IT Support » DMZ-WEB Infrastructure

Rocky Linux 10.2 DMZ host (`dmz-web`) running every public web service of MDS as **rootless Podman Quadlet** units under `websvcmaster`, behind **Nginx Proxy Manager** (Let's Encrypt). Shared-nothing: each service has its own network, database, app container and volumes.

| Stack      | Network         | App container    | DB container  | DB engine   | Public name               |

|------------|-----------------|------------------|---------------|-------------|---------------------------|

| NPM        | all `net-*`     | `nginx-proxy-manager` | —        | —           | host :81/:444 (UI :8181)  |

| WordPress  | `net-<name>`    | `site-<name>`    | `db-<name>`   | MariaDB 11  | `<domain>` (e.g. www./staging.mdsdefense.com) |

| Redmine    | `net-redmine`   | `site-redmine`   | `db-redmine`  | PostgreSQL  | `<redmine-domain>`        |

| Snipe-IT   | `net-snipeit`   | `site-snipeit`   | `db-snipeit`  | MariaDB 11  | `assets.mdsdefense.com`   |

| PF         | `net-pf`, `net-pf-db` (Internal) | `site-pf` | `db-pf` | TimescaleDB (PG 16) | `pf.sibernet.com.tr` |

Naming inversion to remember: containers are `db-<name>`, secrets are `<name>-db-…`.

## Pages

* [[Conventions]] — shell setup, where things live, naming

* [[NPM]] — reverse proxy, Let's Encrypt, joining a site's network, access lists

* [[WordPress]] — add-wordpress-site.sh, volumes, MariaDB access, staging → production

* [[Redmine]] — PostgreSQL, bind mounts, Puma reload, mail relay

* [[Git Workflow]] — bare repos under /srv/git, who runs what, `deploy-commit.sh`, recovery

* [[Snipe-IT]] — APP_KEY, proxy env, upgrades, backups

* [[PF]] — portfolio stack: pf-install.sh, two networks, TimescaleDB backup/restore, app images

* [[Operations]] — services, inspecting, env vars, secrets, trailing-newline fix

* [[Health Check]] — check-sites.sh and the --resolve :444 trick

* [[Troubleshooting]] — what is up / defined, bringing a site back, 502 triage, boot persistence, reboot checklist

* [[Releases]] — version history of the cheat sheet and scripts

## Repository

`dmz-web-deploy` (Repository tab) = the host's `~/deploy`: bootstrap/setup scripts, `add-wordpress-site.sh`, `redmine-install.sh`, `check-sites.sh`, `pf-install.sh`, `root-bin/deploy-commit.sh` and `root-bin/deploy-publish.sh`, `quadlet/*` units, and the single-file versions of this wiki: `dmz-web-podman-cheatsheet.md` (host) and `pf-mgmt-cheatsheet.md` (PF). Secrets are never in the repo; they live only in the Podman secret store.

## Working rules

* Change a unit in the repo working copy (`~/deploy/quadlet/`), commit with `deploy-commit.sh`, then `cp` to `~/.config/containers/systemd/` and `daemon-reload` — never edit the live copy only.

* Every change to a running service gets an issue here (Maintenance / Update-Upgrade); the permanent outcome goes to the relevant wiki page, the step-by-step log stays in the issue.

* New secrets: `printf '%s' … | podman secret create` — no trailing newline.