Rocky Linux 10.2 DMZ host (dmz-web) running every public web service of MDS as rootless Podman Quadlet units under websvcmaster, behind Nginx Proxy Manager (Let's Encrypt). Shared-nothing: each service has its own network, database, app container and volumes.
| Stack | Network | App container | DB container | DB engine | Public name |
|---|---|---|---|---|---|
| NPM | all net-*
|
nginx-proxy-manager |
— | — | host :81/:444 (UI :8181) |
| WordPress | net-<name> |
site-<name> |
db-<name> |
MariaDB 11 |
<domain> (e.g. www./staging.mdsdefense.com) |
| Redmine | net-redmine |
site-redmine |
db-redmine |
PostgreSQL | <redmine-domain> |
| Snipe-IT | net-snipeit |
site-snipeit |
db-snipeit |
MariaDB 11 | assets.mdsdefense.com |
| PF |
net-pf, net-pf-db (Internal) |
site-pf |
db-pf |
TimescaleDB (PG 16) | pf.sibernet.com.tr |
Naming inversion to remember: containers are db-<name>, secrets are <name>-db-….
Pages¶
Every heading in these pages and in the cheat sheets carries its number — chapter, section, subsection (3, 3.1, 3.1.7) — and references use it: "§3.1.7" is the same place in the wiki page, in the cheat sheet and in a cross-reference.
| Chapter | Page | What is in it |
|---|---|---|
| 0 | Conventions | shell setup, where things live, naming |
| 1 | NPM | reverse proxy, Let's Encrypt, joining a site's network, access lists |
| 2 | WordPress | add-wordpress-site.sh, volumes, MariaDB access, staging → production |
| 3 | Redmine | PostgreSQL, bind mounts, Puma reload, mail relay |
| 3.1 | Git Workflow | bare repos under /srv/git, who runs what, deploy-commit.sh (3.1.6), deploy-publish.sh (3.1.7), recovery (3.1.8) |
| 4 | Snipe-IT | APP_KEY, proxy env, pre-flight (4.1), mail (4.2), upgrades (4.3) |
| 5 | Operations | services, inspecting, env vars, secrets, trailing-newline fix, database engines and upgrades (5.6) |
| 6 | Health Check | check-sites.sh and the --resolve :444 trick; before go-live checklist (6.1) |
| 7 | Troubleshooting | what is up / defined, bringing a site back, 502 triage, boot persistence, reboot checklist |
| 8 | PF | portfolio stack: install (8.1), app code (8.2), operations (8.3: new version 8.3.1, backup 8.3.3), troubleshooting (8.4), using the application (8.5: splits 8.5.5) |
| 9 | Releases | version history of the cheat sheet (9.1) and scripts (9.2) |
Repository¶
dmz-web-deploy (Repository tab) = the host's ~/deploy: bootstrap/setup scripts, add-wordpress-site.sh, redmine-install.sh, check-sites.sh, pf-install.sh, root-bin/deploy-commit.sh and root-bin/deploy-publish.sh, quadlet/* units, and the single-file versions of this wiki: dmz-web-podman-cheatsheet.md (host) and pf-mgmt-cheatsheet.md (PF). Secrets are never in the repo; they live only in the Podman secret store.
Working rules¶
- Change a unit in the repo working copy (
~/deploy/quadlet/), commit withdeploy-commit.sh, thencpto~/.config/containers/systemd/anddaemon-reload— never edit the live copy only. - Every change to a running service gets an issue here (Maintenance / Update-Upgrade); the permanent outcome goes to the relevant wiki page, the step-by-step log stays in the issue.
- New secrets:
printf '%s' … | podman secret create— no trailing newline.
Updated by Redmine Admin 6 days ago · 5 revisions