Containers site-redmine (Redmine 6, Puma on :3000) + db-redmine
(PostgreSQL) on net-redmine. NPM forwards to site-redmine:3000.

Persistence: files is a named volume; config, plugins, public/images,
public/assets/plugin_assets are host bind mounts under ~/redmine_data/
(added after a container recreate wiped a podman cp'd plugin). Anything
dropped into the container with podman cp outside those paths does NOT
survive a recreate.

# reload Puma after changing a plugin / View Customize / logo (no restart needed)
podman kill -s USR2 site-redmine

# Rails console / rake inside the container
podman exec -it site-redmine bundle exec rails console -e production
podman exec -it site-redmine bundle exec rake redmine:plugins:migrate RAILS_ENV=production

# PostgreSQL
podman exec -it db-redmine psql -U redmine redmine
podman exec db-redmine pg_dump -U redmine redmine > ~/tmp/redmine-$(date +%F).sql

Mail: no SMTP AUTH (M365 Security Defaults stay on) — Exchange Online
IP-based inbound connector relay, port 25 to the tenant MX endpoint
(mdsdefense-com.mail.protection.outlook.com), STARTTLS, no credentials,
sender sysadmin@mdsdefense.com. Redmine's settings:
grep -nE 'address|port|domain|starttls' ~/redmine_data/config/configuration.yml.
Why no password is needed: Exchange Online only accepts mail from IP addresses
it has been told about (the IP-based connector), and this host's public egress IP
is on that list. Every other container on this host leaves through the same IP,
so it can use the same relay the same way (Snipe-IT, below). The one exception is
a container on a network with Internal=true: it has no internet access at all,
so it cannot reach the relay.

Git repositories and the commit/push procedure: Git Workflow.

Source: dmz-web-podman-cheatsheet.md v1.2 in the dmz-web-deploy repo (Releases). Edit the wiki and the repo copy together.