IT Support » DMZ-WEB Infrastructure

Wiki »

Operations » History » Revision 2

Revision 1 (Redmine Admin, 10/25/2026 04:28 PM) → Revision 2/6 (Redmine Admin, 10/26/2026 02:24 AM)

# Common operations 

 ## Services 

 ```bash 
 

 ``` 
 systemctl --user daemon-reload                          # after editing any Quadlet file 
 
 systemctl --user list-units 'db-*' 'site-*' 'net-*' 'nginx-proxy-manager*' 
 
 systemctl --user status    db-<name>.service site-<name>.service 
 
 systemctl --user restart db-<name>.service site-<name>.service 
 
 journalctl --user -u site-<name>.service -e 
 
 /usr/libexec/podman/quadlet -dryrun -user               # validate Quadlet syntax 
 
 ``` 

 

 ## Listing / inspecting 

 ```bash 
 

 ``` 
 podman ps -a 
 
 podman network ls ; podman volume ls ; podman secret ls 
 
 podman inspect <ctr> --format '{{.ImageName}}' 
 
 podman inspect <ctr> --format '{{range .Mounts}}{{.Name}} -> {{.Destination}}{{"\n"}}{{end}}' 
 
 podman inspect <ctr> | jq '.[0].Config.Env' 
 
 podman logs -f <ctr> 
 
 podman exec -it <ctr> bash                              # root shell inside, no password 
 
 ``` 

 

 ## Environment variables inside a container 

 ```bash 
 

 ``` 
 podman exec <ctr> printenv 
 
 podman exec <ctr> printenv | grep -iE 'ROOT|PASSWORD|KEY' 
 
 podman exec <ctr> printenv MYSQL_ROOT_PASSWORD | od -c | tail -3     # reveals a stray trailing \n 
 
 ``` 

 

 ## Secrets 

 

 Injected as env at container start (`Secret=<secret>,type=env,target=VAR`). 
   

 MariaDB/PostgreSQL only read their `*_PASSWORD` env on **first** 
   

 initialisation of an empty data dir; afterwards the env var is inert and the 
   

 real password is whatever is in the DB. 

 ```bash 
 

 ``` 
 podman secret inspect --showsecret <secret> 
 
 podman secret inspect --showsecret --format '{{.SecretData}}' <secret> 

 

 # always create WITHOUT a trailing newline 
 
 printf '%s' 'VALUE' | podman secret create <secret> - 
 
 printf '%s' "$(openssl rand -base64 32)" | podman secret create <secret> - 

 

 # replace: rm + create, then restart the consumers 
 
 podman secret rm <secret> && printf '%s' 'VALUE' | podman secret create <secret> - 
 
 ``` 

 

 ## Fixing a secret that has a trailing `\n` (legacy WordPress sites) 

 ```bash 
 

 ``` 
 cat > ~/tmp/fixpw.sh <<'EOF' 
 
 ROOTPW="$(printf '%s' "$MYSQL_ROOT_PASSWORD")"     # $(...) strips the trailing \n 
 
 WPPW="$(printf '%s' "$MYSQL_PASSWORD")" 
 
 mariadb -uroot -p"$MYSQL_ROOT_PASSWORD" <<SQL 
 
 ALTER USER 'root'@'localhost' IDENTIFIED BY '$ROOTPW'; 
 
 ALTER USER 'root'@'%'           IDENTIFIED BY '$ROOTPW'; 
 
 ALTER USER 'wordpress'@'%'      IDENTIFIED BY '$WPPW'; 
 
 FLUSH PRIVILEGES; 
 
 SQL 
 
 EOF 
 
 podman exec -i db-<name> sh < ~/tmp/fixpw.sh 
 
 for s in <name>-db-root-password <name>-db-password; do 
   
   v="$(podman secret inspect --showsecret --format '{{.SecretData}}' "$s")" 
   
   podman secret rm "$s"; printf '%s' "$v" | podman secret create "$s" - 
 
 done 
 
 systemctl --user restart db-<name>.service site-<name>.service     # run back to back with the SQL half 
 
 ``` 


 

 --- 
 _Source: 

 *Source: `dmz-web-podman-cheatsheet.md` v1.1.1 in the `dmz-web-deploy` repo ([[Releases]]). ([Releases](#)). Edit the wiki and the repo copy together._ 
 together.* 
 Common operations 
 [Services](#)[Listing / inspecting](#)[Environment variables inside a container](#)[Secrets](#)[Fixing a secret that has a trailing \n (legacy WordPress sites)](#) 
 ☰