Project

General

Profile

Actions
History

Wiki » History » Revision 4

« Previous | Revision 4/5 (diff) | Next »
Redmine Admin, 10/29/2026 08:57 AM
deploy-publish.sh

Rocky Linux 10.2 DMZ host (dmz-web) running every public web service of MDS as rootless Podman Quadlet units under websvcmaster, behind Nginx Proxy Manager (Let's Encrypt). Shared-nothing: each service has its own network, database, app container and volumes.

Stack Network App container DB container DB engine Public name
NPM all net-* nginx-proxy-manager — — host :81/:444 (UI :8181)
WordPress net-<name> site-<name> db-<name> MariaDB 11 <domain> (e.g. www./staging.mdsdefense.com)
Redmine net-redmine site-redmine db-redmine PostgreSQL <redmine-domain>
Snipe-IT net-snipeit site-snipeit db-snipeit MariaDB 11 assets.mdsdefense.com
PF net-pf, net-pf-db (Internal) site-pf db-pf TimescaleDB (PG 16) pf.sibernet.com.tr

Naming inversion to remember: containers are db-<name>, secrets are <name>-db-….

Pages

  • Conventions — shell setup, where things live, naming
  • NPM — reverse proxy, Let's Encrypt, joining a site's network, access lists
  • WordPress — add-wordpress-site.sh, volumes, MariaDB access, staging → production
  • Redmine — PostgreSQL, bind mounts, Puma reload, mail relay
  • Git Workflow — bare repos under /srv/git, who runs what, deploy-commit.sh, recovery
  • Snipe-IT — APP_KEY, proxy env, upgrades, backups
  • PF — portfolio stack: pf-install.sh, two networks, TimescaleDB backup/restore, app images
  • Operations — services, inspecting, env vars, secrets, trailing-newline fix
  • Health Check — check-sites.sh and the --resolve :444 trick
  • Troubleshooting — what is up / defined, bringing a site back, 502 triage, boot persistence, reboot checklist
  • Releases — version history of the cheat sheet and scripts

Repository

dmz-web-deploy (Repository tab) = the host's ~/deploy: bootstrap/setup scripts, add-wordpress-site.sh, redmine-install.sh, check-sites.sh, pf-install.sh, root-bin/deploy-commit.sh and root-bin/deploy-publish.sh, quadlet/* units, and the single-file versions of this wiki: dmz-web-podman-cheatsheet.md (host) and pf-mgmt-cheatsheet.md (PF). Secrets are never in the repo; they live only in the Podman secret store.

Working rules

  • Change a unit in the repo working copy (~/deploy/quadlet/), commit with deploy-commit.sh, then cp to ~/.config/containers/systemd/ and daemon-reload — never edit the live copy only.
  • Every change to a running service gets an issue here (Maintenance / Update-Upgrade); the permanent outcome goes to the relevant wiki page, the step-by-step log stays in the issue.
  • New secrets: printf '%s' … | podman secret create — no trailing newline.

Updated by Redmine Admin 8 days ago · 5 revisions