Chapter 6 of the dmz-web documentation · headings are numbered like the cheat sheets · index: Wiki

• Table of contents
• 6.1 Before go-live checklist

All site-* units at once, from the host. Requests go straight to NPM on
127.0.0.1:444 — the same 443→444 translation the FortiGate VIP does — while
--resolve keeps SNI/Host as the real domain. Domains come from each unit's
Description=<App> -- <domain> line (WordPress, Redmine and Snipe-IT alike).

for u in ~/.config/containers/systemd/site-*.container; do
  d=$(sed -n 's/^Description=.* -- //p' "$u")
  printf '%-28s ' "$d"; curl -sI --max-time 10 --resolve "$d:444:127.0.0.1" "https://$d:444" | head -1
done
# add -k to curl while a Let's Encrypt cert isn't issued yet

# one site by hand
curl -sI --resolve <domain>:444:127.0.0.1 https://<domain>:444 | head -1

# from outside (mobile data / VPN client)
curl -sI https://<domain> | head -1

~/deploy/check-sites.sh is the same loop with container status alongside
(uses the same .* -- sed so non-WordPress units are included).

200/301/302 healthy · 502 NPM up but can't reach the container
(network membership? container down?) · NO RESPONSE NPM/TLS not answering on 444.

Source: dmz-web-podman-cheatsheet.md v1.1.1 in the dmz-web-deploy repo (Releases). Edit the wiki and the repo copy together.

6.1 Before go-live checklist¶

Run through this when a stack moves from "being built" to "in use", and again after bigger changes:

• Nothing readable without login that should not be: open the Redmine project's Repository and Wiki URLs in a private window — they must redirect to the login page (Anonymous role: no Browse repository / View wiki pages, or the project not Public).
• Access List on every Proxy Host that is not meant to be public (assets, pf, track, …), and the 8181 admin UI only from the allowed subnets (§1).
• No floating image tags: grep -H '^Image=' ~/.config/containers/systemd/*.container | grep -E ':latest|:11$' should print nothing worth keeping (use a version tag or a digest; Snipe-IT and MariaDB are pinned, see §4).
• Live vs repo: diff <(grep '^Network=' ~/.config/containers/systemd/nginx-proxy-manager.container) <(grep '^Network=' ~/deploy/quadlet/nginx-proxy-manager.container) prints nothing (or only a new network you are about to deploy).
• Backups exist and one restore has been tried per stack (databases dumped off the host; Snipe-IT: DB + app-snipeit-data + secret snipeit-app-key; PF: pg_dump -Fc and the Timescale restore calls).
• Secrets that were ever pasted into a chat, ticket or terminal log are rotated (database root passwords first).
• Mail: a test mail to an @mdsdefense.com mailbox arrives from every app that sends mail; external recipients are a separate check (Snipe-IT currently gets 451 4.4.4 ATTR5 from Exchange for outside addresses).
• ~/deploy/check-sites.sh shows 200/302 for every site.