IT Support » DMZ-WEB Infrastructure

Created by `~/deploy/add-wordpress-site.sh <domain> [short-name] [--no-egress] [--force] [--skip-npm-api]`.

Short name derives from the domain (`www.mdsdefense.com` → `mdsdefense`).

Per site:

| Object        | Name                      | Notes                                      |

|---------------|---------------------------|--------------------------------------------|

| Network       | `net-<name>`              | `net-<name>.network`                       |

| MariaDB       | `db-<name>`               | `mariadb:11`, no PublishPort               |

| WordPress     | `site-<name>`             | `wordpress:php8.3-apache`, no PublishPort  |

| DB volume     | `db-<name>-data`          | `/var/lib/mysql`                           |

| WP volume     | `wp-<name>-content`       | `/var/www/html` (core, themes, plugins, uploads, `.htaccess`) |

| Secrets       | `<name>-db-root-password` | env `MYSQL_ROOT_PASSWORD` in db            |

|               | `<name>-db-password`      | env `MYSQL_PASSWORD` (db) + `WORDPRESS_DB_PASSWORD` (site) |

```bash

# Themes / plugins / uploads on the host

ls ~/.local/share/containers/storage/volumes/wp-<name>-content/_data/wp-content/themes/

# wp-config.php reads the DB password from the env at every request — nothing to edit

podman exec site-<name> grep -n DB_PASSWORD /var/www/html/wp-config.php

# PHP upload limit lives in the volume's .htaccess (php_value block), not in the image

podman exec site-<name> cat /var/www/html/.htaccess

```

MariaDB access (client only exists inside the container):

```bash

podman exec -it db-<name> sh -c 'mariadb -uroot -p"$MYSQL_ROOT_PASSWORD"'

podman exec -it db-<name> mariadb -uroot -p'PASSWORD'                 # single quotes: + and =

podman exec -it db-<name> mariadb -uroot -p"$(podman secret inspect --showsecret --format '{{.SecretData}}' <name>-db-root-password)"

```

```sql

SELECT user, host, plugin FROM mysql.user;

ALTER USER 'wordpress'@'%' IDENTIFIED BY 'NEW';   -- global, no USE needed

FLUSH PRIVILEGES;

```

Dump / restore:

```bash

podman exec db-<name> sh -c 'mariadb-dump -uroot -p"$MYSQL_ROOT_PASSWORD" wordpress' > ~/tmp/<name>-$(date +%F).sql

podman exec -i db-<name> sh -c 'mariadb -uroot -p"$MYSQL_ROOT_PASSWORD" wordpress' < ~/tmp/<name>-YYYY-MM-DD.sql

```

Staging → production migration = DB dump/restore + `wp-content` copy (incl.

`.htaccess`) + search-replace of the URL (`wp search-replace` via WP-CLI or

the Better Search Replace plugin).

**What updates where.** The image holds only PHP and Apache plus a copy of WordPress that is

used to seed an *empty* volume. Once the volume exists, WordPress itself lives in the volume and

is updated there; replacing the image does not touch it.

| Part | Lives in | How it is updated |

|

---

_Source: `dmz-web-podman-cheatsheet.md` v1.8 in the `dmz-web-deploy` repo ([[Releases]]). Edit the wiki and the repo copy together._