jh-RLI · Oct 18, 2026 · Oct 15, 2026 · Oct 15, 2026
diff --git a/docs/installation/production-podman/index.md b/docs/installation/production-podman/index.md
@@ -51,6 +51,9 @@ supported production path.
 | **lookup**     | Term autocomplete / lookup — see below.                                                                  |
 | **nginx**      | Host package (not a container): terminates backend TLS on `:443` and proxies to the app.                 |
 
+Monitoring (Prometheus, Grafana and exporters) runs beside these services in its
+own containers and changes none of them; see **[Monitoring](monitoring.md)**.
+
 ### The lookup service
 
 The **lookup** service runs

diff --git a/docs/installation/production-podman/install.md b/docs/installation/production-podman/install.md
@@ -25,9 +25,10 @@ only part that needs root.
 - Outbound network access for the first image build (downloads the OEO release,
   the JDBC driver, and base images).
 
-!!! note "Podman 4.x assumed"
+!!! note "Podman 4.4 or newer"
 
-    This guide targets Podman 4.x (netavark backend, native DNS). Quadlets attach
+    This guide targets Podman 4.4 or newer (netavark backend, native DNS) and is
+    tested with Podman 5.4. Quadlets attach
     each container to the `oep` network explicitly, so the older podman-compose
     networking workarounds do not apply here.
 
@@ -52,16 +53,17 @@ $EDITOR ~/.config/oeplatform/oep.env
 For a first bring-up you only need the database and Fuseki credentials; the
 HTTPS block comes later in this page.
 
-| Variable                                               | Description                                                   |
-| ------------------------------------------------------ | ------------------------------------------------------------- |
-| `POSTGRES_USER` / `POSTGRES_PASSWORD`                  | PostgreSQL superuser credentials.                             |
-| `OEP_DJANGO_USER` / `OEP_DB_PW`                        | DB user Django connects as (often the same as the superuser). |
-| `OEP_DJANGO_HOST` / `OEP_DJANGO_NAME`                  | Keep as `postgres` / `oep_django`.                            |
-| `LOCAL_DB_USER` / `LOCAL_DB_PASSWORD`                  | Credentials for the OEDB (`oedb`) database.                   |
-| `LOCAL_DB_HOST` / `LOCAL_DB_NAME`                      | Keep as `postgres` / `oedb`.                                  |
-| `FUSEKI_ADMIN_PASSWORD`                                | Fuseki web UI admin password.                                 |
-| `FUSEKI_DATASET_1`                                     | Fuseki dataset name — keep as `ds`.                           |
-| `ONTOP_DB_URL` / `ONTOP_DB_USER` / `ONTOP_DB_PASSWORD` | Ontop's connection to the OEDB — see **Ontop**.               |
+| Variable                                               | Description                                                                                                       |
+| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- |
+| `POSTGRES_USER` / `POSTGRES_PASSWORD`                  | PostgreSQL superuser credentials.                                                                                 |
+| `OEP_DJANGO_USER` / `OEP_DB_PW`                        | DB user Django connects as (often the same as the superuser).                                                     |
+| `OEP_DJANGO_HOST` / `OEP_DJANGO_NAME`                  | Keep as `postgres` / `oep_django`.                                                                                |
+| `LOCAL_DB_USER` / `LOCAL_DB_PASSWORD`                  | Credentials for the OEDB (`oedb`) database.                                                                       |
+| `LOCAL_DB_HOST` / `LOCAL_DB_NAME`                      | Keep as `postgres` / `oedb`.                                                                                      |
+| `RDF_DATABASE_HOST`                                    | Keep as `fuseki`; without it every OEKG read answers `503`.                                                       |
+| `FUSEKI_ADMIN_PASSWORD`                                | Not read yet: the Fuseki image expects `ADMIN_PASSWORD` and generates a random admin password on its first start. |
+| `FUSEKI_DATASET_1`                                     | Fuseki dataset name — keep as `ds`.                                                                               |
+| `ONTOP_DB_URL` / `ONTOP_DB_USER` / `ONTOP_DB_PASSWORD` | Ontop's connection to the OEDB — see **Ontop**.                                                                   |
 
 !!! warning "The CSRF origin needs a scheme"
 

diff --git a/docs/installation/production-podman/maintenance.md b/docs/installation/production-podman/maintenance.md
@@ -80,27 +80,30 @@ skips error-log lines, which share the journal.
 ## Backups
 
 Persistent state is in named volumes (physically under the service user's home).
-At minimum, back up the **Postgres** data and the **media** volume regularly,
-and always before a release that runs migrations. List volumes and their
-locations:
+At minimum, back up the **Postgres** data, the **Fuseki** volume (the OEKG) and
+the **media** volume regularly, and always before a release that runs
+migrations. List volumes and their locations:
 
 ```sh
 podman volume ls
-podman volume inspect pgdata
+podman volume inspect systemd-pgdata
 ```
 
+Quadlet prefixes every volume name with `systemd-`.
+
 Use `pg_dump` from inside/against the postgres container for logical database
-backups, and snapshot the media volume for uploaded files. (Physical volume
-placement per server is a separate storage-configuration concern, out of scope
-for this generic guide.)
+backups, and snapshot the media and Fuseki volumes. Stop `oep-oeplatform`, the
+only writer, while copying the Fuseki volume, so the copy is consistent.
+(Physical volume placement per server is a separate storage-configuration
+concern, out of scope for this generic guide.)
 
 ## Reset the database (destructive)
 
 This **deletes all database data**. Only for a throwaway/dev-like environment.
 
 ```sh
 systemctl --user stop oep-oeplatform oep-postgres
-podman volume rm pgdata        # confirm the exact name with: podman volume ls
+podman volume rm systemd-pgdata   # confirm the exact name with: podman volume ls
 systemctl --user start oep-postgres oep-oeplatform
 ```
 

diff --git a/docs/installation/production-podman/monitoring.md b/docs/installation/production-podman/monitoring.md
@@ -12,7 +12,7 @@ SPDX-License-Identifier: AGPL-3.0-or-later
     **[Maintenance](maintenance.md)**. It adds monitoring beside a running
     installation without changing the app's containers.
 
-The monitoring answers five questions:
+The monitoring answers six questions:
 
 | Question                                           | Source                                                                            |
 | -------------------------------------------------- | --------------------------------------------------------------------------------- |

diff --git a/docs/installation/production-podman/ontop.md b/docs/installation/production-podman/ontop.md
@@ -34,7 +34,7 @@ bakes in everything it needs, so there are **no files to place by hand**:
 
   ```sh
   podman build --build-arg JDBC_VERSION=42.7.3 \
-    -t localhost/oep-ontop:latest \
+    -t ghcr.io/openenergyplatform/oeplatform-ontop:latest \
     -f docker/Dockerfile.ontop docker/
   ```
 
@@ -100,7 +100,7 @@ Choose one of two ways to apply it:
     `docker/serviceConfigs/ontop/mapping.obda`, rebuild, and restart:
 
     ```sh
-    podman build -t localhost/oep-ontop:latest -f docker/Dockerfile.ontop docker/
+    podman build -t ghcr.io/openenergyplatform/oeplatform-ontop:latest -f docker/Dockerfile.ontop docker/
     systemctl --user restart oep-ontop
     ```
 

diff --git a/versions/changelogs/current.md b/versions/changelogs/current.md
@@ -31,6 +31,12 @@ the previous release's highlights.
 
 ## Changes
 
+- The Podman deployment guide, reviewed: the Ontop page builds under the image
+  name the unit starts (it named the one that fails with exit code 125), the
+  install page lists `RDF_DATABASE_HOST` and says `FUSEKI_ADMIN_PASSWORD` is not
+  read yet, the backups include the Fuseki volume, and volume names carry
+  Quadlet's `systemd-` prefix
+  [(#2412)](https://github.com/OpenEnergyPlatform/oeplatform/issues/2412)
 - The Podman monitoring stack also watches security: failed logins, rejected
   requests (401/403) and requests to typical attack paths are counted from the
   access log every minute, four alert rules (service down, disk filling up,