# WebHosting

Shared web applications behind Nginx/Apache, deployed in `/opt/WebHosting`.

- `docker-compose.yaml` combines `stacks/<app>/compose.yaml` into one Compose project.
  Run commands from the repository root; relative paths resolve from there.
- Only Nginx publishes host ports (`80`/`443`) and joins `public` and `backend`.
  Web applications share `backend`; databases use their separate application networks.
  These are bridge networks with outbound access, without `internal: true`.
- Puppet manages secrets through `hiera/data-lx/default/lx-docker-01.psi.ch.yaml`.
  The service env files live under `/etc/webhosting/`, separately from this repo.
- Env files are root-owned (`0600`, directories `0700`) and use `format: raw`:
  keep values literal, without adding quotes or escaping dollar signs.

Puppet must provision all required env files before Compose validation or deployment.
Use `config --quiet` to avoid printing secrets. After an update, check the application;
if its container IP changed, validate and reload Nginx using the host's deployment procedure.