Wiki » History » Revision 4
Revision 3 (Redmine Admin, 10/26/2026 10:52 AM) → Revision 4/5 (Redmine Admin, 10/29/2026 08:57 AM)
Rocky Linux 10.2 DMZ host (`dmz-web`) running every public web service of MDS as **rootless Podman Quadlet** units under `websvcmaster`, behind **Nginx Proxy Manager** (Let's Encrypt). Shared-nothing: each service has its own network, database, app container and volumes. | Stack | Network | App container | DB container | DB engine | Public name | |------------|-----------------|------------------|---------------|-------------|---------------------------| | NPM | all `net-*` | `nginx-proxy-manager` | — | — | host :81/:444 (UI :8181) | | WordPress | `net-<name>` | `site-<name>` | `db-<name>` | MariaDB 11 | `<domain>` (e.g. www./staging.mdsdefense.com) | | Redmine | `net-redmine` | `site-redmine` | `db-redmine` | PostgreSQL | `<redmine-domain>` | | Snipe-IT | `net-snipeit` | `site-snipeit` | `db-snipeit` | MariaDB 11 | `assets.mdsdefense.com` | | PF | `net-pf`, `net-pf-db` (Internal) | `site-pf` | `db-pf` | TimescaleDB (PG 16) | `pf.sibernet.com.tr` | Naming inversion to remember: containers are `db-<name>`, secrets are `<name>-db-…`. ## Pages * [[Conventions]] — shell setup, where things live, naming * [[NPM]] — reverse proxy, Let's Encrypt, joining a site's network, access lists * [[WordPress]] — add-wordpress-site.sh, volumes, MariaDB access, staging → production * [[Redmine]] — PostgreSQL, bind mounts, Puma reload, mail relay * [[Git Workflow]] — bare repos under /srv/git, who runs what, `deploy-commit.sh`, recovery * [[Snipe-IT]] — APP_KEY, proxy env, upgrades, backups * [[PF]] — portfolio stack: pf-install.sh, two networks, TimescaleDB backup/restore, app images * [[Operations]] — services, inspecting, env vars, secrets, trailing-newline fix * [[Health Check]] — check-sites.sh and the --resolve :444 trick * [[Troubleshooting]] — what is up / defined, bringing a site back, 502 triage, boot persistence, reboot checklist * [[Releases]] — version history of the cheat sheet and scripts ## Repository `dmz-web-deploy` (Repository tab) = the host's `~/deploy`: bootstrap/setup scripts, `add-wordpress-site.sh`, `redmine-install.sh`, `check-sites.sh`, `pf-install.sh`, `root-bin/deploy-commit.sh` and `root-bin/deploy-publish.sh`, `root-bin/deploy-commit.sh`, `quadlet/*` units, and `dmz-web-podman-cheatsheet.md` — the single-file versions version of this wiki: `dmz-web-podman-cheatsheet.md` (host) and `pf-mgmt-cheatsheet.md` (PF). wiki. Secrets are never in the repo; they live only in the Podman secret store. ## Working rules * Change a unit in the repo working copy (`~/deploy/quadlet/`), commit with `deploy-commit.sh`, then `cp` to `~/.config/containers/systemd/` and `daemon-reload` — never edit the live copy only. * Every change to a running service gets an issue here (Maintenance / Update-Upgrade); the permanent outcome goes to the relevant wiki page, the step-by-step log stays in the issue. * New secrets: `printf '%s' … | podman secret create` — no trailing newline. ## Available Topics {{child_pages}}