IT Support » DMZ-WEB Infrastructure

*Chapter 6 of the dmz-web documentation · headings are numbered like the cheat sheets · index: [[Wiki]]*

{{>toc}}

All `site-*` units at once, from the host. Requests go straight to NPM on

127.0.0.1:444 — the same 443→444 translation the FortiGate VIP does — while

`--resolve` keeps SNI/Host as the real domain. Domains come from each unit's

`Description=<App> -- <domain>` line (WordPress, Redmine and Snipe-IT alike).

```bash

for u in ~/.config/containers/systemd/site-*.container; do

  d=$(sed -n 's/^Description=.* -- //p' "$u")

  printf '%-28s ' "$d"; curl -sI --max-time 10 --resolve "$d:444:127.0.0.1" "https://$d:444" | head -1

done

# add -k to curl while a Let's Encrypt cert isn't issued yet

# one site by hand

curl -sI --resolve <domain>:444:127.0.0.1 https://<domain>:444 | head -1

# from outside (mobile data / VPN client)

curl -sI https://<domain> | head -1

```

`~/deploy/check-sites.sh` is the same loop with container status alongside

(uses the same `.* -- ` sed so non-WordPress units are included).

`200`/`301`/`302` healthy · `502` NPM up but can't reach the container

(network membership? container down?) · `NO RESPONSE` NPM/TLS not answering on 444.

---

_Source: `dmz-web-podman-cheatsheet.md` v1.1.1 in the `dmz-web-deploy` repo ([[Releases]]). Edit the wiki and the repo copy together._

## 6.1 Before go-live checklist

Run through this when a stack moves from "being built" to "in use", and again after bigger changes:

* **Nothing readable without login that should not be:** open the Redmine project's *Repository* and *Wiki* URLs in a private window — they must redirect to the login page (Anonymous role: no *Browse repository* / *View wiki pages*, or the project not Public).

* **Access List on every Proxy Host that is not meant to be public** (assets, pf, track, …), and the 8181 admin UI only from the allowed subnets (§1).

* **No floating image tags:** `grep -H '^Image=' ~/.config/containers/systemd/*.container | grep -E ':latest|:11$'` should print nothing worth keeping (use a version tag or a digest; Snipe-IT and MariaDB are pinned, see §4).

* **Live vs repo:** `diff <(grep '^Network=' ~/.config/containers/systemd/nginx-proxy-manager.container) <(grep '^Network=' ~/deploy/quadlet/nginx-proxy-manager.container)` prints nothing (or only a new network you are about to deploy).

* **Backups exist and one restore has been tried** per stack (databases dumped *off* the host; Snipe-IT: DB + `app-snipeit-data` + secret `snipeit-app-key`; PF: `pg_dump -Fc` and the Timescale restore calls).

* **Secrets that were ever pasted into a chat, ticket or terminal log are rotated** (database root passwords first).

* **Mail:** a test mail to an `@mdsdefense.com` mailbox arrives from every app that sends mail; external recipients are a separate check (Snipe-IT currently gets `451 4.4.4 ATTR5` from Exchange for outside addresses).

* `~/deploy/check-sites.sh` shows `200`/`302` for every site.