Health check¶

All site-* units at once, from the host. Requests go straight to NPM on

127.0.0.1:444 — the same 443→444 translation the FortiGate VIP does — while

--resolve keeps SNI/Host as the real domain. Domains come from each unit's

Description=<App> -- <domain> line (WordPress, Redmine and Snipe-IT alike).

for u in ~/.config/containers/systemd/site-*.container; do
  d=$(sed -n 's/^Description=.* -- //p' "$u")
  printf '%-28s ' "$d"; curl -sI --max-time 10 --resolve "$d:444:127.0.0.1" "https://$d:444" | head -1
done
# add -k to curl while a Let's Encrypt cert isn't issued yet

# one site by hand
curl -sI --resolve <domain>:444:127.0.0.1 https://<domain>:444 | head -1

# from outside (mobile data / VPN client)
curl -sI https://<domain> | head -1

~/deploy/check-sites.sh is the same loop with container status alongside

(uses the same .* -- sed so non-WordPress units are included).

200/301/302 healthy · 502 NPM up but can't reach the container

(network membership? container down?) · NO RESPONSE NPM/TLS not answering on 444.

Source: dmz-web-podman-cheatsheet.md v1.1.1 in the dmz-web-deploy repo (Releases). Edit the wiki and the repo copy together.