# WebHosting DMZ

Shared DMZ web applications behind Nginx/Apache, deployed in
`/opt/WebHosting_DMZ`.

- `docker-compose.yaml` combines `stacks/<app>/compose.yaml` into one Compose
  project. Run commands from the repository root so relative paths and `.env`
  resolve from there.
- Only Nginx publishes host ports (`80`/`443`) and joins `public` and `backend`.
  Web applications share `backend`; databases use their separate application
  networks.
- Puppet manages the deployment `.env` and the Nginx configuration on the host.
- All virtual hosts use the proxy's existing shared certificate. This repository's
  deployment workflow therefore does not request or link certificates.

Gitea Actions lints YAML and validates the complete Compose model for pull
requests and pushes. After a merge to `main`, it updates `/opt/WebHosting_DMZ`,
starts the Compose project, validates Nginx, and reloads it. Failed commands stop
the job; there is no automatic rollback.

For a manual deployment, run:

```bash
cd /opt/WebHosting_DMZ
git pull --ff-only origin main
docker compose up -d --remove-orphans
docker compose exec -T nginx nginx -t
docker compose exec -T nginx nginx -s reload
```