Wiki » History » Version 1
Redmine Admin, 10/25/2026 04:12 PM
| 1 | 1 | Redmine Admin | # dmz-web Infrastructure |
|---|---|---|---|
| 2 | |||
| 3 | Rocky Linux 10.2 DMZ host (`dmz-web`) running every public web service of MDS as **rootless Podman Quadlet** units under `websvcmaster`, behind **Nginx Proxy Manager** (Let's Encrypt). Shared-nothing: each service has its own network, database, app container and volumes. |
||
| 4 | |||
| 5 | | Stack | Network | App container | DB container | DB engine | Public name | |
||
| 6 | | --- | --- | --- | --- | --- | --- | |
||
| 7 | | NPM | all `net-*` | `nginx-proxy-manager` | — | — | host :81/:444 (UI :8181) | |
||
| 8 | | WordPress | `net-<name>` | `site-<name>` | `db-<name>` | MariaDB 11 | `<domain>` (e.g. www./staging.mdsdefense.com) | |
||
| 9 | | Redmine | `net-redmine` | `site-redmine` | `db-redmine` | PostgreSQL | `<redmine-domain>` | |
||
| 10 | | Snipe-IT | `net-snipeit` | `site-snipeit` | `db-snipeit` | MariaDB 11 | `assets.mdsdefense.com` | |
||
| 11 | |||
| 12 | Naming inversion to remember: containers are `db-<name>`, secrets are `<name>-db-…`. |
||
| 13 | |||
| 14 | ## Pages |
||
| 15 | |||
| 16 | - [Conventions](#) — shell setup, where things live, naming |
||
| 17 | - [NPM](#) — reverse proxy, Let's Encrypt, joining a site's network, access lists |
||
| 18 | - [WordPress](#) — add-wordpress-site.sh, volumes, MariaDB access, staging → production |
||
| 19 | - [Redmine](#) — PostgreSQL, bind mounts, Puma reload, mail relay |
||
| 20 | - [Git Workflow](#) — bare repos under /srv/git, who runs what, `deploy-commit.sh`, recovery |
||
| 21 | - [Snipe-IT](#) — APP_KEY, proxy env, upgrades, backups |
||
| 22 | - [Operations](#) — services, inspecting, env vars, secrets, trailing-newline fix |
||
| 23 | - [Health Check](#) — check-sites.sh and the --resolve :444 trick |
||
| 24 | - [Releases](#) — version history of the cheat sheet and scripts |
||
| 25 | ## Repository |
||
| 26 | |||
| 27 | `dmz-web-deploy` (Repository tab) = the host's `~/deploy`: bootstrap/setup scripts, `add-wordpress-site.sh`, `redmine-install.sh`, `check-sites.sh`, `root-bin/deploy-commit.sh`, `quadlet/*` units, and `dmz-web-podman-cheatsheet.md` — the single-file version of this wiki. Secrets are never in the repo; they live only in the Podman secret store. |
||
| 28 | |||
| 29 | ## Working rules |
||
| 30 | |||
| 31 | - Change a unit in the repo working copy (`~/deploy/quadlet/`), commit with `deploy-commit.sh`, then `cp` to `~/.config/containers/systemd/` and `daemon-reload` — never edit the live copy only. |
||
| 32 | - Every change to a running service gets an issue here (Maintenance / Update-Upgrade); the permanent outcome goes to the relevant wiki page, the step-by-step log stays in the issue. |
||
| 33 | - New secrets: `printf '%s' … | podman secret create` — no trailing newline. |
||
| 34 | dmz-web Infrastructure |
||
| 35 | [Pages](#)[Repository](#)[Working rules](#) |
||
| 36 | ☰ |