IT Support » DMZ-WEB Infrastructure

*Chapter 0 of the dmz-web documentation · headings are numbered like the cheat sheets · index: [[Wiki]]*

Host: `dmz-web` (Rocky Linux 10.2). Everything runs **rootless** under user

`websvcmaster` (no sudo) as Quadlet units in `~/.config/containers/systemd/`.

Design rule: **shared-nothing** — every service gets its own network, DB

container, app container and volumes; the only thing joined to all of them is

Nginx Proxy Manager.

Naming inversion to remember: containers are `db-<name>`, secrets are `<name>-db-…`.

## 0. Shell setup (every session)

`sudo -iu websvcmaster` doesn't run PAM session setup, so `systemctl --user`

fails with "Failed to connect to user scope bus" until:

```bash

export XDG_RUNTIME_DIR=/run/user/$(id -u)

export DBUS_SESSION_BUS_ADDRESS=unix:path=$XDG_RUNTIME_DIR/bus

systemctl --user show-environment >/dev/null && echo OK

```

Lingering must be on (`loginctl show-user websvcmaster | grep Linger`, as root).

No write access to system `/tmp` — use `~/tmp`.

Where things live:

```bash

~/.config/containers/systemd/          # live Quadlet units (the "pod config")

~/deploy/                              # add-wordpress-site.sh, check-sites.sh

~/deploy/quadlet/                      # generated unit templates (source of truth, cp'd into the dir above)

~/.local/share/containers/storage/volumes/<vol>/_data/   # named volume contents

~/.local/share/containers/storage/secrets/filedriver/    # secret store

~/redmine_data/                        # Redmine bind mounts (config, plugins, images, assets)

/srv/git/                              # bare git repos (root-owned, read-only into Redmine)

```

---

_Source: `dmz-web-podman-cheatsheet.md` v1.1.1 in the `dmz-web-deploy` repo ([[Releases]]). Edit the wiki and the repo copy together._