Rocky Linux 10.2 DMZ host (dmz-web) running every public web service of MDS as rootless Podman Quadlet units under websvcmaster, behind Nginx Proxy Manager (Let's Encrypt). Shared-nothing: each service has its own network, database, app container and volumes.

Naming inversion to remember: containers are db-<name>, secrets are <name>-db-….

Pages¶

• Conventions — shell setup, where things live, naming
• NPM — reverse proxy, Let's Encrypt, joining a site's network, access lists
• WordPress — add-wordpress-site.sh, volumes, MariaDB access, staging → production
• Redmine — PostgreSQL, bind mounts, Puma reload, mail relay
• Git Workflow — bare repos under /srv/git, who runs what, deploy-commit.sh, recovery
• Snipe-IT — APP_KEY, proxy env, upgrades, backups
• Operations — services, inspecting, env vars, secrets, trailing-newline fix
• Health Check — check-sites.sh and the --resolve :444 trick
• Troubleshooting — what is up / defined, bringing a site back, 502 triage, boot persistence, reboot checklist
• Releases — version history of the cheat sheet and scripts

Repository¶

dmz-web-deploy (Repository tab) = the host's ~/deploy: bootstrap/setup scripts, add-wordpress-site.sh, redmine-install.sh, check-sites.sh, root-bin/deploy-commit.sh, quadlet/* units, and dmz-web-podman-cheatsheet.md — the single-file version of this wiki. Secrets are never in the repo; they live only in the Podman secret store.

Working rules¶

• Change a unit in the repo working copy (~/deploy/quadlet/), commit with deploy-commit.sh, then cp to ~/.config/containers/systemd/ and daemon-reload — never edit the live copy only.
• Every change to a running service gets an issue here (Maintenance / Update-Upgrade); the permanent outcome goes to the relevant wiki page, the step-by-step log stays in the issue.
• New secrets: printf '%s' … | podman secret create — no trailing newline.