Initial code borrowed from https://github.com/drupal-composer/drupal-project

.gitignore

+files/
+settings/
+
+# Ignore directories generated by Composer
+composer.lock
+drush/contrib
+vendor
+web/core
+web/modules/contrib
+web/themes/contrib
+web/profiles/contrib
+
+# Ignore Drupal's file directory
+web/sites/*/settings.php
+web/sites/*/files
+web/sites/*/private
+
+# Ignore files generated by PhpStorm
+.idea

.gitlab-ci.yml

+Deploy:
+  script:
+    - "apb deploy"
+  only:
+    - some-branch

composer.json

+{
+  "name": "drupal/d8-project",
+  "description": "Drupal 8 template for a composer based deployment workflow",
+  "type": "project",
+  "license": "GPL-2.0+",
+  "authors": [
+    {
+      "name": "Jürgen Haas",
+      "role": "Drupal Expert"
+    },
+    {
+      "name": "Richard Papp",
+      "role": "Drupal Expert"
+    }
+  ],
+  "repositories": [
+    {
+      "type": "composer",
+      "url": "https://packages.drupal.org/8"
+    }
+  ],
+  "require": {
+    "composer/installers": "^1.0.20",
+    "drupal-composer/drupal-scaffold": "^2.0.1",
+    "cweagans/composer-patches": "~1.0",
+    "drupal/core": "8.1.2",
+    "drush/drush": "~8.0",
+    "drupal/console": "~0.10",
+    "drupal/address": "1.0-beta3",
+    "drupal/admin_toolbar": "1.15",
+    "drupal/browser_refresh": "1.0",
+    "drupal/coffee": "1.0-beta1",
+    "drupal/ctools": "3.0-alpha26",
+    "drupal/entity": "1.0-alpha3",
+    "drupal/node_view_permissions": "1.0",
+    "drupal/pathauto": "1.0-alpha3",
+    "drupal/piwik": "1.0",
+    "drupal/rules": "3.0-alpha1",
+    "drupal/smtp": "1.0-alpha0",
+    "drupal/video": "1.2",
+    "drupal/videojs": "1.0",
+    "drupal/metatag": "1.0.x-dev",
+    "drupal/slack": "1.0.x-dev",
+    "drupal/honeypot": "1.23",
+    "drupal/maillog": "1.0.x-dev"
+  },
+  "require-dev": {
+    "behat/mink": "~1.7",
+    "behat/mink-goutte-driver": "~1.2",
+    "jcalderonzumba/gastonjs": "~1.0.2",
+    "jcalderonzumba/mink-phantomjs-driver": "~0.3.1",
+    "mikey179/vfsStream": "~1.2",
+    "phpunit/phpunit": "~4.8",
+    "symfony/css-selector": "~2.8"
+  },
+  "conflict": {
+    "drupal/drupal": "*"
+  },
+  "minimum-stability": "dev",
+  "prefer-stable": true,
+  "autoload": {
+    "classmap": [
+      "scripts/composer/ScriptHandler.php"
+    ]
+  },
+  "scripts": {
+    "drupal-scaffold": "DrupalComposer\\DrupalScaffold\\Plugin::scaffold",
+    "post-install-cmd": [
+      "DrupalProject\\composer\\ScriptHandler::createRequiredFiles"
+    ],
+    "post-update-cmd": [
+      "DrupalProject\\composer\\ScriptHandler::createRequiredFiles"
+    ]
+  },
+  "extra": {
+    "installer-paths": {
+      "web/core": [
+        "type:drupal-core"
+      ],
+      "web/modules/contrib/{$name}": [
+        "type:drupal-module"
+      ],
+      "web/profiles/contrib/{$name}": [
+        "type:drupal-profile"
+      ],
+      "web/themes/contrib/{$name}": [
+        "type:drupal-theme"
+      ],
+      "drush/contrib/{$name}": [
+        "type:drupal-drush"
+      ]
+    },
+    "patches": {
+      "drupal/node_view_permissions": {
+        "Replace String with SafeMarkup class": "https://www.drupal.org/files/issues/node-view-permissions-php7-support-2683175-2.patch"
+      }
+    }
+  }
+}

config/default/live/.htaccess

+# Deny all requests from Apache 2.4+.
+<IfModule mod_authz_core.c>
+  Require all denied
+</IfModule>
+
+# Deny all requests from Apache 2.0-2.2.
+<IfModule !mod_authz_core.c>
+  Deny from all
+</IfModule>
+# Turn off all options we don't need.
+Options -Indexes -ExecCGI -Includes -MultiViews
+
+# Set the catch-all handler to prevent scripts from being executed.
+SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+<Files *>
+  # Override the handler again if we're run later in the evaluation list.
+  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
+</Files>
+
+# If we know how to do it safely, disable the PHP engine entirely.
+<IfModule mod_php5.c>
+  php_flag engine off
+</IfModule>
\ No newline at end of file

config/default/staging/.htaccess

+# Deny all requests from Apache 2.4+.
+<IfModule mod_authz_core.c>
+  Require all denied
+</IfModule>
+
+# Deny all requests from Apache 2.0-2.2.
+<IfModule !mod_authz_core.c>
+  Deny from all
+</IfModule>
+# Turn off all options we don't need.
+Options -Indexes -ExecCGI -Includes -MultiViews
+
+# Set the catch-all handler to prevent scripts from being executed.
+SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+<Files *>
+  # Override the handler again if we're run later in the evaluation list.
+  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
+</Files>
+
+# If we know how to do it safely, disable the PHP engine entirely.
+<IfModule mod_php5.c>
+  php_flag engine off
+</IfModule>
\ No newline at end of file

config/default/sync/.htaccess

+# Deny all requests from Apache 2.4+.
+<IfModule mod_authz_core.c>
+  Require all denied
+</IfModule>
+
+# Deny all requests from Apache 2.0-2.2.
+<IfModule !mod_authz_core.c>
+  Deny from all
+</IfModule>
+# Turn off all options we don't need.
+Options -Indexes -ExecCGI -Includes -MultiViews
+
+# Set the catch-all handler to prevent scripts from being executed.
+SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+<Files *>
+  # Override the handler again if we're run later in the evaluation list.
+  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
+</Files>
+
+# If we know how to do it safely, disable the PHP engine entirely.
+<IfModule mod_php5.c>
+  php_flag engine off
+</IfModule>
\ No newline at end of file

drush/README.md

+This directory contains commands, configuration and site aliases for Drush. See http://packages.drush.org/ for a directory of Drush commands installable via Composer.

drush/policy.drush.inc

+<?php
+
+/*
+ * Customize this file as desired. See https://github.com/drush-ops/drush/blob/8.x/examples/policy.drush.inc for documentation.
+ */
+
+/**
+ * Implements drush_hook_COMMAND_validate().
+ *
+ * Encourage folks to use `composer` instead of Drush pm commands
+ */
+function drush_policy_pm_updatecode_validate() {
+  return _deny_message();
+}
+
+function drush_policy_pm_update_validate() {
+  return _deny_message();
+}
+
+function drush_policy_pm_download_validate() {
+  return _deny_message();
+}
+
+function _deny_message() {
+  if (!drush_get_option('pm-force')) {
+    $msg = 'This codebase is assembled with Composer instead of Drush. Use `composer update` and `composer require` instead of `drush pm-updatecode` and `drush pm-download`. You may override this error by using the --pm-force option.';
+    return drush_set_error('POLICY_PM_DENY', dt($msg));
+  }
+}
+
+/**
+ * Implements hook_drush_help_alter().
+ */
+function policy_drush_help_alter(&$command) {
+  if (in_array($command['command'], array('pm-updatecode', 'pm-update', 'pm-download'))) {
+    $command['options']['pm-force'] = 'Override site policy and allow Drush codebase management (pm-* commands)';
+  }
+}
+

scripts/composer/ScriptHandler.php

+<?php
+
+/**
+ * @file
+ * Contains \DrupalProject\composer\ScriptHandler.
+ */
+
+namespace DrupalProject\composer;
+
+use Composer\Script\Event;
+use Symfony\Component\Filesystem\Filesystem;
+
+class ScriptHandler {
+
+  protected static function getDrupalRoot($project_root) {
+    return $project_root .  '/web';
+  }
+
+  public static function createRequiredFiles(Event $event) {
+    $fs = new Filesystem();
+    $root = static::getDrupalRoot(getcwd());
+
+    $dirs = [
+      'modules',
+      'profiles',
+      'themes',
+    ];
+
+    // Required for unit testing
+    foreach ($dirs as $dir) {
+      if (!$fs->exists($root . '/'. $dir)) {
+        $fs->mkdir($root . '/'. $dir);
+        $fs->touch($root . '/'. $dir . '/.gitkeep');
+      }
+    }
+
+    // Prepare the settings file for installation
+    if (!$fs->exists($root . '/sites/default/settings.php')) {
+      $fs->copy($root . '/sites/default/default.settings.php', $root . '/sites/default/settings.php');
+      $fs->chmod($root . '/sites/default/settings.php', 0666);
+      $event->getIO()->write("Create a sites/default/settings.php file with chmod 0666");
+    }
+
+    // Prepare the services file for installation
+    if (!$fs->exists($root . '/sites/default/services.yml')) {
+      $fs->copy($root . '/sites/default/default.services.yml', $root . '/sites/default/services.yml');
+      $fs->chmod($root . '/sites/default/services.yml', 0666);
+      $event->getIO()->write("Create a sites/default/services.yml file with chmod 0666");
+    }
+
+    // Create the files directory with chmod 0777
+    if (!$fs->exists($root . '/sites/default/files')) {
+      $oldmask = umask(0);
+      $fs->mkdir($root . '/sites/default/files', 0777);
+      umask($oldmask);
+      $event->getIO()->write("Create a sites/default/files directory with chmod 0777");
+    }
+  }
+
+}