd>{uploadDirectory}</dd></div>
+          <div><dt>Admin Konfiguration</dt><dd>{adminConfigurationStatus()}</dd></div>
+          <div><dt>Olympus Verbindung</dt><dd>{olympusStatus()}</dd></div>
+          <div><dt>SMTP</dt><dd>{smtpStatus()}</dd></div>
+        </dl>
+      </section>
+      <section className="admin-card">
+        <h2>Betriebsregeln</h2>
+        <ul className="list">
+          <li>Runtime-Daten liegen unter <code>data/</code> und werden nicht versioniert.</li>
+          <li>Uploads liegen unter <code>public/uploads/images/</code> und werden nicht versioniert.</li>
+          <li>Olympus- und SMTP-Integration sind vorbereitet, aber nicht aktiv implementiert.</li>
+        </ul>
+      </section>
    </AdminShell>
  );
 }
--- a/app/api/health/route.ts
+++ b/app/api/health/route.ts
@ -0,0 +1,20 @@
+import { NextResponse } from "next/server";
+import { adminConfigurationStatus, appVersion, checkStorage } from "@/lib/runtime/config";
+
+export async function GET() {
+  let storage = "ok";
+
+  try {
+    await checkStorage();
+  } catch {
+    storage = "error";
+  }
+
+  return NextResponse.json({
+    status: storage === "ok" ? "ok" : "error",
+    version: appVersion,
+    storage,
+    admin: adminConfigurationStatus(),
+    timestamp: new Date().toISOString(),
+  });
+}
--- a/app/error.tsx
+++ b/app/error.tsx
@ -0,0 +1,19 @@
+"use client";
+
+import Link from "next/link";
+
+export default function ErrorPage({ reset }: { error: Error & { digest?: string }; reset: () => void }) {
+  return (
+    <section className="error-page">
+      <div className="error-card">
+        <p className="eyebrow">500</p>
+        <h1>Die Seite konnte nicht geladen werden</h1>
+        <p className="lead">Es ist ein technischer Fehler aufgetreten. Bitte versuchen Sie es erneut.</p>
+        <div className="actions">
+          <button className="button" type="button" onClick={reset}>Erneut versuchen</button>
+          <Link className="button light" href="/">Zur Startseite</Link>
+        </div>
+      </div>
+    </section>
+  );
+}
--- a/app/global-error.tsx
+++ b/app/global-error.tsx
@ -0,0 +1,18 @@
+"use client";
+
+export default function GlobalErrorPage({ reset }: { error: Error & { digest?: string }; reset: () => void }) {
+  return (
+    <html lang="de">
+      <body>
+        <section className="error-page">
+          <div className="error-card">
+            <p className="eyebrow">Runtime</p>
+            <h1>Ein unerwarteter Fehler ist aufgetreten</h1>
+            <p className="lead">Die Anwendung konnte diesen Bereich nicht laden. Bitte versuchen Sie es erneut.</p>
+            <button className="button" type="button" onClick={reset}>Erneut versuchen</button>
+          </div>
+        </section>
+      </body>
+    </html>
+  );
+}
--- a/app/globals.css
+++ b/app/globals.css
@ -461,6 +461,33 @@ h3 {
  font-size: 26px;
 }

+.error-page {
+  min-height: 70vh;
+  display: grid;
+  place-items: center;
+  padding: 48px 16px;
+  background:
+    linear-gradient(90deg, rgba(6, 24, 52, 0.94), rgba(8, 42, 96, 0.76)),
+    url("/workbench-signal.svg"),
+    #07172d;
+  background-size: cover;
+}
+
+.error-card {
+  width: min(720px, 100%);
+  border: 1px solid rgba(255, 255, 255, 0.14);
+  border-radius: 8px;
+  background: rgba(255, 255, 255, 0.96);
+  padding: 34px;
+  box-shadow: var(--shadow);
+}
+
+.error-card h1 {
+  color: var(--ink);
+  font-size: clamp(34px, 5vw, 56px);
+  line-height: 1;
+}
+
 .admin-login-page {
  min-height: 100vh;
  display: grid;
@ -578,6 +605,13 @@ h3 {
  cursor: pointer;
 }

+.admin-version {
+  margin: 18px 12px 0;
+  color: rgba(255, 255, 255, 0.56);
+  font-size: 13px;
+  font-weight: 800;
+}
+
 .admin-main {
  min-width: 0;
  padding: 28px;
@ -738,6 +772,30 @@ h3 {
  object-fit: cover;
 }

+.system-list {
+  display: grid;
+  gap: 0;
+  margin: 0;
+}
+
+.system-list div {
+  display: grid;
+  grid-template-columns: 220px minmax(0, 1fr);
+  gap: 18px;
+  border-bottom: 1px solid var(--line);
+  padding: 12px 0;
+}
+
+.system-list dt {
+  color: var(--muted);
+  font-weight: 800;
+}
+
+.system-list dd {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+
@media (max-width: 1080px) and (min-width: 861px) {
  .brand-logo {
    width: 236px;
@ -837,4 +895,9 @@ h3 {
  .admin-upload {
    display: grid;
  }
+
+  .system-list div {
+    grid-template-columns: 1fr;
+    gap: 4px;
+  }
 }
--- a/app/not-found.tsx
+++ b/app/not-found.tsx
@ -0,0 +1,17 @@
+import Link from "next/link";
+
+export default function NotFoundPage() {
+  return (
+    <section className="error-page">
+      <div className="error-card">
+        <p className="eyebrow">404</p>
+        <h1>Seite nicht gefunden</h1>
+        <p className="lead">Die angeforderte Seite existiert nicht oder wurde verschoben.</p>
+        <div className="actions">
+          <Link className="button" href="/">Zur Startseite</Link>
+          <Link className="button light" href="/kontakt">Kontakt aufnehmen</Link>
+        </div>
+      </div>
+    </section>
+  );
+}
--- a/components/Footer.tsx
+++ b/components/Footer.tsx
@ -1,5 +1,6 @@
 import Image from "next/image";
 import Link from "next/link";
+import { appVersion } from "@/lib/runtime/version";

 export default function Footer() {
  return (
@ -14,7 +15,7 @@ export default function Footer() {
            className="footer-logo"
          />
          <p>Funktechnik Schubert – Service und technische Unterstützung für Funkgeräte, Messtechnik und Kommunikationstechnik.</p>
-          <p className="copyright">© Funktechnik Schubert</p>
+          <p className="copyright">© Funktechnik Schubert · v{appVersion}</p>
        </div>
        <div>
          <h3>Website</h3>
--- a/components/admin/AdminLoginForm.tsx
+++ b/components/admin/AdminLoginForm.tsx
@ -4,7 +4,7 @@ import Image from "next/image";
 import { useRouter } from "next/navigation";
 import { useState, type FormEvent } from "react";

-export default function AdminLoginForm({ nextPath = "/admin" }: { nextPath?: string }) {
+export default function AdminLoginForm({ nextPath = "/admin", adminConfigured = true }: { nextPath?: string; adminConfigured?: boolean }) {
  const router = useRouter();
  const [error, setError] = useState("");
  const [pending, setPending] = useState(false);
@ -34,6 +34,11 @@ export default function AdminLoginForm({ nextPath = "/admin" }: { nextPath?: str
      <form className="admin-login-card" onSubmit={submit}>
        <Image src="/funktechnik_schubert_logo.jpg" alt="Funktechnik Schubert" width={1672} height={941} priority />
        <h1>Administration Login</h1>
+        {!adminConfigured && (
+          <p className="error">
+            Admin-Zugang ist nicht konfiguriert. Bitte ADMIN_EMAIL, ADMIN_PASSWORD und ADMIN_SESSION_SECRET in der Umgebung setzen.
+          </p>
+        )}
        <label>
          E-Mail
          <input name="email" type="email" autoComplete="username" required />
@ -43,7 +48,7 @@ export default function AdminLoginForm({ nextPath = "/admin" }: { nextPath?: str
          <input name="password" type="password" autoComplete="current-password" required />
        </label>
        {error && <p className="error">{error}</p>}
-        <button className="button" type="submit" disabled={pending}>{pending ? "Anmeldung..." : "Anmelden"}</button>
+        <button className="button" type="submit" disabled={pending || !adminConfigured}>{pending ? "Anmeldung..." : "Anmelden"}</button>
      </form>
    </main>
  );
--- a/components/admin/AdminShell.tsx
+++ b/components/admin/AdminShell.tsx
@ -4,6 +4,7 @@ import Image from "next/image";
 import Link from "next/link";
 import { usePathname, useRouter } from "next/navigation";
 import type { ReactNode } from "react";
+import { appVersion } from "@/lib/runtime/version";

 const navItems = [
  ["Dashboard", "/admin"],
@ -40,6 +41,7 @@ export default function AdminShell({ children }: { children: ReactNode }) {
            </Link>
          ))}
        </nav>
+        <p className="admin-version">v{appVersion}</p>
        <button className="admin-logout" type="button" onClick={logout}>Abmelden</button>
      </aside>
      <div className="admin-main">{children}</div>
--- a/data/.gitkeep
+++ b/data/.gitkeep
@ -0,0 +1 @@
+
--- a/data/contact-inquiries.example.json
+++ b/data/contact-inquiries.example.json
@ -0,0 +1,12 @@
+[
+  {
+    "id": "contact_example",
+    "createdAt": "2026-07-03T00:00:00.000Z",
+    "status": "new",
+    "name": "Max Mustermann",
+    "email": "max@example.invalid",
+    "phone": "",
+    "subject": "Allgemeine Anfrage",
+    "message": "Beispieldatensatz fuer lokale Tests. Nicht fuer produktive Daten verwenden."
+  }
+]
--- a/data/repair-inquiries.example.json
+++ b/data/repair-inquiries.example.json
@ -0,0 +1,18 @@
+[
+  {
+    "id": "repair_example",
+    "createdAt": "2026-07-03T00:00:00.000Z",
+    "status": "new",
+    "name": "Max Mustermann",
+    "email": "max@example.invalid",
+    "phone": "",
+    "manufacturer": "Beispielhersteller",
+    "model": "Beispielmodell",
+    "serialNumber": "",
+    "deviceType": "cb-radio",
+    "accessories": "Mikrofon",
+    "opened": "unknown",
+    "previousWork": "",
+    "description": "Beispieldatensatz fuer lokale Tests. Nicht fuer produktive Daten verwenden."
+  }
+]
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -7,13 +7,22 @@ services:
    ports:
      - "3010:3010"
    environment:
-      NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL}
-      ADMIN_EMAIL: ${ADMIN_EMAIL}
-      ADMIN_PASSWORD: ${ADMIN_PASSWORD}
-      ADMIN_SESSION_SECRET: ${ADMIN_SESSION_SECRET}
-      AUTH_COOKIE_SECURE: ${AUTH_COOKIE_SECURE}
-      OLYMPUS_INTAKE_API_URL: ${OLYMPUS_INTAKE_API_URL}
-      OLYMPUS_INTAKE_API_TOKEN: ${OLYMPUS_INTAKE_API_TOKEN}
+      NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:-http://localhost:3010}
+      NEXT_PUBLIC_APP_VERSION: "0.2.2"
+      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
+      ADMIN_SESSION_SECRET: ${ADMIN_SESSION_SECRET:-}
+      AUTH_COOKIE_SECURE: ${AUTH_COOKIE_SECURE:-false}
+      OLYMPUS_INTAKE_API_URL: ${OLYMPUS_INTAKE_API_URL:-}
+      OLYMPUS_INTAKE_API_TOKEN: ${OLYMPUS_INTAKE_API_TOKEN:-}
+      DOCKER_ENV: "true"
    volumes:
-      - ./data:/app/data
+      - funktechnik-data:/app/data
+      - funktechnik-uploads:/app/public/uploads/images
+      - funktechnik-next-cache:/app/.next/cache
    restart: unless-stopped
+
+volumes:
+  funktechnik-data:
+  funktechnik-uploads:
+  funktechnik-next-cache:
--- a/lib/admin/store.ts
+++ b/lib/admin/store.ts
@ -1,27 +1,25 @@
 import { mkdir, readFile, writeFile } from "fs/promises";
 import path from "path";
+import { dataDirectory } from "@/lib/runtime/config";
 import type { ContactInquiry, InquiryStatus, RepairInquiry, SiteSettings, SmtpSettings } from "./types";

-const dataDir = path.join(process.cwd(), "data");
-
 async function ensureDataDir() {
-  await mkdir(dataDir, { recursive: true });
+  await mkdir(dataDirectory, { recursive: true });
 }

 async function readJson<T>(fileName: string, fallback: T): Promise<T> {
  await ensureDataDir();
  try {
-    const file = await readFile(path.join(dataDir, fileName), "utf8");
+    const file = await readFile(path.join(dataDirectory, fileName), "utf8");
    return JSON.parse(file) as T;
  } catch {
-    await writeJson(fileName, fallback);
    return fallback;
  }
 }

 async function writeJson<T>(fileName: string, value: T) {
  await ensureDataDir();
-  await writeFile(path.join(dataDir, fileName), `${JSON.stringify(value, null, 2)}\n`, "utf8");
+  await writeFile(path.join(dataDirectory, fileName), `${JSON.stringify(value, null, 2)}\n`, "utf8");
 }

 function id(prefix: string) {
--- a/lib/runtime/config.ts
+++ b/lib/runtime/config.ts
@ -0,0 +1,39 @@
+import { existsSync } from "fs";
+import { access, mkdir, writeFile, rm } from "fs/promises";
+import path from "path";
+import { appVersion } from "./version";
+
+export const dataDirectory = path.join(process.cwd(), "data");
+export const uploadDirectory = path.join(process.cwd(), "public", "uploads", "images");
+
+export function adminConfigurationStatus() {
+  return process.env.ADMIN_EMAIL && process.env.ADMIN_PASSWORD && process.env.ADMIN_SESSION_SECRET ? "configured" : "missing";
+}
+
+export function isDockerEnvironment() {
+  return process.env.DOCKER_ENV === "true" || process.env.CONTAINER === "true" || existsSync("/.dockerenv");
+}
+
+export async function ensureRuntimeDirectories() {
+  await mkdir(dataDirectory, { recursive: true });
+  await mkdir(uploadDirectory, { recursive: true });
+}
+
+export async function checkStorage() {
+  await ensureRuntimeDirectories();
+  const probe = path.join(dataDirectory, `.storage-check-${Date.now()}`);
+  await writeFile(probe, "ok", "utf8");
+  await rm(probe, { force: true });
+  await access(uploadDirectory);
+  return "ok";
+}
+
+export function olympusStatus() {
+  return process.env.OLYMPUS_INTAKE_API_URL && process.env.OLYMPUS_INTAKE_API_TOKEN ? "configured" : "not_configured";
+}
+
+export function smtpStatus() {
+  return "prepared";
+}
+
+export { appVersion };
--- a/lib/runtime/version.ts
+++ b/lib/runtime/version.ts
@ -0,0 +1 @@
+export const appVersion = "0.2.2";
--- a/package-lock.json
+++ b/package-lock.json
@ -1,12 +1,12 @@
 {
  "name": "funktechnik-schubert-website",
-  "version": "0.1.0",
+  "version": "0.2.2",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "funktechnik-schubert-website",
-      "version": "0.1.0",
+      "version": "0.2.2",
      "dependencies": {
        "next": "16.2.10",
        "react": "19.2.3",
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "funktechnik-schubert-website",
-  "version": "0.1.0",
+  "version": "0.2.2",
  "private": true,
  "scripts": {
    "dev": "next dev -p 3010",
--- a/scripts/backup.sh
+++ b/scripts/backup.sh
@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+set -eu
+
+BACKUP_DIR="${BACKUP_DIR:-backups}"
+STAMP="$(date +%Y%m%d-%H%M%S)"
+TARGET="${BACKUP_DIR}/funktechnik-data-${STAMP}.tar.gz"
+
+mkdir -p "$BACKUP_DIR"
+tar -czf "$TARGET" data public/uploads
+
+echo "Backup erstellt: $TARGET"
+echo "Hinweis: .env wird aus Sicherheitsgruenden nicht automatisch gesichert."
+echo "Bitte .env separat und sicher ausserhalb des Repositories sichern."
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@ -0,0 +1,19 @@
+#!/usr/bin/env sh
+set -eu
+
+COMPOSE="${COMPOSE:-docker compose}"
+BASE_URL="${BASE_URL:-http://localhost:3010}"
+
+echo "Pruefe Docker Compose Konfiguration..."
+$COMPOSE config >/dev/null
+
+echo "Baue Container..."
+$COMPOSE build
+
+echo "Starte Container..."
+$COMPOSE up -d
+
+echo "Fuehre Healthcheck aus..."
+BASE_URL="$BASE_URL" scripts/healthcheck.sh
+
+echo "Deployment abgeschlossen."
--- a/scripts/healthcheck.sh
+++ b/scripts/healthcheck.sh
@ -0,0 +1,14 @@
+#!/usr/bin/env sh
+set -eu
+
+BASE_URL="${BASE_URL:-http://localhost:3010}"
+HEALTH_URL="${BASE_URL%/}/api/health"
+
+echo "Checking ${HEALTH_URL}"
+response="$(curl -fsS "$HEALTH_URL")"
+echo "$response"
+
+case "$response" in
+  *'"status":"ok"'*) exit 0 ;;
+  *) echo "Healthcheck failed" >&2; exit 1 ;;
+esac
--- a/scripts/restore.sh
+++ b/scripts/restore.sh
@ -0,0 +1,17 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ "${1:-}" = "" ]; then
+  echo "Usage: scripts/restore.sh <backup.tar.gz>" >&2
+  exit 1
+fi
+
+BACKUP_FILE="$1"
+
+if [ ! -f "$BACKUP_FILE" ]; then
+  echo "Backup nicht gefunden: $BACKUP_FILE" >&2
+  exit 1
+fi
+
+tar -xzf "$BACKUP_FILE"
+echo "Restore abgeschlossen: $BACKUP_FILE"
--- a/scripts/runtime-start.js
+++ b/scripts/runtime-start.js
@ -0,0 +1,36 @@
+/* eslint-disable @typescript-eslint/no-require-imports */
+const fs = require("fs");
+const path = require("path");
+
+const requiredEnv = ["ADMIN_EMAIL", "ADMIN_PASSWORD", "ADMIN_SESSION_SECRET"];
+const requiredDirs = [
+  path.join(process.cwd(), "data"),
+  path.join(process.cwd(), "public", "uploads", "images"),
+  path.join(process.cwd(), ".next", "cache"),
+];
+
+function fail(message) {
+  process.stderr.write(`[funktechnik-website] ${message}\n`);
+  process.exit(1);
+}
+
+function ensureWritableDirectory(directory) {
+  fs.mkdirSync(directory, { recursive: true });
+  const probe = path.join(directory, `.write-check-${Date.now()}`);
+  fs.writeFileSync(probe, "ok", "utf8");
+  fs.rmSync(probe, { force: true });
+}
+
+const missingEnv = requiredEnv.filter((name) => !process.env[name]);
+if (missingEnv.length > 0) {
+  fail(`Start abgebrochen: fehlende Umgebungsvariablen: ${missingEnv.join(", ")}. Bitte .env anhand von .env.example konfigurieren.`);
+}
+
+try {
+  for (const directory of requiredDirs) ensureWritableDirectory(directory);
+} catch (error) {
+  fail(`Start abgebrochen: Runtime-Verzeichnis ist nicht beschreibbar. Details: ${error instanceof Error ? error.message : "unbekannter Fehler"}`);
+}
+
+process.stdout.write(`[funktechnik-website] Runtime checks ok. Starting version ${process.env.NEXT_PUBLIC_APP_VERSION ?? "0.2.2"}.\n`);
+require("./server.js");