Production

What to do before running on a server: passwords, host names, TLS and ports.

Checklist

Set strong passwords in .env and never commit .env.
Restrict TYPO3_TRUSTED_HOSTS_PATTERN to the real domain, for example (www\.)?example\.org.
Set TYPO3_SITE_URL to the real URL before the first start. Otherwise, adjust it later in the backend under “Sites”.
Terminate TLS at a reverse proxy (Traefik, Caddy, nginx) and enter its IP in TYPO3_REVERSE_PROXY_IP.
Restrict the published port to 127.0.0.1:8088:80 if appropriate.
Leave out docker-compose.override.yml when the Keycloak host name resolves via DNS, and enter the public URLs in the Keycloak client.