IT Support » DMZ-WEB Infrastructure

Rocky Linux 10.2 DMZ host (`dmz-web`) running every public web service of MDS as **rootless Podman Quadlet** units under `websvcmaster`, behind **Nginx Proxy Manager** (Let's Encrypt). Shared-nothing: each service has its own network, database, app container and volumes.

| Stack      | Network         | App container    | DB container  | DB engine   | Public name               |

|------------|-----------------|------------------|---------------|-------------|---------------------------|

| NPM        | all `net-*`     | `nginx-proxy-manager` | —        | —           | host :81/:444 (UI :8181)  |

| WordPress  | `net-<name>`    | `site-<name>`    | `db-<name>`   | MariaDB 11  | `<domain>` (e.g. www./staging.mdsdefense.com) |

| Redmine    | `net-redmine`   | `site-redmine`   | `db-redmine`  | PostgreSQL  | `<redmine-domain>`        |

| Snipe-IT   | `net-snipeit`   | `site-snipeit`   | `db-snipeit`  | MariaDB 11  | `assets.mdsdefense.com`   |

| PF         | `net-pf`, `net-pf-db` (Internal) | `site-pf` | `db-pf` | TimescaleDB (PG 16) | `pf.sibernet.com.tr` |

Naming inversion to remember: containers are `db-<name>`, secrets are `<name>-db-…`.

## Pages

Every heading in these pages and in the cheat sheets carries its number — chapter, section, subsection (**3**, **3.1**, **3.1.7**) — and references use it: "§3.1.7" is the same place in the wiki page, in the cheat sheet and in a cross-reference.

| Chapter | Page | What is in it |

|---|---|---|

| 0 | [[Conventions]] | shell setup, where things live, naming |

| 1 | [[NPM]] | reverse proxy, Let's Encrypt, joining a site's network, access lists |

| 2 | [[WordPress]] | add-wordpress-site.sh, volumes, MariaDB access, staging → production |

| 3 | [[Redmine]] | PostgreSQL, bind mounts, Puma reload, mail relay |

| 3.1 | [[Git Workflow]] | bare repos under /srv/git, who runs what, `deploy-commit.sh` (3.1.6), `deploy-publish.sh` (3.1.7), recovery (3.1.8) |

| 4 | [[Snipe-IT]] | APP_KEY, proxy env, pre-flight (4.1), mail (4.2), upgrades (4.3) |

| 5 | [[Operations]] | services, inspecting, env vars, secrets, trailing-newline fix, database engines and upgrades (5.6) |

| 6 | [[Health Check]] | check-sites.sh and the --resolve :444 trick; before go-live checklist (6.1) |

| 7 | [[Troubleshooting]] | what is up / defined, bringing a site back, 502 triage, boot persistence, reboot checklist |

| 8 | [[PF]] | portfolio stack: install (8.1), app code (8.2), operations (8.3: new version 8.3.1, backup 8.3.3), troubleshooting (8.4), using the application (8.5: splits 8.5.5) |

| 9 | [[Releases]] | version history of the cheat sheet (9.1) and scripts (9.2) |

## Repository

`dmz-web-deploy` (Repository tab) = the host's `~/deploy`: bootstrap/setup scripts, `add-wordpress-site.sh`, `redmine-install.sh`, `check-sites.sh`, `pf-install.sh`, `root-bin/deploy-commit.sh` and `root-bin/deploy-publish.sh`, `quadlet/*` units, and the single-file versions of this wiki: `dmz-web-podman-cheatsheet.md` (host) and `pf-mgmt-cheatsheet.md` (PF). Secrets are never in the repo; they live only in the Podman secret store.

## Working rules

* Change a unit in the repo working copy (`~/deploy/quadlet/`), commit with `deploy-commit.sh`, then `cp` to `~/.config/containers/systemd/` and `daemon-reload` — never edit the live copy only.

* Every change to a running service gets an issue here (Maintenance / Update-Upgrade); the permanent outcome goes to the relevant wiki page, the step-by-step log stays in the issue.

* New secrets: `printf '%s' … | podman secret create` — no trailing newline.