IT Support » DMZ-WEB Infrastructure

# Health check

All `site-*` units at once, from the host. Requests go straight to NPM on  

127.0.0.1:444 — the same 443→444 translation the FortiGate VIP does — while  

`--resolve` keeps SNI/Host as the real domain. Domains come from each unit's  

`Description=<App> -- <domain>` line (WordPress, Redmine and Snipe-IT alike).

```

for u in ~/.config/containers/systemd/site-*.container; do

  d=$(sed -n 's/^Description=.* -- //p' "$u")

  printf '%-28s ' "$d"; curl -sI --max-time 10 --resolve "$d:444:127.0.0.1" "https://$d:444" | head -1

done

# add -k to curl while a Let's Encrypt cert isn't issued yet

# one site by hand

curl -sI --resolve <domain>:444:127.0.0.1 https://<domain>:444 | head -1

# from outside (mobile data / VPN client)

curl -sI https://<domain> | head -1

```

`~/deploy/check-sites.sh` is the same loop with container status alongside  

(uses the same `.* --` sed so non-WordPress units are included).

`200`/`301`/`302` healthy · `502` NPM up but can't reach the container  

(network membership? container down?) · `NO RESPONSE` NPM/TLS not answering on 444.

---

*Source: `dmz-web-podman-cheatsheet.md` v1.1.1 in the `dmz-web-deploy` repo ([Releases](#)). Edit the wiki and the repo copy together.*