IT Support » DMZ-WEB Infrastructure

## Services

```bash

systemctl --user daemon-reload                        # after editing any Quadlet file

systemctl --user list-units 'db-*' 'site-*' 'net-*' 'nginx-proxy-manager*'

systemctl --user status  db-<name>.service site-<name>.service

systemctl --user restart db-<name>.service site-<name>.service

journalctl --user -u site-<name>.service -e

/usr/libexec/podman/quadlet -dryrun -user             # validate Quadlet syntax

```

## Listing / inspecting

```bash

podman ps -a

podman network ls ; podman volume ls ; podman secret ls

podman inspect <ctr> --format '{{.ImageName}}'

podman inspect <ctr> --format '{{range .Mounts}}{{.Name}} -> {{.Destination}}{{"\n"}}{{end}}'

podman inspect <ctr> | jq '.[0].Config.Env'

podman logs -f <ctr>

podman exec -it <ctr> bash                            # root shell inside, no password

```

## Environment variables inside a container

```bash

podman exec <ctr> printenv

podman exec <ctr> printenv | grep -iE 'ROOT|PASSWORD|KEY'

podman exec <ctr> printenv MYSQL_ROOT_PASSWORD | od -c | tail -3   # reveals a stray trailing \n

```

## Secrets

Injected as env at container start (`Secret=<secret>,type=env,target=VAR`).

MariaDB/PostgreSQL only read their `*_PASSWORD` env on **first**

initialisation of an empty data dir; afterwards the env var is inert and the

real password is whatever is in the DB.

```bash

podman secret inspect --showsecret <secret>

podman secret inspect --showsecret --format '{{.SecretData}}' <secret>

# always create WITHOUT a trailing newline

printf '%s' 'VALUE' | podman secret create <secret> -

printf '%s' "$(openssl rand -base64 32)" | podman secret create <secret> -

# replace: rm + create, then restart the consumers

podman secret rm <secret> && printf '%s' 'VALUE' | podman secret create <secret> -

```

## Fixing a secret that has a trailing `\n` (legacy WordPress sites)

```bash

cat > ~/tmp/fixpw.sh <<'EOF'

ROOTPW="$(printf '%s' "$MYSQL_ROOT_PASSWORD")"   # $(...) strips the trailing \n

WPPW="$(printf '%s' "$MYSQL_PASSWORD")"

mariadb -uroot -p"$MYSQL_ROOT_PASSWORD" <<SQL

ALTER USER 'root'@'localhost' IDENTIFIED BY '$ROOTPW';

ALTER USER 'root'@'%'         IDENTIFIED BY '$ROOTPW';

ALTER USER 'wordpress'@'%'    IDENTIFIED BY '$WPPW';

FLUSH PRIVILEGES;

SQL

EOF

podman exec -i db-<name> sh < ~/tmp/fixpw.sh

for s in <name>-db-root-password <name>-db-password; do

  v="$(podman secret inspect --showsecret --format '{{.SecretData}}' "$s")"

  podman secret rm "$s"; printf '%s' "$v" | podman secret create "$s" -

done

systemctl --user restart db-<name>.service site-<name>.service   # run back to back with the SQL half

```

---

_Source: `dmz-web-podman-cheatsheet.md` v1.1.1 in the `dmz-web-deploy` repo ([[Releases]]). Edit the wiki and the repo copy together._