Adminer
Lifecycle: Current. Last verified: 2026-07-17.
| Field | Value |
|---|---|
| Purpose | Controlled web database administration |
| Owner | IT Operations |
| Criticality / recovery priority | Medium / P4 |
| Host/runtime | CT 101, rootless Podman as podsvc |
| Image | docker.io/library/adminer:4.8.1 |
| Unit | adminer.service |
| Route/backend | dbgui.kh3group.com / 192.168.2.20:30082 |
| Network | kh3-backend |
| Persistent data | None |
| Default server | postgres |
Adminer depends on PostgreSQL, Caddy, DNS, and an explicit admin access policy. It must not be broadly exposed without OIDC, VPN, or source restrictions.
Operate
ssh pvessh 'pct exec 101 -- runuser -l podsvc -c \
"XDG_RUNTIME_DIR=/run/user/2000 systemctl --user status adminer.service --no-pager"'
ssh pvessh 'curl -sS -o /dev/null -w "%{http_code}\n" \
http://192.168.2.20:30082/'
Expected: active and normal HTTP response. Validate login only with a least-privilege test role; do not save credentials in the browser.
Upgrade, backup, and restore
Adminer is stateless. Back up the Quadlet/env name and Caddy policy. Pin and test the image, restart only this unit during an approved change, and validate the protected route plus a least-privilege connection. Roll back the image and unit if validation fails.
Troubleshooting
| Symptom | Diagnosis | Remedy |
|---|---|---|
502 |
Test backend/unit | Repair Adminer before Caddy |
| DB timeout | PostgreSQL and kh3-backend |
Repair network/database |
| Login failure | Test same role with native client | Correct grants/credentials outside docs |
| Unprotected public UI | Check Caddy/OPNsense policy | Block route until policy is restored |