Host: dmz-web (Rocky Linux 10.2). Everything runs rootless under user
websvcmaster (no sudo) as Quadlet units in ~/.config/containers/systemd/.
Design rule: shared-nothing — every service gets its own network, DB
container, app container and volumes; the only thing joined to all of them is
Nginx Proxy Manager.

Naming inversion to remember: containers are db-<name>, secrets are <name>-db-….

Shell setup (every session)¶

sudo -iu websvcmaster doesn't run PAM session setup, so systemctl --user
fails with "Failed to connect to user scope bus" until:

export XDG_RUNTIME_DIR=/run/user/$(id -u)
export DBUS_SESSION_BUS_ADDRESS=unix:path=$XDG_RUNTIME_DIR/bus
systemctl --user show-environment >/dev/null && echo OK

Lingering must be on (loginctl show-user websvcmaster | grep Linger, as root).
No write access to system /tmp — use ~/tmp.

Where things live:

~/.config/containers/systemd/          # live Quadlet units (the "pod config")
~/deploy/                              # add-wordpress-site.sh, check-sites.sh
~/deploy/quadlet/                      # generated unit templates (source of truth, cp'd into the dir above)
~/.local/share/containers/storage/volumes/<vol>/_data/   # named volume contents
~/.local/share/containers/storage/secrets/filedriver/    # secret store
~/redmine_data/                        # Redmine bind mounts (config, plugins, images, assets)
/srv/git/                              # bare git repos (root-owned, read-only into Redmine)

Source: dmz-web-podman-cheatsheet.md v1.1.1 in the dmz-web-deploy repo (Releases). Edit the wiki and the repo copy together.