diff --git a/development/playbooks/deploy-dev/deploy-dev.yaml b/development/playbooks/deploy-dev/deploy-dev.yaml
index 8e70dcc4b..0d034e328 100644
--- a/development/playbooks/deploy-dev/deploy-dev.yaml
+++ b/development/playbooks/deploy-dev/deploy-dev.yaml
@@ -5,6 +5,12 @@
   vars:
     flavor: katello
     pulp_register_foreman_proxy: false
+    postgresql_publish:
+      - "127.0.0.1:5432:5432"
+    valkey_publish:
+      - "127.0.0.1:6379:6379"
+    candlepin_publish:
+      - "127.0.0.1:23443:23443"
   vars_files:
     - "../../../src/vars/defaults.yml"
     - "../../../src/vars/flavors/{{ flavor }}.yml"
@@ -58,6 +64,7 @@
     - role: pre_install
     - role: systemd_target
     - role: certificates
+    - role: foreman_core_network
     - role: postgresql
     - role: valkey
     - role: candlepin
@@ -68,10 +75,13 @@
         foreman_development_oauth_consumer_key: "{{ foreman_oauth_consumer_key }}"
         foreman_development_oauth_consumer_secret: "{{ foreman_oauth_consumer_secret }}"
         foreman_development_candlepin_oauth_secret: "{{ candlepin_oauth_secret }}"
+        foreman_development_database_password: "{{ foreman_database_password }}"
+
     - role: iop_core
       when:
         - "enabled_features | has_feature('iop')"
       vars:
+        iop_core_gateway_url: "https://localhost:24443"
         iop_core_foreman_oauth_consumer_key: "{{ foreman_oauth_consumer_key }}"
         iop_core_foreman_oauth_consumer_secret: "{{ foreman_oauth_consumer_secret }}"
     - role: cloud_connector
diff --git a/development/playbooks/remote-database/remote-database.yaml b/development/playbooks/remote-database/remote-database.yaml
index 346f91682..7881694d7 100644
--- a/development/playbooks/remote-database/remote-database.yaml
+++ b/development/playbooks/remote-database/remote-database.yaml
@@ -10,6 +10,9 @@
     certificates_ca_password: "CHANGEME"
     postgresql_ssl_crt: "{{ certificates_ca_directory }}/certs/{{ ansible_facts['fqdn'] }}.crt"
     postgresql_ssl_key: "{{ certificates_ca_directory }}/private/{{ ansible_facts['fqdn'] }}.key"
+    postgresql_networks: []
+    postgresql_publish:
+      - "5432:5432"
   vars_files:
     - "../../../src/vars/defaults.yml"
     - "../../../src/vars/flavors/{{ flavor }}.yml"
diff --git a/development/roles/foreman_development/defaults/main.yaml b/development/roles/foreman_development/defaults/main.yaml
index c46766969..6fe323649 100644
--- a/development/roles/foreman_development/defaults/main.yaml
+++ b/development/roles/foreman_development/defaults/main.yaml
@@ -29,11 +29,10 @@ foreman_development_rails_command: "puma -w 2 -p {{ foreman_development_rails_po
 
 foreman_development_url: "http://{{ ansible_facts['fqdn'] }}:{{ foreman_development_rails_port }}"
 
-foreman_development_database_host: "localhost"
+foreman_development_database_host: "127.0.0.1"
 foreman_development_database_port: 5432
 foreman_development_database_name: "foreman_development"
 foreman_development_database_user: "foreman"
-foreman_development_database_password: "foreman" # noqa: no-static-secrets
 
 foreman_development_nodejs_stream: "22"
 
diff --git a/development/roles/foreman_development/templates/database.yml.j2 b/development/roles/foreman_development/templates/database.yml.j2
index 0f5698eb6..506b7ff4b 100644
--- a/development/roles/foreman_development/templates/database.yml.j2
+++ b/development/roles/foreman_development/templates/database.yml.j2
@@ -4,7 +4,7 @@ development:
   pool: 20
   username: {{ foreman_development_database_user }}
   password: {{ foreman_development_database_password }}
-  host: localhost
+  host: {{ foreman_development_database_host }}
   encoding: UTF8
   template: template0
 
@@ -14,7 +14,7 @@ test:
   pool: 20
   username: {{ foreman_development_database_user }}
   password: {{ foreman_development_database_password }}
-  host: localhost
+  host: {{ foreman_development_database_host }}
   encoding: UTF8
   template: template0
 
@@ -24,6 +24,6 @@ production:
   pool: 20
   username: {{ foreman_development_database_user }}
   password: {{ foreman_development_database_password }}
-  host: localhost
+  host: {{ foreman_development_database_host }}
   encoding: UTF8
   template: template0
diff --git a/docs/architecture/iop.md b/docs/architecture/iop.md
index 0f4bf12eb..5966f975c 100644
--- a/docs/architecture/iop.md
+++ b/docs/architecture/iop.md
@@ -10,36 +10,14 @@ The `iop` feature depends on `rh-cloud`, which installs the `foreman_rh_cloud` p
 
 ## Architecture
 
-IOP runs as a set of containerized services managed via podman quadlets on the `iop-core-network` (bridge, `10.130.0.0/24`). The gateway is registered as a Foreman smart proxy at `https://localhost:24443`.
+IOP runs as a set of containerized services managed via podman quadlets on the shared `foreman-core-network` (bridge, `10.130.0.0/24`), alongside Foreman, Postgres, and other co-located services. See [Network Architecture](network.md) for the host/bridge split, unix sockets, and published ports.
+
+The subnet matches the former `iop-core-network` so the gateway image nginx resolver (`10.130.0.1`) can resolve upstream service names. The gateway is registered as a Foreman smart proxy at `https://iop-core-gateway:8443` (host publish remains `127.0.0.1:24443` for host-side tools and tests).
 
 ```mermaid
 graph TB
     subgraph Host["Host System"]
-        Foreman["Foreman<br/>(foreman_rh_cloud)"]
         Apache["Apache httpd"]
-        PG[(PostgreSQL)]
-
-        subgraph Network["iop-core-network (10.130.0.0/24)"]
-            Kafka[Kafka]
-
-            subgraph Core["Core Pipeline"]
-                Ingress[Ingress]
-                Puptoo[Puptoo]
-                Yuptoo[Yuptoo]
-                Engine[Engine]
-            end
-
-            Gateway["Gateway<br/>:24443"]
-
-            subgraph Services["Application Services"]
-                Inventory["Inventory API<br/>:8081"]
-                Advisor["Advisor API<br/>:8000"]
-                Remediation["Remediation API<br/>:3000"]
-                VMAAS["VMAAS<br/>(reposcan + webapp)"]
-                Vuln["Vulnerability<br/>(8 containers)"]
-            end
-        end
-
         subgraph Frontends["Frontend Assets (/var/www/iop)"]
             InventoryFE[Inventory Frontend]
             AdvisorFE[Advisor Frontend]
@@ -49,6 +27,29 @@ graph TB
         CVEMap["CVE Map Downloader<br/>(systemd timer + path watcher)"]
     end
 
+    subgraph Network["foreman-core-network (10.130.0.0/24)"]
+        Foreman["Foreman<br/>(foreman_rh_cloud)"]
+        PG[(PostgreSQL)]
+        Kafka[Kafka]
+
+        subgraph Core["Core Pipeline"]
+            Ingress[Ingress]
+            Puptoo[Puptoo]
+            Yuptoo[Yuptoo]
+            Engine[Engine]
+        end
+
+        Gateway["Gateway<br/>:24443"]
+
+        subgraph Services["Application Services"]
+            Inventory["Inventory API<br/>:8081"]
+            Advisor["Advisor API<br/>:8000"]
+            Remediation["Remediation API<br/>:3000"]
+            VMAAS["VMAAS<br/>(reposcan + webapp)"]
+            Vuln["Vulnerability<br/>(8 containers)"]
+        end
+    end
+
     Foreman -- "smart proxy<br/>relay" --> Gateway
     Gateway --> Kafka
     Apache -- "Alias" --> Frontends
@@ -113,7 +114,7 @@ Key Kafka topics:
 | gateway | `iop-core-gateway` | 127.0.0.1:24443 | nginx proxy, smart proxy relay to Foreman |
 | inventory | `iop-core-host-inventory-migrate` (oneshot), `iop-core-host-inventory`, `iop-core-host-inventory-api`, `iop-core-host-inventory-cleanup` (timer) | 8081 (internal) | Host inventory with DB migration, MQ consumer, REST API, and periodic cleanup |
 | advisor | `iop-service-advisor-backend-api`, `iop-service-advisor-backend-service` | 8000 (internal) | Advisor recommendations |
-| remediation | `iop-service-remediations-api` | 3000 (host network) | Remediation playbook generation |
+| remediation | `iop-service-remediations-api` | 3000 (internal) | Remediation playbook generation |
 | vmaas | `iop-service-vmaas-reposcan`, `iop-service-vmaas-webapp-go` | - | Vulnerability metadata and advisory sync |
 | vulnerability | 8 containers (see below) | 8443 (internal) | Vulnerability assessment pipeline |
 
@@ -132,11 +133,7 @@ Key Kafka topics:
 
 ### Network
 
-All IOP containers join the `iop-core-network` bridge network (`10.130.0.0/24`, gateway `10.130.0.1`). Containers communicate with each other by container name within this network.
-
-Database connectivity uses `host.containers.internal:5432` to reach the host's PostgreSQL instance. SSL is disabled for these internal connections.
-
-The gateway binds only to `127.0.0.1:24443` so it is not externally accessible.
+All IOP containers join `foreman-core-network` and reach Postgres at `postgresql:5432`. The gateway is published on host loopback as `127.0.0.1:24443` (container port `8443`) so it is not externally accessible; the Foreman container talks to it as `https://iop-core-gateway:8443`. The gateway relays to Foreman via `https://host.containers.internal` (Apache on the host). See [Network Architecture](network.md).
 
 ### Smart Proxy Registration
 
@@ -164,7 +161,8 @@ Timers:
 
 ## Databases
 
-IOP creates five PostgreSQL databases, all accessible to containers via `host.containers.internal:5432`:
+IOP creates five PostgreSQL databases, all accessible to containers via the
+`postgresql` container on `foreman-core-network` (`postgresql:5432`):
 
 | Database | User |
 |----------|------|
@@ -180,6 +178,8 @@ Passwords are auto-generated using Ansible's `password` lookup and stored as pod
 
 Advisor and vulnerability services use PostgreSQL foreign data wrappers (FDW) to query the inventory database directly, avoiding REST API overhead for bulk data access.
 
+IOP app containers still connect as `postgresql:5432` on the bridge. FDW is different: Ansible sets up the foreign server from the host (`login_host: 127.0.0.1`, the published IPv4 port), and `CREATE SERVER` stores `host=127.0.0.1`, which Postgres interprets inside its own container so advisor/vuln stay on-box instead of hairpinning through the bridge. See [PostgreSQL from three vantage points](network.md#postgresql-from-three-vantage-points).
+
 The reusable `iop_fdw` role sets up each FDW connection:
 
 1. Enables the `postgres_fdw` extension on the consuming database
@@ -272,8 +272,8 @@ Gateway and service certificates use the default foremanctl CA infrastructure at
 
 | Certificate | Path |
 |-------------|------|
-| Gateway server cert | `certs/localhost.crt` |
-| Gateway server key | `private/localhost.key` |
+| Gateway server cert | `certs/iop-core-gateway.crt` |
+| Gateway server key | `private/iop-core-gateway.key` |
 | Gateway client cert | `certs/localhost-client.crt` |
 | Gateway client key | `private/localhost-client.key` |
 | CA | `certs/ca.crt` |
diff --git a/docs/architecture/network.md b/docs/architecture/network.md
new file mode 100644
index 000000000..74a7f665c
--- /dev/null
+++ b/docs/architecture/network.md
@@ -0,0 +1,197 @@
+# Network Architecture
+
+foremanctl splits networking into two planes: the **host** (public TLS, unix sockets, and a few loopback publishes) and a **shared Podman bridge** used for container-to-container traffic. Apache httpd is the public HTTP(S) front door. Application containers do not publish their APIs on all interfaces.
+
+IOP service internals (Kafka topics, data flow) are covered in [IOP](iop.md). This document describes how packets move between the host, containers, and clients.
+
+## Planes
+
+```mermaid
+flowchart TB
+    subgraph Clients["Clients"]
+        Browser["Browsers, Hammer, registered hosts"]
+    end
+
+    subgraph Host["Host"]
+        Apache["Apache httpd<br/>:80 / :443"]
+        Socks["systemd unix sockets<br/>/run/httpd.*.sock"]
+        Loopback["Loopback publishes<br/>127.0.0.1 only"]
+        Proxy["foreman-proxy<br/>network: host<br/>:8443"]
+        Apache --> Socks
+    end
+
+    subgraph Bridge["foreman-core-network (bridge, 10.130.0.0/24)"]
+        FM[foreman]
+        PG[(postgresql)]
+        VK[valkey]
+        CP[candlepin]
+        Pulp["pulp-api / pulp-content / pulp-worker"]
+        GW[iop-core-gateway]
+        IOP["other IOP containers"]
+        FM --- PG
+        FM --- VK
+        FM --- CP
+        Pulp --- PG
+        Pulp --- VK
+        IOP --- PG
+        GW --- IOP
+    end
+
+    Browser --> Apache
+    Browser --> Proxy
+    Socks -.-> FM
+    Socks -.-> Pulp
+    Loopback -.-> PG
+    Loopback -.-> GW
+    GW -->|"host.containers.internal"| Apache
+    FM -->|"https://iop-core-gateway:8443"| GW
+    Proxy -->|"https://FQDN"| Apache
+```
+
+| Plane | What lives here | How others reach it |
+|-------|-----------------|---------------------|
+| Host network | Apache httpd, Hammer, IOP downloaders, Foreman Proxy | Public `:80`/`:443` and proxy `:8443` |
+| Host unix sockets | systemd socket units for Foreman and Pulp | Apache `ProxyPass` to `unix://...` |
+| Host loopback | Published container ports bound to `127.0.0.1` | Host-side Ansible, tests, and tools |
+| `foreman-core-network` | Foreman, Postgres, Valkey, Candlepin, Pulp, IOP | Container DNS name on `10.130.0.0/24` |
+
+## Prerequisite: netavark
+
+Deployments require Podman's **netavark** network backend (not CNI). `check_podman_network_backend` fails the install otherwise.
+
+Netavark provides the bridge, gateway IP, and [aardvark-dns](https://github.com/containers/aardvark-dns) so containers resolve each other by container name.
+
+## Shared bridge: `foreman-core-network`
+
+The `foreman_core_network` role creates the network early in both `foremanctl deploy` and `foremanctl deploy-proxy`:
+
+| Setting | Value |
+|---------|-------|
+| Name | `foreman-core-network` |
+| Driver | `bridge` |
+| Subnet | `10.130.0.0/24` |
+| Gateway | `10.130.0.1` |
+
+The subnet matches the former `iop-core-network`. The IOP gateway image uses `10.130.0.1` as its nginx resolver; that address is the bridge gateway, where aardvark-dns answers container-name lookups.
+
+Containers on this network talk by **container name**, not by published host ports. Examples:
+
+| Client | Target | Why |
+|--------|--------|-----|
+| Foreman, Candlepin, Pulp, IOP apps | `postgresql:5432` | Internal database |
+| Foreman cache / Dynflow | `valkey:6379` | Redis-protocol cache and queues |
+| Foreman (Katello) | `https://candlepin:23443/candlepin` | Entitlement service |
+| IOP services | `iop-core-kafka:9092` | Message bus (`advertised.listeners` uses this name) |
+| Foreman (smart proxy) | `https://iop-core-gateway:8443` | IOP gateway |
+| VMAAS | `http://iop-core-gateway:9090` | Katello/CVE map via gateway |
+
+Certificates include extra DNS names for names used over TLS on the bridge (`candlepin`, `iop-core-gateway`). See [Certificates](../user/certificates.md).
+
+### Members
+
+These containers join `foreman-core-network`:
+
+- `postgresql` (internal database mode)
+- `valkey`
+- `candlepin`
+- `foreman`, `dynflow-sidekiq@*`, `foreman-recurring@*`, `foreman-db-migrate`
+- `pulp-api`, `pulp-content`, `pulp-worker@*`
+- All IOP containers (Kafka, ingress, processors, gateway, inventory, advisor, remediation, VMAAS, vulnerability)
+
+### Non-members
+
+| Component | Network | Reason |
+|-----------|---------|--------|
+| Apache httpd | Host (RPM) | Public TLS terminator; proxies to unix sockets |
+| Hammer | Host | CLI talking to `https://FQDN` |
+| `foreman-proxy` | `network: host` | Bind host ports (`8443`, templates `:8000`) and host-level DHCP/TFTP/DNS |
+| IOP frontends | None (extracted files) | Served by Apache aliases under `/var/www/iop` |
+| IOP CVE map / VEX downloaders | Host systemd | Fetch files and call the gateway loopback publish |
+
+## Host to container
+
+### Unix sockets (Foreman and Pulp)
+
+Foreman and Pulp do not publish HTTP ports. systemd socket units listen on the host and pass the connection into the container (`sdnotify` + `Requires=<name>.socket`):
+
+| Socket unit | ListenStream | Apache backend |
+|-------------|--------------|----------------|
+| `foreman.socket` | `/run/httpd.foreman.sock` | `unix:///run/httpd.foreman.sock\|http://foreman` |
+| `pulp-api.socket` | `/run/httpd.pulp-api.sock` | `unix:///run/httpd.pulp-api.sock\|http://pulpcore-api` |
+| `pulp-content.socket` | `/run/httpd.pulp-content.sock` | `unix:///run/httpd.pulp-content.sock\|http://pulpcore-content` |
+
+Apache `ProxyPass` sends `/pulp/...` to the Pulp sockets and everything else (on a Foreman server) to the Foreman socket. SELinux `daemons_enable_cluster_mode` is enabled so httpd can use those unix sockets. `httpd.service` is ordered `After=` / `Wants=` `foreman.socket`.
+
+Socket units are owned by `apache` with mode `0600`, so only the host httpd can connect.
+
+### Loopback publishes
+
+A published port is a host bind of `container_port` onto `127.0.0.1`. It is not reachable from other machines.
+
+| Container | Production publish | Purpose |
+|-----------|--------------------|---------|
+| `postgresql` | `127.0.0.1:5432:5432` | Ansible `community.postgresql` modules, FDW setup, tests |
+| `iop-core-gateway` | `127.0.0.1:24443:8443` | Host-side tools (CVE map reposync trigger) |
+
+Valkey and Candlepin are **not** published in production. They are reachable only on the bridge (`valkey:6379`, `candlepin:23443`). Tests assert those ports are absent from `podman port` and from `0.0.0.0` / `[::]` listeners.
+
+Postgres is published on IPv4 loopback only (`127.0.0.1`, not `::1` or `0.0.0.0`).
+
+### PostgreSQL from three vantage points
+
+```mermaid
+flowchart LR
+    Ansible["Ansible / tests on host"] -->|"127.0.0.1:5432<br/>published"| PG
+    Apps["Foreman, Pulp, IOP apps"] -->|"postgresql:5432<br/>bridge DNS"| PG
+    FDW["postgres_fdw inside PG"] -->|"127.0.0.1:5432<br/>container loopback"| PG
+    PG[(postgresql container)]
+```
+
+- **Host processes** use the published port (`127.0.0.1:5432`). Ansible roles use `database_management_host`, which resolves to that address in internal mode.
+- **Peer containers** use `postgresql:5432` on `foreman-core-network`.
+- **Foreign data wrappers** (advisor and vulnerability databases) store `host=127.0.0.1`. That address is interpreted *inside* the Postgres container, so FDW connections stay on the same server and do not hairpin through the published host port.
+
+## Container to host
+
+Containers reach host services at `host.containers.internal` (the bridge gateway from the container's point of view).
+
+The IOP gateway nginx relay uses this to call Foreman through Apache:
+
+```
+proxy_pass https://host.containers.internal;
+```
+
+Foreman itself is not listening on a container IP for HTTPS; Apache on the host is. The gateway therefore leaves the bridge, hits the host, and Apache forwards the request into the Foreman unix socket.
+
+Host-side IOP timers (CVE map, VEX) call the gateway at `https://localhost:24443` (the loopback publish), not via container DNS.
+
+## Public entry points
+
+| Listener | Process | Audience |
+|----------|---------|----------|
+| `:80` / `:443` | Apache httpd | UI, API, Pulp content, `/pub` |
+| `:8443` | `foreman-proxy` (host network) | Smart-proxy clients, Capsule/proxy registration |
+
+Nothing else is intended to be reachable off-host. Application databases, Valkey, Candlepin, Kafka, and IOP APIs stay on the bridge or on loopback.
+
+On a **proxy** (Capsule) node, Apache still terminates TLS and proxies Pulp locally, but `/rhsm` and selected Foreman routes are proxied to the server FQDN (`httpd_foreman_url`) rather than to a local Foreman socket. SELinux `httpd_can_network_relay` is enabled for that remote relay.
+
+## External database mode
+
+When `database_mode: external`, the `postgresql` container is not deployed. Foreman, Candlepin, and Pulp use `--database-host` (and related SSL flags). Those containers still sit on `foreman-core-network` and reach the remote server through the bridge's default NAT/route.
+
+IOP requires internal database mode and is skipped when the database is external.
+
+Ansible connectivity checks run **from the host**, so they use `database_management_host` (`127.0.0.1` in internal mode via the published port, or the same value as `database_host` in external mode). Container connection strings use `database_host` (`postgresql` internally, or the remote hostname externally), not the management host, except where noted above for FDW.
+
+## Development (`forge deploy-dev`)
+
+In the development environment Foreman runs on the host (`bundle exec`), not in the `foreman` container. Extra loopback publishes exist so that host-side Rails can reach services that production talks to by container name:
+
+| Extra publish | Host use |
+|---------------|----------|
+| `127.0.0.1:5432:5432` | Rails database.yml (also present in production) |
+| `127.0.0.1:6379:6379` | Rails cache / Dynflow |
+| `127.0.0.1:23443:23443` | Katello → Candlepin |
+
+IOP smart-proxy registration is overridden to `https://localhost:24443` because the registering Foreman process is on the host, not on `foreman-core-network`. Production registers `https://iop-core-gateway:8443` so the Foreman *container* can reach the gateway by DNS name with a matching TLS certificate.
diff --git a/docs/developer/deployment.md b/docs/developer/deployment.md
index 8c7ef148e..bdd73a0f5 100644
--- a/docs/developer/deployment.md
+++ b/docs/developer/deployment.md
@@ -95,7 +95,7 @@ IOP (Insights Operating Platform) deploys on-premise Insights services for advis
 ./foremanctl deploy --add-feature iop
 ```
 
-See [IOP Architecture](iop.md) for details on the services deployed and configuration options.
+See [IOP Architecture](../architecture/iop.md) for details on the services deployed and configuration options, and [Network Architecture](../architecture/network.md) for how IOP sits on the shared container network.
 
 ### Image Management
 
@@ -451,3 +451,5 @@ As `foremanctl` is Ansible-based, this means that the ["control node"](https://d
 To simplify the "install `foremanctl`" step, our test infrastructure uses different systems for the "control node" (the system the source code is cloned to) and the "target node" (the VM created by our development tooling).
 
 There is a desire to allow deployments where a single `foremanctl` control node manages multiple managed nodes, but no code exists yet for this.
+
+How those components talk to each other on the managed node — the shared `foreman-core-network` bridge, Apache unix sockets, and loopback publishes — is described in [Network Architecture](../architecture/network.md).
diff --git a/docs/user/certificates.md b/docs/user/certificates.md
index f00a96575..15242e2da 100644
--- a/docs/user/certificates.md
+++ b/docs/user/certificates.md
@@ -243,7 +243,7 @@ For `certificate_source: custom_server`:
 
 1. **CA Generation**: Generate self-signed internal CA certificate and key with 20-year validity
 2. **Custom Server Certificates**: Copy the custom server cert, key, and CA bundle from user-provided paths to `/var/lib/foremanctl/certs/` (only when certificate paths are provided)
-3. **Host Certificate Issuance**: Generate client certificate and localhost certificate signed by the internal CA (server cert for FQDN is skipped)
+3. **Host Certificate Issuance**: Generate client certificates for every hostname. Internally issued server certificates are still created for localhost and other internal names (`candlepin`, `iop-core-gateway`). The public FQDN server certificate is skipped (the custom cert is used instead).
 
 #### Auth Bundle Generation
 
diff --git a/docs/user/parameters.md b/docs/user/parameters.md
index ba6847ba7..a2f853f76 100644
--- a/docs/user/parameters.md
+++ b/docs/user/parameters.md
@@ -33,7 +33,7 @@ There are multiple use cases from the users perspective that dictate what parame
 | Parameter | Description | foreman-installer Parameters |
 | ----------| ----------- | ---------------------------- |
 | `--database-mode` | Denotes if the database is internally or externally managed | `--foreman-db-manage`<br/> `--katello-candlepin-db-manage`<br/> `--foreman-proxy-content-pulpcore-manage-postgresql` |
-| `--database-host` | Location to connect to the database | `--foreman-db-host`<br/> `--katello-candlepin-db-host`<br/> `--foreman-proxy-content-pulpcore-postgresql-host` |
+| `--database-host` | Hostname application containers use to reach PostgreSQL (`postgresql` internal; remote host external) | `--foreman-db-host`<br/> `--katello-candlepin-db-host`<br/> `--foreman-proxy-content-pulpcore-postgresql-host` |
 | `--database-port` | Port to connect to the database | `--foreman-db-port`<br/> `--katello-candlepin-db-port`<br/> `--foreman-proxy-content-pulpcore-postgresql-port` |
 | `--database-ssl-mode` | SSL verification mode to use | `--foreman-db-sslmode` <br/> `--katello-candlepin-db-ssl-verify` <br/> `--katello-candlepin-db-ssl` <br/> `--foreman-proxy-content-pulpcore-postgresql-ssl`|
 | `--database-ssl-ca` | Path to the database CA certificate | `--foreman-db-root-cert` <br/> `--katello-candlepin-db-ssl-ca` <br/> `--foreman-proxy-content-pulpcore-db-ssl-root-ca` |
diff --git a/src/playbooks/_database_connection/metadata.obsah.yaml b/src/playbooks/_database_connection/metadata.obsah.yaml
index e7d61a057..7e087ce8e 100644
--- a/src/playbooks/_database_connection/metadata.obsah.yaml
+++ b/src/playbooks/_database_connection/metadata.obsah.yaml
@@ -1,7 +1,7 @@
 ---
 variables:
   database_host:
-    help: Host of the PostgreSQL database.
+    help: Hostname application containers use to reach PostgreSQL (`postgresql` when the database runs locally; the remote host in external mode).
   database_port:
     help: Port of the PostgreSQL database.
 
diff --git a/src/playbooks/deploy-proxy/deploy-proxy.yaml b/src/playbooks/deploy-proxy/deploy-proxy.yaml
index 615e13120..67f86957a 100644
--- a/src/playbooks/deploy-proxy/deploy-proxy.yaml
+++ b/src/playbooks/deploy-proxy/deploy-proxy.yaml
@@ -26,6 +26,7 @@
         certificate_checks_key: "{{ server_key }}"
         certificate_checks_ca: "{{ server_ca_certificate }}"
     - role: oauth_from_bundle
+    - role: foreman_core_network
     - role: postgresql
       when:
         - database_mode == 'internal'
diff --git a/src/playbooks/deploy/deploy.yaml b/src/playbooks/deploy/deploy.yaml
index 0aa62d905..2de1649af 100644
--- a/src/playbooks/deploy/deploy.yaml
+++ b/src/playbooks/deploy/deploy.yaml
@@ -26,6 +26,7 @@
         certificate_checks_certificate: "{{ server_certificate }}"
         certificate_checks_key: "{{ server_key }}"
         certificate_checks_ca: "{{ server_ca_certificate }}"
+    - role: foreman_core_network
     - role: postgresql
       when:
         - database_mode == 'internal'
diff --git a/src/roles/backup/tasks/main.yaml b/src/roles/backup/tasks/main.yaml
index f73999b17..9d9602ad3 100644
--- a/src/roles/backup/tasks/main.yaml
+++ b/src/roles/backup/tasks/main.yaml
@@ -63,7 +63,7 @@
 
     - name: Wait for PostgreSQL readiness
       ansible.builtin.command:
-        cmd: pg_isready -h {{ database_host }} -p {{ database_port }}
+        cmd: pg_isready -h {{ database_management_host }} -p {{ database_port }}
       register: backup_pg_ready
       retries: "{{ backup_postgresql_ready_retries }}"
       delay: "{{ backup_postgresql_ready_delay }}"
@@ -77,7 +77,7 @@
         db_entry:
           name: "{{ item.name }}"
           database: "{{ item.database }}"
-          host: "{{ database_host }}"
+          host: "{{ database_management_host }}"
           port: "{{ database_port }}"
           user: "{{ item.user }}"
           password: "{{ item.password }}"
diff --git a/src/roles/candlepin/defaults/main.yml b/src/roles/candlepin/defaults/main.yml
index 322cceae1..cf0363c2d 100644
--- a/src/roles/candlepin/defaults/main.yml
+++ b/src/roles/candlepin/defaults/main.yml
@@ -1,6 +1,6 @@
 ---
 candlepin_ssl_port: 23443
-candlepin_hostname: localhost
+candlepin_hostname: 0.0.0.0
 candlepin_tls_versions:
   - "TLSv1.2"
   - "TLSv1.3"
@@ -10,7 +10,10 @@ candlepin_container_image: quay.io/foreman/candlepin
 candlepin_container_tag: "4.4.14"
 candlepin_secret_mount_opts: "mode=0440,uid=0,gid=53,type=mount"
 
-candlepin_database_host: localhost
+candlepin_networks:
+  - foreman-core-network
+
+candlepin_database_host: postgresql
 candlepin_database_port: 5432
 candlepin_database_ssl: false
 candlepin_database_ssl_mode: disable
diff --git a/src/roles/candlepin/tasks/main.yml b/src/roles/candlepin/tasks/main.yml
index 3db3d067f..ae05e8608 100644
--- a/src/roles/candlepin/tasks/main.yml
+++ b/src/roles/candlepin/tasks/main.yml
@@ -74,7 +74,8 @@
     name: "candlepin"
     image: candlepin.image
     state: quadlet
-    network: host
+    network: "{{ candlepin_networks }}"
+    publish: "{{ candlepin_publish | default(omit) }}"
     hostname: "{{ ansible_facts['hostname'] }}.local"
     secrets:
       - 'candlepin-ca-cert,target=/etc/candlepin/certs/candlepin-ca.crt,{{ candlepin_secret_mount_opts }}'
diff --git a/src/roles/certificates/defaults/main.yml b/src/roles/certificates/defaults/main.yml
index d194c2bcc..b4c9db9a2 100644
--- a/src/roles/certificates/defaults/main.yml
+++ b/src/roles/certificates/defaults/main.yml
@@ -12,6 +12,8 @@ certificates_output_directory_keys: "{{ certificates_output_directory }}/private
 certificates_output_directory_requests: "{{ certificates_output_directory }}/requests"
 certificates_ca_subject: 'Foreman Self-signed CA'
 certificates_server_aliases: []
+certificates_hostname_extra_sans: {}
+certificates_internal_hostnames: "{{ ['localhost'] + (certificates_hostname_extra_sans.keys() | list) }}"
 certificates_algorithm_type: RSA
 certificates_algorithm_size: 4096
 certificates_ca_validity_days: 7300
diff --git a/src/roles/certificates/tasks/host.yml b/src/roles/certificates/tasks/host.yml
index 02aedf02f..493269e95 100644
--- a/src/roles/certificates/tasks/host.yml
+++ b/src/roles/certificates/tasks/host.yml
@@ -4,6 +4,7 @@
   when:
     - certificates_source == 'custom_server'
     - certificates_custom_server_certificate is defined
+    - certificates_hostname not in (certificates_internal_hostnames | list)
 
 - name: Issue certificates
   ansible.builtin.include_tasks: issue.yml
diff --git a/src/roles/certificates/tasks/issue.yml b/src/roles/certificates/tasks/issue.yml
index 0886fb257..ea0932570 100644
--- a/src/roles/certificates/tasks/issue.yml
+++ b/src/roles/certificates/tasks/issue.yml
@@ -1,7 +1,12 @@
 ---
 - name: Issue server certificate
   when:
-    - (certificates_source != 'custom_server') or (certificates_hostname == 'localhost')
+    - (certificates_source != 'custom_server') or (certificates_hostname in (certificates_internal_hostnames | list))
+  vars:
+    _certificates_alias_sans: "{{ certificates_server_aliases if certificates_hostname != 'localhost' else [] }}"
+    _certificates_named_sans: "{{ certificates_hostname_extra_sans[certificates_hostname] | default([]) }}"
+    _certificates_extra_sans: "{{ _certificates_alias_sans + _certificates_named_sans }}"
+    _certificates_desired_server_sans: "{{ ([certificates_hostname] + _certificates_extra_sans) | unique | map('regex_replace', '^', 'DNS:') | list }}"
   block:
     - name: 'Create server private key'
       community.crypto.openssl_privatekey:
@@ -21,11 +26,16 @@
           - keyEncipherment
         extended_key_usage:
           - serverAuth
-      vars:
-        _certificates_extra_sans: "{{ certificates_server_aliases if certificates_hostname != 'localhost' else [] }}"
-        _certificates_desired_server_sans: "{{ ([certificates_hostname] + _certificates_extra_sans) | map('regex_replace', '^', 'DNS:') | list }}"
+
+    - name: 'Read existing server certificate'
+      community.crypto.x509_certificate_info:
+        path: "{{ certificates_output_directory_certs }}/{{ certificates_hostname }}.crt"
+      register: _certificates_existing_server
+      failed_when: false
 
     - name: 'Sign server certificate'
+      vars:
+        _certificates_missing_sans: "{{ _certificates_desired_server_sans | difference(_certificates_existing_server.subject_alt_name | default([])) }}"
       community.crypto.x509_certificate:
         path: "{{ certificates_output_directory_certs }}/{{ certificates_hostname }}.crt"
         csr_path: "{{ certificates_output_directory_requests }}/{{ certificates_hostname }}.csr"
@@ -33,7 +43,7 @@
         ownca_path: "{{ certificates_ca_directory_certs }}/ca.crt"
         ownca_privatekey_path: "{{ certificates_ca_directory_keys }}/ca.key"
         ownca_not_after: "+{{ certificates_validity_days }}d"
-        force: "{{ certificates_renew | bool }}"
+        force: "{{ (certificates_renew | bool) or (_certificates_missing_sans | length > 0) }}"
 
 - name: 'Create client private key'
   community.crypto.openssl_privatekey:
diff --git a/src/roles/check_database_index/tasks/main.yml b/src/roles/check_database_index/tasks/main.yml
index 42f34350a..2136e87c0 100644
--- a/src/roles/check_database_index/tasks/main.yml
+++ b/src/roles/check_database_index/tasks/main.yml
@@ -2,7 +2,7 @@
 - name: Check if amcheck extension is installed
   community.postgresql.postgresql_query:
     login_db: "{{ check_database_index_database }}"
-    login_host: "{{ database_host }}"
+    login_host: "{{ database_management_host }}"
     login_port: "{{ database_port }}"
     login_user: postgres
     login_password: "{{ postgresql_admin_password }}"
@@ -19,7 +19,7 @@
     - name: Execute amcheck integrity check
       community.postgresql.postgresql_query:
         login_db: "{{ check_database_index_database }}"
-        login_host: "{{ database_host }}"
+        login_host: "{{ database_management_host }}"
         login_port: "{{ database_port }}"
         login_user: postgres
         login_password: "{{ postgresql_admin_password }}"
diff --git a/src/roles/check_duplicate_permissions/tasks/main.yaml b/src/roles/check_duplicate_permissions/tasks/main.yaml
index 0bdaf4fa4..f78567f70 100644
--- a/src/roles/check_duplicate_permissions/tasks/main.yaml
+++ b/src/roles/check_duplicate_permissions/tasks/main.yaml
@@ -5,7 +5,7 @@
     login_db: "{{ foreman_database_name }}"
     login_user: "{{ foreman_database_user }}"
     login_password: "{{ foreman_database_password }}"
-    login_host: "{{ foreman_database_host }}"
+    login_host: "{{ database_management_host }}"
     query: |
       SELECT id, name
       FROM permissions p
diff --git a/src/roles/check_foreman_tasks/tasks/main.yaml b/src/roles/check_foreman_tasks/tasks/main.yaml
index f3820cd55..344e40be2 100644
--- a/src/roles/check_foreman_tasks/tasks/main.yaml
+++ b/src/roles/check_foreman_tasks/tasks/main.yaml
@@ -4,7 +4,7 @@
     login_db: "{{ foreman_database_name }}"
     login_user: "{{ foreman_database_user }}"
     login_password: "{{ foreman_database_password }}"
-    login_host: "{{ foreman_database_host }}"
+    login_host: "{{ database_management_host }}"
     query: |
       SELECT count(*) AS count
         FROM foreman_tasks_tasks
diff --git a/src/roles/check_host_facts_count/tasks/main.yaml b/src/roles/check_host_facts_count/tasks/main.yaml
index 7400013ea..221d4b7c5 100644
--- a/src/roles/check_host_facts_count/tasks/main.yaml
+++ b/src/roles/check_host_facts_count/tasks/main.yaml
@@ -4,7 +4,7 @@
     login_db: "{{ foreman_database_name }}"
     login_user: "{{ foreman_database_user }}"
     login_password: "{{ foreman_database_password }}"
-    login_host: "{{ foreman_database_host }}"
+    login_host: "{{ database_management_host }}"
     query: |
       SELECT fact_values.host_id, count(fact_values.id) as count
       FROM fact_values
diff --git a/src/roles/foreman/defaults/main.yaml b/src/roles/foreman/defaults/main.yaml
index dfa026572..6365a6fd8 100644
--- a/src/roles/foreman/defaults/main.yaml
+++ b/src/roles/foreman/defaults/main.yaml
@@ -5,13 +5,17 @@ foreman_container_name: foreman
 
 foreman_database_name: foreman
 foreman_database_user: foreman
-foreman_database_host: localhost
+# On the shared network, reach Postgres by container name (not host loopback).
+foreman_database_host: postgresql
 foreman_database_port: 5432
 foreman_database_pool: 9
 foreman_database_ssl_mode: disable
 foreman_database_ssl_ca: # noqa: no-empty-defaults
 foreman_database_ssl_ca_path: /etc/foreman/db-ca.crt
 
+
+foreman_networks:
+  - foreman-core-network
 foreman_name: "{{ ansible_facts['fqdn'] }}"
 foreman_listen_stream: localhost:3000
 foreman_url: "http://{{ ansible_facts['fqdn'] }}:3000"
@@ -55,7 +59,7 @@ foreman_env:
   FOREMAN_PUMA_WORKERS: "{{ foreman_puma_workers }}"
 
 foreman_dynflow_extra_env:
-  DYNFLOW_REDIS_URL: "redis://localhost:6379/6"
+  DYNFLOW_REDIS_URL: "redis://valkey:6379/6"
   REDIS_PROVIDER: "DYNFLOW_REDIS_URL"
 
 foreman_dynflow_env: "{{ foreman_env | ansible.builtin.combine(foreman_dynflow_extra_env) }}"
diff --git a/src/roles/foreman/tasks/main.yaml b/src/roles/foreman/tasks/main.yaml
index d35d0c0a8..8c8ffb06e 100644
--- a/src/roles/foreman/tasks/main.yaml
+++ b/src/roles/foreman/tasks/main.yaml
@@ -113,7 +113,7 @@
     image: foreman.image
     state: quadlet
     sdnotify: true
-    network: host
+    network: "{{ foreman_networks }}"
     hostname: "{{ ansible_facts['hostname'] }}.local"
     volume:
       - 'foreman-data-run:/var/run/foreman:rw,z,U'
@@ -148,7 +148,7 @@
     image: foreman.image
     state: quadlet
     sdnotify: true
-    network: host
+    network: "{{ foreman_networks }}"
     hostname: "{{ ansible_facts['hostname'] }}.local"
     volume:
       - 'foreman-data-run:/var/run/foreman:rw,z,U'
@@ -193,7 +193,7 @@
     state: quadlet
     image: foreman.image
     sdnotify: false
-    network: host
+    network: "{{ foreman_networks }}"
     hostname: "{{ ansible_facts['hostname'] }}.local"
     command: "foreman-rake {{ item.rake }}"
     volume:
@@ -228,7 +228,7 @@
     state: quadlet
     image: foreman.image
     sdnotify: false
-    network: host
+    network: "{{ foreman_networks }}"
     command: bash -c "bin/rails db:migrate && bin/rails db:seed"
     env: "{{ foreman_env }}"
     secrets: "{{ foreman_secrets }}"
diff --git a/src/roles/foreman/templates/katello.yaml.j2 b/src/roles/foreman/templates/katello.yaml.j2
index 14450c508..4d9818b95 100644
--- a/src/roles/foreman/templates/katello.yaml.j2
+++ b/src/roles/foreman/templates/katello.yaml.j2
@@ -3,7 +3,7 @@
   :rest_client_timeout: 3600
 
   :candlepin:
-    :url: https://localhost:23443/candlepin
+    :url: "https://candlepin:23443/candlepin"
     :oauth_key: "katello"
     :oauth_secret: "{{ candlepin_oauth_secret }}"
     :ca_cert_file: /etc/foreman/katello-default-ca.crt
diff --git a/src/roles/foreman/templates/settings.yaml.j2 b/src/roles/foreman/templates/settings.yaml.j2
index cfbaf3a9d..010616726 100644
--- a/src/roles/foreman/templates/settings.yaml.j2
+++ b/src/roles/foreman/templates/settings.yaml.j2
@@ -17,7 +17,7 @@
 :rails_cache_store:
   :type: redis
   :urls:
-    - redis://localhost:6379/4
+    - "redis://valkey:6379/4"
   :options:
     :compress: true
     :namespace: foreman
diff --git a/src/roles/foreman_core_network/defaults/main.yaml b/src/roles/foreman_core_network/defaults/main.yaml
new file mode 100644
index 000000000..8c7dfc30b
--- /dev/null
+++ b/src/roles/foreman_core_network/defaults/main.yaml
@@ -0,0 +1,5 @@
+---
+foreman_core_network_name: "foreman-core-network"
+foreman_core_network_subnet: "10.130.0.0/24"
+foreman_core_network_gateway: "10.130.0.1"
+foreman_core_network_driver: "bridge"
diff --git a/src/roles/foreman_core_network/tasks/main.yaml b/src/roles/foreman_core_network/tasks/main.yaml
new file mode 100644
index 000000000..05863c868
--- /dev/null
+++ b/src/roles/foreman_core_network/tasks/main.yaml
@@ -0,0 +1,8 @@
+---
+- name: Create foreman-core-network
+  containers.podman.podman_network:
+    name: "{{ foreman_core_network_name }}"
+    state: present
+    driver: "{{ foreman_core_network_driver }}"
+    subnet: "{{ foreman_core_network_subnet }}"
+    gateway: "{{ foreman_core_network_gateway }}"
diff --git a/src/roles/foreman_proxy/defaults/main.yaml b/src/roles/foreman_proxy/defaults/main.yaml
index 2f226f001..fdb973cf9 100644
--- a/src/roles/foreman_proxy/defaults/main.yaml
+++ b/src/roles/foreman_proxy/defaults/main.yaml
@@ -21,9 +21,9 @@ foreman_proxy_foreman_server_url: "https://{{ ansible_facts['fqdn'] }}"
 # Templates settings
 foreman_proxy_templates_url: "http://{{ foreman_proxy_name }}:8000"
 
-# Container gateway settings
+# Container gateway settings (deploy playbooks override via database.yml)
 foreman_proxy_container_gateway_pulp_endpoint: "https://{{ foreman_proxy_name }}"
-foreman_proxy_container_gateway_db_host: localhost
+foreman_proxy_container_gateway_db_host: "127.0.0.1"
 foreman_proxy_container_gateway_db_port: 5432
 foreman_proxy_container_gateway_db_user: container_gateway
 foreman_proxy_container_gateway_db_name: container_gateway
diff --git a/src/roles/httpd/tasks/main.yml b/src/roles/httpd/tasks/main.yml
index 1e3af02ae..4fc5eeeeb 100644
--- a/src/roles/httpd/tasks/main.yml
+++ b/src/roles/httpd/tasks/main.yml
@@ -6,6 +6,15 @@
       - mod_ssl
     state: present
 
+- name: Set httpd_can_network_connect so Apache can reverse proxy to TCP backends
+  ansible.posix.seboolean:
+    name: httpd_can_network_connect
+    state: true
+    persistent: true
+  when:
+    - ansible_facts['selinux']['status'] == "enabled"
+    - httpd_foreman_backend is match('^https?://')
+
 - name: Set daemons_enable_cluster_mode so Apache can connect to unix sockets
   ansible.posix.seboolean:
     name: daemons_enable_cluster_mode
diff --git a/src/roles/iop_advisor/defaults/main.yaml b/src/roles/iop_advisor/defaults/main.yaml
index ae2e3bf93..c36529c80 100644
--- a/src/roles/iop_advisor/defaults/main.yaml
+++ b/src/roles/iop_advisor/defaults/main.yaml
@@ -5,5 +5,5 @@ iop_advisor_container_tag: "foreman-3.18"
 iop_advisor_database_name: advisor_db
 iop_advisor_database_user: advisor_user
 iop_advisor_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_advisor_database_host: host.containers.internal
+iop_advisor_database_host: postgresql
 iop_advisor_database_port: 5432
diff --git a/src/roles/iop_advisor/tasks/main.yaml b/src/roles/iop_advisor/tasks/main.yaml
index a27ae640c..f5622c6c2 100644
--- a/src/roles/iop_advisor/tasks/main.yaml
+++ b/src/roles/iop_advisor/tasks/main.yaml
@@ -39,7 +39,7 @@
     state: quadlet
     command: sh -c "./container_init.sh && api/app.sh"
     network:
-      - iop-core-network
+      - foreman-core-network
     env:
       DJANGO_SESSION_KEY: "UNUSED"
       BOOTSTRAP_SERVERS: "iop-core-kafka:9092"
@@ -83,7 +83,7 @@
     state: quadlet
     command: pipenv run python service/service.py
     network:
-      - iop-core-network
+      - foreman-core-network
     env:
       BOOTSTRAP_SERVERS: "iop-core-kafka:9092"
       ADVISOR_DB_SSL_MODE: "disable"
diff --git a/src/roles/iop_core/defaults/main.yaml b/src/roles/iop_core/defaults/main.yaml
index 0fec3bb3a..b11112d01 100644
--- a/src/roles/iop_core/defaults/main.yaml
+++ b/src/roles/iop_core/defaults/main.yaml
@@ -1,2 +1,3 @@
 ---
 iop_core_foreman_url: "https://{{ ansible_facts['fqdn'] }}"
+iop_core_gateway_url: "https://iop-core-gateway:8443"
diff --git a/src/roles/iop_core/tasks/main.yaml b/src/roles/iop_core/tasks/main.yaml
index 7bb48d4e0..5dabab21c 100644
--- a/src/roles/iop_core/tasks/main.yaml
+++ b/src/roles/iop_core/tasks/main.yaml
@@ -1,7 +1,7 @@
 ---
-- name: Deploy IOP Network
+- name: Ensure shared app network exists
   ansible.builtin.include_role:
-    name: iop_network
+    name: foreman_core_network
 
 - name: Deploy IOP Kafka service
   ansible.builtin.include_role:
@@ -30,7 +30,7 @@
 - name: Register IOP Gateway as smart proxy
   theforeman.foreman.smart_proxy:
     name: "iop-gateway"
-    url: "https://localhost:24443"
+    url: "{{ iop_core_gateway_url }}"
     server_url: "{{ iop_core_foreman_url }}"
     oauth1_consumer_key: "{{ iop_core_foreman_oauth_consumer_key }}"
     oauth1_consumer_secret: "{{ iop_core_foreman_oauth_consumer_secret }}"
diff --git a/src/roles/iop_engine/tasks/main.yaml b/src/roles/iop_engine/tasks/main.yaml
index 7fa4d76d6..ab20a38aa 100644
--- a/src/roles/iop_engine/tasks/main.yaml
+++ b/src/roles/iop_engine/tasks/main.yaml
@@ -20,7 +20,7 @@
     etc_hosts:
       console.redhat.com: "127.0.0.1"
     network:
-      - iop-core-network
+      - foreman-core-network
     quadlet_options:
       - |
         [Unit]
diff --git a/src/roles/iop_fdw/defaults/main.yaml b/src/roles/iop_fdw/defaults/main.yaml
index 1a69ee91d..1c3667cca 100644
--- a/src/roles/iop_fdw/defaults/main.yaml
+++ b/src/roles/iop_fdw/defaults/main.yaml
@@ -6,9 +6,12 @@ iop_fdw_remote_database_name: "{{ undef(hint='You must specify the remote FDW da
 iop_fdw_remote_user: "{{ undef(hint='You must specify the remote FDW database user') }}"
 iop_fdw_remote_password: "{{ undef(hint='You must specify the remote FDW database password') }}"
 
-# Optional parameters - can use defaults
-iop_fdw_database_host: "localhost"
+# Optional parameters - can use defaults.
+# Use 127.0.0.1: Postgres is published on IPv4 only (not ::1), and TCP
+# requires a password now that it is no longer on host networking.
+iop_fdw_database_host: "{{ database_management_host }}"
 iop_fdw_database_port: 5432
+iop_fdw_login_password: "{{ postgresql_admin_password }}"
 
 # Constants - same for all invocations (matching puppet-iop)
 iop_fdw_foreign_server_name: hbi_server
diff --git a/src/roles/iop_fdw/tasks/main.yaml b/src/roles/iop_fdw/tasks/main.yaml
index f81358c5f..94173278a 100644
--- a/src/roles/iop_fdw/tasks/main.yaml
+++ b/src/roles/iop_fdw/tasks/main.yaml
@@ -9,23 +9,28 @@
     name: postgres_fdw
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
+  no_log: true
 
 - name: Check if foreign server exists
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: "SELECT srvname FROM pg_foreign_server WHERE srvname = %s"
     positional_args:
       - "{{ iop_fdw_foreign_server_name }}"
   register: iop_fdw_foreign_server_check
   changed_when: false
+  no_log: true
 
 - name: Create foreign server for target database
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: |
       CREATE SERVER {{ iop_fdw_foreign_server_name }}
@@ -36,11 +41,13 @@
       - "{{ iop_fdw_database_port | string }}"
       - "{{ iop_fdw_remote_database_name }}"
   when: iop_fdw_foreign_server_check.rowcount == 0
+  no_log: true
 
 - name: Check if user mapping exists for service user
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: "SELECT umuser FROM pg_user_mappings WHERE srvname = %s AND usename = %s"
     positional_args:
@@ -48,11 +55,13 @@
       - "{{ iop_fdw_database_user }}"
   register: iop_fdw_user_mapping_check
   changed_when: false
+  no_log: true
 
 - name: Create user mapping for service user
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: |
       CREATE USER MAPPING FOR {{ iop_fdw_database_user }}
@@ -62,22 +71,26 @@
       - "{{ iop_fdw_remote_user }}"
       - "{{ iop_fdw_remote_password }}"
   when: iop_fdw_user_mapping_check.rowcount == 0
+  no_log: true
 
 - name: Check if user mapping exists for postgres user
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: "SELECT umuser FROM pg_user_mappings WHERE srvname = %s AND usename = 'postgres'"
     positional_args:
       - "{{ iop_fdw_foreign_server_name }}"
   register: iop_fdw_postgres_mapping_check
   changed_when: false
+  no_log: true
 
 - name: Create user mapping for postgres user
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: |
       CREATE USER MAPPING FOR postgres
@@ -87,13 +100,16 @@
       - "{{ iop_fdw_remote_user }}"
       - "{{ iop_fdw_remote_password }}"
   when: iop_fdw_postgres_mapping_check.rowcount == 0
+  no_log: true
 
 - name: Grant usage on foreign server
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: "GRANT USAGE ON FOREIGN SERVER {{ iop_fdw_foreign_server_name }} TO {{ iop_fdw_database_user }}"
+  no_log: true
 
 - name: Create local view schema
   community.postgresql.postgresql_schema:
@@ -101,7 +117,9 @@
     name: "{{ iop_fdw_local_view_schema }}"
     owner: "{{ iop_fdw_database_user }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
+  no_log: true
 
 - name: Create local schema for foreign tables
   community.postgresql.postgresql_schema:
@@ -109,12 +127,15 @@
     name: "{{ iop_fdw_local_source_schema }}"
     owner: "{{ iop_fdw_database_user }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
+  no_log: true
 
 - name: Check if foreign table exists
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: "SELECT foreign_table_name FROM information_schema.foreign_tables WHERE foreign_table_schema = %s AND foreign_table_name = %s"
     positional_args:
@@ -122,11 +143,13 @@
       - "{{ iop_fdw_remote_table_name }}"
   register: iop_fdw_foreign_table_check
   changed_when: false
+  no_log: true
 
 - name: Import foreign schema
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: |
       IMPORT FOREIGN SCHEMA {{ iop_fdw_remote_table_schema }}
@@ -134,32 +157,39 @@
       FROM SERVER {{ iop_fdw_foreign_server_name }}
       INTO {{ iop_fdw_local_source_schema }}
   when: iop_fdw_foreign_table_check.rowcount == 0
+  no_log: true
 
 - name: Create local view pointing to foreign table
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: |
       CREATE OR REPLACE VIEW "{{ iop_fdw_local_view_schema }}"."{{ iop_fdw_local_view_name }}" AS
       SELECT * FROM "{{ iop_fdw_local_source_schema }}"."{{ iop_fdw_remote_table_name }}"
+  no_log: true
 
 - name: Grant select on foreign table to service user
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: |
       GRANT USAGE ON SCHEMA {{ iop_fdw_local_source_schema }} TO {{ iop_fdw_database_user }};
       GRANT USAGE ON SCHEMA {{ iop_fdw_local_view_schema }} TO {{ iop_fdw_database_user }};
       GRANT SELECT ON {{ iop_fdw_local_source_schema }}.{{ iop_fdw_remote_table_name }} TO {{ iop_fdw_database_user }};
       GRANT SELECT ON {{ iop_fdw_local_view_schema }}.{{ iop_fdw_local_view_name }} TO {{ iop_fdw_database_user }};
+  no_log: true
 
 - name: Grant permissions on remote database view to remote user
   community.postgresql.postgresql_query:
     login_db: "{{ iop_fdw_remote_database_name }}"
     login_user: postgres
+    login_password: "{{ iop_fdw_login_password }}"
     login_host: "{{ iop_fdw_database_host }}"
     query: |
       GRANT USAGE ON SCHEMA {{ iop_fdw_remote_table_schema }} TO {{ iop_fdw_remote_user }};
       GRANT SELECT ON {{ iop_fdw_remote_table_schema }}.{{ iop_fdw_local_view_name }} TO {{ iop_fdw_remote_user }};
+  no_log: true
diff --git a/src/roles/iop_gateway/defaults/main.yaml b/src/roles/iop_gateway/defaults/main.yaml
index 4439e1e37..1e87d9145 100644
--- a/src/roles/iop_gateway/defaults/main.yaml
+++ b/src/roles/iop_gateway/defaults/main.yaml
@@ -2,8 +2,8 @@
 iop_gateway_container_image: "quay.io/iop/gateway"
 iop_gateway_container_tag: "foreman-5.0"
 
-iop_gateway_server_certificate: "/var/lib/foremanctl/certs/certs/localhost.crt"
-iop_gateway_server_key: "/var/lib/foremanctl/certs/private/localhost.key"
+iop_gateway_server_certificate: "/var/lib/foremanctl/certs/certs/iop-core-gateway.crt"
+iop_gateway_server_key: "/var/lib/foremanctl/certs/private/iop-core-gateway.key"
 iop_gateway_server_ca_certificate: "/var/lib/foremanctl/certs/certs/ca.crt"
 iop_gateway_client_certificate: "/var/lib/foremanctl/certs/certs/localhost-client.crt"
 iop_gateway_client_key: "/var/lib/foremanctl/certs/private/localhost-client.key"
diff --git a/src/roles/iop_gateway/tasks/main.yaml b/src/roles/iop_gateway/tasks/main.yaml
index 4d89c0253..bf2a82c59 100644
--- a/src/roles/iop_gateway/tasks/main.yaml
+++ b/src/roles/iop_gateway/tasks/main.yaml
@@ -57,7 +57,7 @@
     image: iop-gateway.image
     state: quadlet
     network:
-      - iop-core-network
+      - foreman-core-network
     publish:
       - "127.0.0.1:24443:8443"
     secrets:
diff --git a/src/roles/iop_ingress/tasks/main.yaml b/src/roles/iop_ingress/tasks/main.yaml
index 97a51e9fa..b5a4c95bf 100644
--- a/src/roles/iop_ingress/tasks/main.yaml
+++ b/src/roles/iop_ingress/tasks/main.yaml
@@ -17,7 +17,7 @@
       INGRESS_WEBPORT: "8080"
       INGRESS_METRICSPORT: "3001"
     network:
-      - iop-core-network
+      - foreman-core-network
     quadlet_options:
       - |
         [Unit]
diff --git a/src/roles/iop_inventory/defaults/main.yaml b/src/roles/iop_inventory/defaults/main.yaml
index b262e6033..5344ffd44 100644
--- a/src/roles/iop_inventory/defaults/main.yaml
+++ b/src/roles/iop_inventory/defaults/main.yaml
@@ -5,5 +5,5 @@ iop_inventory_container_tag: "foreman-3.18"
 iop_inventory_database_name: inventory_db
 iop_inventory_database_user: inventory_admin
 iop_inventory_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_inventory_database_host: host.containers.internal
+iop_inventory_database_host: postgresql
 iop_inventory_database_port: 5432
diff --git a/src/roles/iop_inventory/tasks/main.yaml b/src/roles/iop_inventory/tasks/main.yaml
index 695af3a0a..4beea88a9 100644
--- a/src/roles/iop_inventory/tasks/main.yaml
+++ b/src/roles/iop_inventory/tasks/main.yaml
@@ -39,7 +39,7 @@
     state: quadlet
     command: make upgrade_db
     network:
-      - iop-core-network
+      - foreman-core-network
     env:
       KAFKA_BOOTSTRAP_SERVERS: "PLAINTEXT://iop-core-kafka:9092"
       USE_SUBMAN_ID: "true"
@@ -70,7 +70,7 @@
     state: quadlet
     command: make run_inv_mq_service
     network:
-      - iop-core-network
+      - foreman-core-network
     env:
       KAFKA_BOOTSTRAP_SERVERS: "PLAINTEXT://iop-core-kafka:9092"
       USE_SUBMAN_ID: "true"
@@ -101,7 +101,7 @@
     state: quadlet
     command: python run_gunicorn.py
     network:
-      - iop-core-network
+      - foreman-core-network
     env:
       KAFKA_BOOTSTRAP_SERVERS: "iop-core-kafka:9092"
       LISTEN_PORT: "8081"
@@ -134,7 +134,7 @@
     state: quadlet
     command: make run_host_delete_access_tags
     network:
-      - iop-core-network
+      - foreman-core-network
     env:
       KAFKA_BOOTSTRAP_SERVERS: "PLAINTEXT://iop-core-kafka:9092"
       USE_SUBMAN_ID: "true"
@@ -219,7 +219,7 @@
     login_db: "{{ iop_inventory_database_name }}"
     login_user: postgres
     login_password: "{{ postgresql_admin_password }}"
-    login_host: localhost
+    login_host: "{{ database_management_host }}"
 
 - name: Create inventory schema in inventory database
   community.postgresql.postgresql_schema:
@@ -228,14 +228,14 @@
     owner: "{{ iop_inventory_database_user }}"
     login_user: postgres
     login_password: "{{ postgresql_admin_password }}"
-    login_host: localhost
+    login_host: "{{ database_management_host }}"
 
 - name: Create inventory.hosts view in inventory database
   community.postgresql.postgresql_query:
     login_db: "{{ iop_inventory_database_name }}"
     login_user: postgres
     login_password: "{{ postgresql_admin_password }}"
-    login_host: localhost
+    login_host: "{{ database_management_host }}"
     # TODO(RHINENG-26911): remove this view once Cyndi decommission completes
     # across all IoP services.
     # Per-org custom staleness from hbi.staleness is not supported.
diff --git a/src/roles/iop_kafka/tasks/main.yaml b/src/roles/iop_kafka/tasks/main.yaml
index 519ab78e1..c5a2bd069 100644
--- a/src/roles/iop_kafka/tasks/main.yaml
+++ b/src/roles/iop_kafka/tasks/main.yaml
@@ -35,7 +35,7 @@
     state: quadlet
     command: sh bin/init-start.sh
     network:
-      - iop-core-network
+      - foreman-core-network
     env:
       LOG_DIR: /tmp/kafka-logs
       KAFKA_NODE_ID: "1"
diff --git a/src/roles/iop_network/defaults/main.yaml b/src/roles/iop_network/defaults/main.yaml
deleted file mode 100644
index c4d62c427..000000000
--- a/src/roles/iop_network/defaults/main.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-iop_network_name: "iop-core-network"
-iop_network_subnet: "10.130.0.0/24"
-iop_network_gateway: "10.130.0.1"
-iop_network_driver: "bridge"
diff --git a/src/roles/iop_network/tasks/main.yaml b/src/roles/iop_network/tasks/main.yaml
deleted file mode 100644
index 3f6676ec2..000000000
--- a/src/roles/iop_network/tasks/main.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-- name: Create IOP Core network
-  containers.podman.podman_network:
-    name: "{{ iop_network_name }}"
-    state: present
-    driver: "{{ iop_network_driver }}"
-    subnet: "{{ iop_network_subnet }}"
-    gateway: "{{ iop_network_gateway }}"
diff --git a/src/roles/iop_puptoo/tasks/main.yaml b/src/roles/iop_puptoo/tasks/main.yaml
index 98b53ec6c..a83f8ebe2 100644
--- a/src/roles/iop_puptoo/tasks/main.yaml
+++ b/src/roles/iop_puptoo/tasks/main.yaml
@@ -12,7 +12,7 @@
       DISABLE_REDIS: "True"
       DISABLE_S3_UPLOAD: "True"
     network:
-      - iop-core-network
+      - foreman-core-network
     quadlet_options:
       - |
         [Unit]
diff --git a/src/roles/iop_remediation/defaults/main.yaml b/src/roles/iop_remediation/defaults/main.yaml
index 32dc3c911..c512d738e 100644
--- a/src/roles/iop_remediation/defaults/main.yaml
+++ b/src/roles/iop_remediation/defaults/main.yaml
@@ -5,5 +5,5 @@ iop_remediation_container_tag: "foreman-3.18"
 iop_remediation_database_name: remediations_db
 iop_remediation_database_user: remediations_user
 iop_remediation_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_remediation_database_host: "host.containers.internal"
+iop_remediation_database_host: postgresql
 iop_remediation_database_port: "5432"
diff --git a/src/roles/iop_remediation/tasks/main.yaml b/src/roles/iop_remediation/tasks/main.yaml
index 5bd638040..5bd43e921 100644
--- a/src/roles/iop_remediation/tasks/main.yaml
+++ b/src/roles/iop_remediation/tasks/main.yaml
@@ -43,7 +43,7 @@
     image: iop-remediation.image
     state: quadlet
     network:
-      - iop-core-network
+      - foreman-core-network
     command: sh -c "npm run db:migrate && exec node --max-http-header-size=16384 src/app.js"
     env:
       REDIS_ENABLED: "false"
diff --git a/src/roles/iop_vmaas/defaults/main.yaml b/src/roles/iop_vmaas/defaults/main.yaml
index dfe76e638..c098a1659 100644
--- a/src/roles/iop_vmaas/defaults/main.yaml
+++ b/src/roles/iop_vmaas/defaults/main.yaml
@@ -5,7 +5,7 @@ iop_vmaas_container_tag: "latest"
 iop_vmaas_database_name: vmaas_db
 iop_vmaas_database_user: vmaas_admin
 iop_vmaas_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_vmaas_database_host: "host.containers.internal"
+iop_vmaas_database_host: postgresql
 iop_vmaas_database_port: "5432"
 
 iop_vmaas_client_ca_certificate: "/var/lib/foremanctl/certs/certs/ca.crt"
diff --git a/src/roles/iop_vmaas/tasks/main.yaml b/src/roles/iop_vmaas/tasks/main.yaml
index b3dacc0e7..c81fa317c 100644
--- a/src/roles/iop_vmaas/tasks/main.yaml
+++ b/src/roles/iop_vmaas/tasks/main.yaml
@@ -38,7 +38,7 @@
     image: iop-vmaas.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     volumes:
       - iop-service-vmaas-data:/data:rw
     command: "/vmaas/entrypoint.sh database-upgrade reposcan"
@@ -82,7 +82,7 @@
     image: iop-vmaas.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     command: "/vmaas/entrypoint.sh webapp-go"
     env:
       REPOSCAN_PUBLIC_URL: "http://iop-service-vmaas-reposcan:8000"
diff --git a/src/roles/iop_vulnerability/defaults/main.yaml b/src/roles/iop_vulnerability/defaults/main.yaml
index 37d812880..20f906968 100644
--- a/src/roles/iop_vulnerability/defaults/main.yaml
+++ b/src/roles/iop_vulnerability/defaults/main.yaml
@@ -5,7 +5,7 @@ iop_vulnerability_container_tag: "foreman-3.18"
 iop_vulnerability_database_name: vulnerability_db
 iop_vulnerability_database_user: vulnerability_admin
 iop_vulnerability_database_password: "{{ undef(hint='Set a secure database password') }}"
-iop_vulnerability_database_host: "host.containers.internal"
+iop_vulnerability_database_host: postgresql
 iop_vulnerability_database_port: "5432"
 
 # Taskomatic configuration
diff --git a/src/roles/iop_vulnerability/tasks/main.yaml b/src/roles/iop_vulnerability/tasks/main.yaml
index f31848a8f..52d25c28a 100644
--- a/src/roles/iop_vulnerability/tasks/main.yaml
+++ b/src/roles/iop_vulnerability/tasks/main.yaml
@@ -45,7 +45,7 @@
     image: iop-vulnerability.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     command: "bash -c /engine/dbupgrade.sh"
     env:
       UNLEASH_BOOTSTRAP_FILE: "develfeatureflags.json"
@@ -78,7 +78,7 @@
     image: iop-vulnerability.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     command: "/engine/entrypoint.sh manager"
     env:
       UNLEASH_BOOTSTRAP_FILE: "develfeatureflags.json"
@@ -110,7 +110,7 @@
     image: iop-vulnerability.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     command: "/engine/entrypoint.sh taskomatic"
     env:
       UNLEASH_BOOTSTRAP_FILE: "develfeatureflags.json"
@@ -144,7 +144,7 @@
     image: iop-vulnerability.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     command: "/engine/entrypoint.sh grouper"
     env:
       UNLEASH_BOOTSTRAP_FILE: "develfeatureflags.json"
@@ -182,7 +182,7 @@
     image: iop-vulnerability.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     command: "/engine/entrypoint.sh listener"
     env:
       UNLEASH_BOOTSTRAP_FILE: "develfeatureflags.json"
@@ -220,7 +220,7 @@
     image: iop-vulnerability.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     command: "/engine/entrypoint.sh evaluator"
     env:
       UNLEASH_BOOTSTRAP_FILE: "develfeatureflags.json"
@@ -258,7 +258,7 @@
     image: iop-vulnerability.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     command: "/engine/entrypoint.sh evaluator"
     env:
       UNLEASH_BOOTSTRAP_FILE: "develfeatureflags.json"
@@ -296,7 +296,7 @@
     image: iop-vulnerability.image
     state: quadlet
     quadlet_dir: /etc/containers/systemd
-    network: iop-core-network
+    network: foreman-core-network
     command: "/engine/entrypoint.sh vmaas-sync"
     env:
       UNLEASH_BOOTSTRAP_FILE: "develfeatureflags.json"
diff --git a/src/roles/iop_yuptoo/tasks/main.yaml b/src/roles/iop_yuptoo/tasks/main.yaml
index 3e46da161..abb66ee16 100644
--- a/src/roles/iop_yuptoo/tasks/main.yaml
+++ b/src/roles/iop_yuptoo/tasks/main.yaml
@@ -12,7 +12,7 @@
       BOOTSTRAP_SERVERS: "iop-core-kafka:9092"
       BYPASS_PAYLOAD_EXPIRATION: "true"
     network:
-      - iop-core-network
+      - foreman-core-network
     quadlet_options:
       - |
         [Unit]
diff --git a/src/roles/postgresql/defaults/main.yml b/src/roles/postgresql/defaults/main.yml
index 8c1b6bb49..d4fc92592 100644
--- a/src/roles/postgresql/defaults/main.yml
+++ b/src/roles/postgresql/defaults/main.yml
@@ -2,7 +2,6 @@
 postgresql_container_image: quay.io/sclorg/postgresql-16-c10s
 postgresql_container_tag: "latest"
 postgresql_container_name: postgresql
-postgresql_network: host
 postgresql_restart_policy: always
 
 postgresql_data_dir: /var/lib/pgsql/data
@@ -13,4 +12,8 @@ postgresql_max_connections: 500
 postgresql_shared_buffers: 512MB
 postgresql_effective_cache_size: 1GB
 
+postgresql_networks:
+  - foreman-core-network
+postgresql_publish:
+  - "127.0.0.1:5432:5432"
 postgresql_upgrade: "hardlink"
diff --git a/src/roles/postgresql/tasks/main.yml b/src/roles/postgresql/tasks/main.yml
index 547957ab2..a0bc64bee 100644
--- a/src/roles/postgresql/tasks/main.yml
+++ b/src/roles/postgresql/tasks/main.yml
@@ -29,7 +29,8 @@
     healthcheck_interval: 5s
     sdnotify: healthy
     stop_signal: 2
-    network: host
+    network: "{{ postgresql_networks }}"
+    publish: "{{ postgresql_publish | default(omit) }}"
     volumes:
       - "{{ postgresql_data_dir }}:/var/lib/pgsql/data:rw,Z"
     secrets:
@@ -118,7 +119,7 @@
     password: "{{ item.password }}"
     login_user: postgres
     login_password: "{{ postgresql_admin_password }}"
-    login_host: localhost
+    login_host: "{{ database_management_host }}"
     role_attr_flags: "{{ item.role_attr_flags | default(omit) }}"
     state: present
   loop: "{{ postgresql_users }}"
@@ -130,6 +131,6 @@
     owner: "{{ item.owner }}"
     login_user: postgres
     login_password: "{{ postgresql_admin_password }}"
-    login_host: localhost
+    login_host: "{{ database_management_host }}"
     state: present
   loop: "{{ postgresql_databases }}"
diff --git a/src/roles/pulp/README.md b/src/roles/pulp/README.md
index 1306a23c0..6395fe756 100644
--- a/src/roles/pulp/README.md
+++ b/src/roles/pulp/README.md
@@ -18,7 +18,7 @@ Variables
 - `pulp_plugins`: Additional Pulp plugins to enable (default: `[pulp_container, pulp_rpm]`)
 - `pulp_database_name`: Name of the Pulp database (default: `pulp`)
 - `pulp_database_user`: Database user (default: `pulp`)
-- `pulp_database_host`: Database host (default: `localhost`)
+- `pulp_database_host`: Database host (default: `postgresql` on `foreman-core-network`; overridden by `database_host` in deploy playbooks)
 - `pulp_database_port`: Database port (default: `5432`)
 - `pulp_database_password`: Database password (required, no default)
 - `pulp_database_ssl_mode`: Database SSL mode (default: `disabled`)
diff --git a/src/roles/pulp/defaults/main.yaml b/src/roles/pulp/defaults/main.yaml
index 08d7f3821..e6875b1d4 100644
--- a/src/roles/pulp/defaults/main.yaml
+++ b/src/roles/pulp/defaults/main.yaml
@@ -46,12 +46,16 @@ pulp_enabled_plugins: "{{ pulp_default_plugins + pulp_plugins }}"
 
 pulp_database_name: pulp
 pulp_database_user: pulp
-pulp_database_host: localhost
 pulp_database_port: 5432
+# On the shared network, reach Postgres/Valkey by container name.
+pulp_database_host: postgresql
 pulp_database_ssl_mode: disabled
 pulp_database_ssl_ca: # noqa: no-empty-defaults
 pulp_database_ssl_ca_path: /etc/pulp/certs/db-ca.crt
 
+pulp_networks:
+  - foreman-core-network
+
 pulp_settings_database_env:
   PULP_DATABASES__default__NAME: "{{ pulp_database_name }}"
   PULP_DATABASES__default__USER: "{{ pulp_database_user }}"
@@ -73,7 +77,7 @@ pulp_settings_other_env:
   PULP_ANSIBLE_API_HOSTNAME: "{{ pulp_content_origin }}"
   PULP_ANSIBLE_CONTENT_HOSTNAME: "{{ pulp_content_origin }}/pulp/content"
   PULP_ANSIBLE_PERMISSION_CLASSES: "[]"
-  PULP_REDIS_URL: "redis://localhost:6379/8"
+  PULP_REDIS_URL: "redis://valkey:6379/8"
   PULP_REMOTE_USER_ENVIRON_NAME: "HTTP_REMOTE_USER"
   PULP_REST_FRAMEWORK__DEFAULT_AUTHENTICATION_CLASSES: >-
     ['rest_framework.authentication.SessionAuthentication', 'pulpcore.app.authentication.PulpRemoteUserAuthentication']
diff --git a/src/roles/pulp/tasks/main.yaml b/src/roles/pulp/tasks/main.yaml
index 58b513e0c..384396f58 100644
--- a/src/roles/pulp/tasks/main.yaml
+++ b/src/roles/pulp/tasks/main.yaml
@@ -118,7 +118,7 @@
     state: quadlet
     sdnotify: true
     command: pulp-api
-    network: host
+    network: "{{ pulp_networks }}"
     hostname: "pulp-api.{{ ansible_facts['hostname'] }}.local"
     volumes: "{{ pulp_volumes }}"
     security_opt:
@@ -158,7 +158,7 @@
     state: quadlet
     sdnotify: true
     command: pulp-content
-    network: host
+    network: "{{ pulp_networks }}"
     hostname: "pulp-content.{{ ansible_facts['hostname'] }}.local"
     volumes: "{{ pulp_volumes }}"
     security_opt:
@@ -191,7 +191,7 @@
     image: pulp.image
     state: quadlet
     command: pulp-worker
-    network: host
+    network: "{{ pulp_networks }}"
     hostname: "pulp-worker-%i.{{ ansible_facts['hostname'] }}.local"
     volumes: "{{ pulp_volumes }}"
     security_opt:
@@ -242,7 +242,7 @@
     image: pulp.image
     sdnotify: false
     command: pulpcore-manager migrate --noinput
-    network: host
+    network: "{{ pulp_networks }}"
     volumes: "{{ pulp_volumes }}"
     secrets:
       - 'pulp-symmetric-key,type=mount,target=/etc/pulp/certs/database_fields.symmetric.key'
@@ -263,7 +263,7 @@
     image: pulp.image
     sdnotify: false
     command: pulpcore-manager reset-admin-password --random
-    network: host
+    network: "{{ pulp_networks }}"
     volumes: "{{ pulp_volumes }}"
     secrets:
       - 'pulp-symmetric-key,type=mount,target=/etc/pulp/certs/database_fields.symmetric.key'
diff --git a/src/roles/restore/tasks/restore_databases.yaml b/src/roles/restore/tasks/restore_databases.yaml
index 2147c8807..67b18631f 100644
--- a/src/roles/restore/tasks/restore_databases.yaml
+++ b/src/roles/restore/tasks/restore_databases.yaml
@@ -11,7 +11,7 @@
 
 - name: Wait for PostgreSQL readiness
   ansible.builtin.command:
-    cmd: pg_isready --host={{ database_host }} --port={{ database_port }}
+    cmd: pg_isready --host={{ database_management_host }} --port={{ database_port }}
   register: restore_pg_ready
   retries: "{{ restore_postgresql_ready_retries }}"
   delay: "{{ restore_postgresql_ready_delay }}"
@@ -45,7 +45,7 @@
   community.postgresql.postgresql_db:
     name: "{{ item.database }}"
     state: absent
-    login_host: "{{ database_host }}"
+    login_host: "{{ database_management_host }}"
     login_port: "{{ database_port }}"
     login_user: postgres
     login_password: "{{ postgresql_admin_password }}"
@@ -58,7 +58,7 @@
     name: "{{ item.database }}"
     state: present
     owner: "{{ item.user }}"
-    login_host: "{{ database_host }}"
+    login_host: "{{ database_management_host }}"
     login_port: "{{ database_port }}"
     login_user: postgres
     login_password: "{{ postgresql_admin_password }}"
@@ -70,7 +70,7 @@
   community.postgresql.postgresql_ext:
     name: postgres_fdw
     db: "{{ item.database }}"
-    login_host: "{{ database_host }}"
+    login_host: "{{ database_management_host }}"
     login_port: "{{ database_port }}"
     login_user: postgres
     login_password: "{{ postgresql_admin_password }}"
@@ -83,7 +83,7 @@
   ansible.builtin.command:
     cmd: >
       pg_restore
-      --host={{ database_host }}
+      --host={{ database_management_host }}
       --port={{ database_port }}
       --username={{ item.user }}
       --dbname={{ item.database }}
diff --git a/src/roles/valkey/defaults/main.yml b/src/roles/valkey/defaults/main.yml
index 257e3e412..5b9ff7e7c 100644
--- a/src/roles/valkey/defaults/main.yml
+++ b/src/roles/valkey/defaults/main.yml
@@ -1,3 +1,6 @@
 ---
 valkey_container_image: quay.io/sclorg/valkey-8-c10s
 valkey_container_tag: "latest"
+
+valkey_networks:
+  - foreman-core-network
diff --git a/src/roles/valkey/tasks/main.yaml b/src/roles/valkey/tasks/main.yaml
index 8e054c065..7c62079ee 100644
--- a/src/roles/valkey/tasks/main.yaml
+++ b/src/roles/valkey/tasks/main.yaml
@@ -18,9 +18,10 @@
     name: valkey
     image: valkey.image
     state: quadlet
-    network: host
+    network: "{{ valkey_networks }}"
+    publish: "{{ valkey_publish | default(omit) }}"
     sdnotify: true
-    command: ["run-valkey", "--supervised", "systemd", "--loglevel", "{{ valkey_log_level }}", "--bind", "127.0.0.1", "-::1"]
+    command: ["run-valkey", "--supervised", "systemd", "--loglevel", "{{ valkey_log_level }}", "--bind", "*", "-::1"]
     volumes:
       - /var/lib/valkey:/data:rw,Z
     quadlet_options:
diff --git a/src/vars/base.yaml b/src/vars/base.yaml
index ae19a2b24..966e80d85 100644
--- a/src/vars/base.yaml
+++ b/src/vars/base.yaml
@@ -2,6 +2,13 @@
 certificates_hostnames:
   - "{{ ansible_facts['fqdn'] }}"
   - localhost
+  - candlepin
+  - iop-core-gateway
+certificates_hostname_extra_sans:
+  candlepin:
+    - localhost
+  iop-core-gateway:
+    - localhost
 
 oauth_directory: "{{ obsah_state_path }}/oauth"
 
@@ -13,8 +20,6 @@ certificates_oauth_directory: /var/lib/foremanctl/oauth
 
 candlepin_ca_key: "{{ ca_key }}"
 candlepin_ca_certificate: "{{ ca_certificate }}"
-candlepin_tomcat_key: "{{ localhost_key }}"
-candlepin_tomcat_certificate: "{{ localhost_certificate }}"
 candlepin_client_key: "{{ client_key }}"
 candlepin_client_certificate: "{{ client_certificate }}"
 
diff --git a/src/vars/certificates.yml b/src/vars/certificates.yml
index c2349252d..743c74f6c 100644
--- a/src/vars/certificates.yml
+++ b/src/vars/certificates.yml
@@ -14,9 +14,11 @@ localhost_key: "{{ certificates_ca_directory }}/private/localhost.key"
 localhost_certificate: "{{ certificates_ca_directory }}/certs/localhost.crt"
 localhost_client_key: "{{ certificates_ca_directory }}/private/localhost-client.key"
 localhost_client_certificate: "{{ certificates_ca_directory }}/certs/localhost-client.crt"
+candlepin_tomcat_key: "{{ certificates_ca_directory }}/private/candlepin.key"
+candlepin_tomcat_certificate: "{{ certificates_ca_directory }}/certs/candlepin.crt"
 
-iop_gateway_server_certificate: "{{ certificates_ca_directory }}/certs/localhost.crt"
-iop_gateway_server_key: "{{ certificates_ca_directory }}/private/localhost.key"
+iop_gateway_server_certificate: "{{ certificates_ca_directory }}/certs/iop-core-gateway.crt"
+iop_gateway_server_key: "{{ certificates_ca_directory }}/private/iop-core-gateway.key"
 iop_gateway_server_ca_certificate: "{{ certificates_ca_directory }}/certs/ca.crt"
 iop_gateway_client_certificate: "{{ certificates_ca_directory }}/certs/localhost-client.crt"
 iop_gateway_client_key: "{{ certificates_ca_directory }}/private/localhost-client.key"
diff --git a/src/vars/database.yml b/src/vars/database.yml
index 5be821439..3421e222d 100644
--- a/src/vars/database.yml
+++ b/src/vars/database.yml
@@ -1,5 +1,6 @@
 ---
-database_host: localhost
+database_host: postgresql
+database_management_host: "{{ database_host if database_mode == 'external' else '127.0.0.1' }}"
 database_port: 5432
 database_ssl_mode: disable
 database_ssl_ca:
@@ -17,7 +18,7 @@ pulp_database_user: pulp
 pulp_database_password_file: "{{ obsah_state_path }}/pulp-db-password"
 pulp_database_password: "{{ lookup('ansible.builtin.password', pulp_database_password_file, chars=['ascii_letters', 'digits']) }}"
 
-foreman_proxy_container_gateway_db_host: "{{ database_host }}"
+foreman_proxy_container_gateway_db_host: "{{ database_management_host }}"
 foreman_proxy_container_gateway_db_port: "{{ database_port }}"
 foreman_proxy_container_gateway_db_name: container_gateway
 foreman_proxy_container_gateway_db_user: container_gateway
@@ -28,22 +29,22 @@ foreman_proxy_container_gateway_db_password: >-
 postgresql_admin_password_file: "{{ obsah_state_path }}/postgresql-admin-password"
 postgresql_admin_password: "{{ lookup('ansible.builtin.password', postgresql_admin_password_file, chars=['ascii_letters', 'digits']) }}"
 
-candlepin_database_host: "{{ database_host }}"
+candlepin_database_host: "{{ database_host if database_mode == 'external' else 'postgresql' }}"
 candlepin_database_port: "{{ database_port }}"
 candlepin_database_ssl_mode: "{{ database_ssl_mode }}"
 candlepin_database_ssl_ca: "{{ database_ssl_ca }}"
 
-pulp_database_host: "{{ database_host }}"
+pulp_database_host: "{{ database_host if database_mode == 'external' else 'postgresql' }}"
 pulp_database_port: "{{ database_port }}"
 pulp_database_ssl_mode: "{{ database_ssl_mode }}"
 pulp_database_ssl_ca: "{{ database_ssl_ca }}"
 
-foreman_database_host: "{{ database_host }}"
+foreman_database_host: "{{ database_host if database_mode == 'external' else 'postgresql' }}"
 foreman_database_port: "{{ database_port }}"
 foreman_database_ssl_mode: "{{ database_ssl_mode }}"
 foreman_database_ssl_ca: "{{ database_ssl_ca }}"
 
-iop_database_host: host.containers.internal
+iop_database_host: postgresql
 iop_database_port: 5432
 
 iop_inventory_database_host: "{{ iop_database_host }}"
@@ -84,7 +85,7 @@ iop_vulnerability_database_password: "{{ lookup('ansible.builtin.password', iop_
 databases:
   - name: foreman
     database: "{{ foreman_database_name }}"
-    host: "{{ foreman_database_host }}"
+    host: "{{ database_management_host }}"
     port: "{{ foreman_database_port }}"
     user: "{{ foreman_database_user }}"
     password: "{{ foreman_database_password }}"
@@ -93,16 +94,17 @@ databases:
     feature: foreman
   - name: candlepin
     database: "{{ candlepin_database_name }}"
-    host: "{{ candlepin_database_host }}"
+    host: "{{ database_management_host }}"
     port: "{{ candlepin_database_port }}"
     user: "{{ candlepin_database_user }}"
     password: "{{ candlepin_database_password }}"
     ssl_mode: "{{ candlepin_database_ssl_mode }}"
     ssl_ca: "{{ candlepin_database_ssl_ca }}"
     feature: candlepin
+
   - name: pulp
     database: "{{ pulp_database_name }}"
-    host: "{{ pulp_database_host }}"
+    host: "{{ database_management_host }}"
     port: "{{ pulp_database_port }}"
     user: "{{ pulp_database_user }}"
     password: "{{ pulp_database_password }}"
@@ -118,35 +120,35 @@ databases:
     feature: container-gateway
   - name: iop_advisor
     database: "{{ iop_advisor_database_name }}"
-    host: "{{ iop_advisor_database_host }}"
+    host: "{{ database_management_host }}"
     port: "{{ iop_advisor_database_port }}"
     user: "{{ iop_advisor_database_user }}"
     password: "{{ iop_advisor_database_password }}"
     feature: iop
   - name: iop_inventory
     database: "{{ iop_inventory_database_name }}"
-    host: "{{ iop_inventory_database_host }}"
+    host: "{{ database_management_host }}"
     port: "{{ iop_inventory_database_port }}"
     user: "{{ iop_inventory_database_user }}"
     password: "{{ iop_inventory_database_password }}"
     feature: iop
   - name: iop_remediation
     database: "{{ iop_remediation_database_name }}"
-    host: "{{ iop_remediation_database_host }}"
+    host: "{{ database_management_host }}"
     port: "{{ iop_remediation_database_port }}"
     user: "{{ iop_remediation_database_user }}"
     password: "{{ iop_remediation_database_password }}"
     feature: iop
   - name: iop_vmaas
     database: "{{ iop_vmaas_database_name }}"
-    host: "{{ iop_vmaas_database_host }}"
+    host: "{{ database_management_host }}"
     port: "{{ iop_vmaas_database_port }}"
     user: "{{ iop_vmaas_database_user }}"
     password: "{{ iop_vmaas_database_password }}"
     feature: iop
   - name: iop_vulnerability
     database: "{{ iop_vulnerability_database_name }}"
-    host: "{{ iop_vulnerability_database_host }}"
+    host: "{{ database_management_host }}"
     port: "{{ iop_vulnerability_database_port }}"
     user: "{{ iop_vulnerability_database_user }}"
     password: "{{ iop_vulnerability_database_password }}"
diff --git a/tests/feature/iop/test_advisor.py b/tests/feature/iop/test_advisor.py
index ec55b78d3..d3afedbc1 100644
--- a/tests/feature/iop/test_advisor.py
+++ b/tests/feature/iop/test_advisor.py
@@ -133,5 +133,5 @@ def test_advisor_fdw_permissions_on_view(server):
 
 
 def test_advisor_api_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-advisor')} curl --fail -s -o /dev/null http://iop-service-advisor-backend-api:8000/api/insights/v1/status/live/")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-advisor')} curl --fail -s -o /dev/null http://iop-service-advisor-backend-api:8000/api/insights/v1/status/live/")
     assert result.succeeded
diff --git a/tests/feature/iop/test_ingress.py b/tests/feature/iop/test_ingress.py
index cf709fea1..03d79d2cb 100644
--- a/tests/feature/iop/test_ingress.py
+++ b/tests/feature/iop/test_ingress.py
@@ -5,5 +5,5 @@ def test_ingress_service(server):
 
 
 def test_ingress_http_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-ingress')} curl --fail -s -o /dev/null http://iop-core-ingress:8080/")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-ingress')} curl --fail -s -o /dev/null http://iop-core-ingress:8080/")
     assert result.succeeded
diff --git a/tests/feature/iop/test_integration.py b/tests/feature/iop/test_integration.py
index 0f74469c0..be332d73e 100644
--- a/tests/feature/iop/test_integration.py
+++ b/tests/feature/iop/test_integration.py
@@ -13,7 +13,7 @@ def test_iop_core_ingress_service(server):
 
 
 def test_iop_ingress_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-ingress:8080/")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-ingress:8080/")
     assert result.succeeded
 
 
@@ -26,7 +26,7 @@ def test_iop_core_puptoo_service(server):
 
 
 def test_iop_puptoo_metrics_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-puptoo:8000/metrics")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-puptoo:8000/metrics")
     assert result.succeeded
 
 
@@ -39,7 +39,7 @@ def test_iop_core_yuptoo_service(server):
 
 
 def test_iop_yuptoo_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-yuptoo:5005/")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-yuptoo:5005/")
     assert result.succeeded
 
 
@@ -78,12 +78,12 @@ def test_iop_core_host_inventory_api_service(server):
 
 
 def test_iop_inventory_mq_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-host-inventory:9126/")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-host-inventory:9126/")
     assert result.succeeded
 
 
 def test_iop_inventory_api_health_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-host-inventory-api:8081/health")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-core-host-inventory-api:8081/health")
     assert result.succeeded
 
 
@@ -104,7 +104,7 @@ def test_iop_service_advisor_backend_service(server):
 
 
 def test_iop_advisor_api_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-service-advisor-backend-api:8000/api/insights/v1/status/live/")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-service-advisor-backend-api:8000/api/insights/v1/status/live/")
     assert result.succeeded
 
 
@@ -117,5 +117,5 @@ def test_iop_service_remediations_api_service(server):
 
 
 def test_iop_remediations_api_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-service-remediations-api:9002/health")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-gateway')} curl --fail -s -o /dev/null http://iop-service-remediations-api:9002/health")
     assert result.succeeded
diff --git a/tests/feature/iop/test_inventory.py b/tests/feature/iop/test_inventory.py
index ec87c4d3a..70ef62780 100644
--- a/tests/feature/iop/test_inventory.py
+++ b/tests/feature/iop/test_inventory.py
@@ -22,7 +22,7 @@ def test_inventory_service_dependencies(server):
 
 
 def test_inventory_api_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-inventory')} curl --fail -s -o /dev/null http://iop-core-host-inventory-api:8081/health")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-inventory')} curl --fail -s -o /dev/null http://iop-core-host-inventory-api:8081/health")
     assert result.succeeded
 
 
diff --git a/tests/feature/iop/test_remediation.py b/tests/feature/iop/test_remediation.py
index 522165615..3872c4676 100644
--- a/tests/feature/iop/test_remediation.py
+++ b/tests/feature/iop/test_remediation.py
@@ -20,5 +20,5 @@ def test_remediation_api_environment_variables(server):
 
 
 def test_remediation_api_endpoint(server, iop_image):
-    result = server.run(f"podman run --network=iop-core-network --rm {iop_image('iop-remediation')} curl --fail -s -o /dev/null http://iop-service-remediations-api:9002/health")
+    result = server.run(f"podman run --network=foreman-core-network --rm {iop_image('iop-remediation')} curl --fail -s -o /dev/null http://iop-service-remediations-api:9002/health")
     assert result.succeeded
diff --git a/tests/feature/iop/test_vulnerability.py b/tests/feature/iop/test_vulnerability.py
index a409acc17..c5a22a611 100644
--- a/tests/feature/iop/test_vulnerability.py
+++ b/tests/feature/iop/test_vulnerability.py
@@ -83,7 +83,7 @@ def test_vulnerability_containers_networking(server):
     for container in containers:
         result = server.run(f"podman inspect {container} --format '{{{{.NetworkSettings.Networks}}}}'")
         assert result.succeeded
-        assert "iop-core-network" in result.stdout
+        assert "foreman-core-network" in result.stdout
 
 
 def test_vulnerability_manager_environment_variables(server):
diff --git a/tests/feature/katello/candlepin_test.py b/tests/feature/katello/candlepin_test.py
index 4d88ac8ae..33537f082 100644
--- a/tests/feature/katello/candlepin_test.py
+++ b/tests/feature/katello/candlepin_test.py
@@ -27,20 +27,33 @@ def test_candlepin_runs_as_tomcat(server):
 
 
 def test_candlepin_port(server):
-    candlepin = server.addr("localhost")
-    assert candlepin.port("23443").is_reachable
+    ports = server.run("podman port candlepin")
+    assert '127.0.0.1:23443' not in ports.stdout
+    assert '0.0.0.0:23443' not in ports.stdout
 
 
-def test_candlepin_status(server, certificates):
-    status = server.run(f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null --write-out '%{{http_code}}' https://localhost:23443/candlepin/status")
+def test_candlepin_certificate_san(server, certificates):
+    san = server.run(
+        f"openssl x509 -in {certificates['candlepin_tomcat_certificate']} -noout -ext subjectAltName"
+    )
+    assert san.succeeded
+    assert 'DNS:candlepin' in san.stdout
+
+
+def test_candlepin_status(server):
+    status = server.run(
+        "podman exec foreman curl --cacert /etc/foreman/katello-default-ca.crt "
+        "--silent --output /dev/null --write-out '%{http_code}' "
+        "https://candlepin:23443/candlepin/status"
+    )
     assert status.succeeded
     assert status.stdout == '200'
 
 
-def test_candlepin_logs_in_journal(server, certificates):
+def test_candlepin_logs_in_journal(server):
     server.run(
-        f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null "
-        f"https://localhost:23443/candlepin/status"
+        "podman exec foreman curl --cacert /etc/foreman/katello-default-ca.crt "
+        "--silent --output /dev/null https://candlepin:23443/candlepin/status"
     )
 
     journal = server.run("journalctl -u candlepin --since '2 min ago' --no-pager").stdout
@@ -48,10 +61,10 @@ def test_candlepin_logs_in_journal(server, certificates):
     assert 'LoggingFilter' in journal
 
 
-def test_candlepin_tomcat_logs_in_journal(server, certificates):
+def test_candlepin_tomcat_logs_in_journal(server):
     server.run(
-        f"curl --cacert {certificates['ca_certificate']} --silent --output /dev/null "
-        f"https://localhost:23443/candlepin/status"
+        "podman exec foreman curl --cacert /etc/foreman/katello-default-ca.crt "
+        "--silent --output /dev/null https://candlepin:23443/candlepin/status"
     )
 
     journal = server.run("journalctl -u candlepin --no-pager").stdout
@@ -60,7 +73,10 @@ def test_candlepin_tomcat_logs_in_journal(server, certificates):
 
 
 def test_tls(server):
-    result = server.run('nmap --script +ssl-enum-ciphers localhost -p 23443')
+    result = server.run('podman inspect -f \'{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}\' candlepin')
+
+    candlepin_ip = result.stdout.strip()
+    result = server.run(f'nmap -sT --script +ssl-enum-ciphers -p 23443 {candlepin_ip}')
     result = result.stdout
     assert "TLSv1.3" in result
     assert "TLSv1.2" in result
diff --git a/tests/feature/valkey/base_test.py b/tests/feature/valkey/base_test.py
index 19b7aa7bb..dd2b0ee61 100644
--- a/tests/feature/valkey/base_test.py
+++ b/tests/feature/valkey/base_test.py
@@ -14,10 +14,15 @@ def test_redis_service_absent(server):
 
 def test_valkey_port(server):
     valkey = server.addr(VALKEY_HOST)
-    assert valkey.port(VALKEY_PORT).is_reachable
+    assert not valkey.port(VALKEY_PORT).is_reachable
 
 
-def test_valkey_listens_on_localhost_only(server):
-    result = server.run(f"ss -tlnH sport = :{VALKEY_PORT}")
-    assert f'127.0.0.1:{VALKEY_PORT}' in result.stdout
-    assert f'0.0.0.0:{VALKEY_PORT}' not in result.stdout
+def test_valkey_not_listening_on_all_interfaces(server):
+
+    ports = server.run("podman port valkey")
+    assert f'127.0.0.1:{VALKEY_PORT}' not in ports.stdout
+    assert f'0.0.0.0:{VALKEY_PORT}' not in ports.stdout
+
+    ss = server.run(f"ss -ltn '( sport = :{VALKEY_PORT} )'")
+    assert f'0.0.0.0:{VALKEY_PORT}' not in ss.stdout
+    assert f'[::]:{VALKEY_PORT}' not in ss.stdout
diff --git a/tests/feature/webhooks/base_test.py b/tests/feature/webhooks/base_test.py
index 811faf002..3f2a60403 100644
--- a/tests/feature/webhooks/base_test.py
+++ b/tests/feature/webhooks/base_test.py
@@ -35,12 +35,13 @@ def webhook_template(foremanapi):
 
 
 @pytest.fixture
-def webhook(foremanapi, server_fqdn, webhook_listener, webhook_template):
+def webhook(foremanapi, webhook_listener, webhook_template):
+    # host.containers.internal: Foreman is on foreman-core-network, not host net.
     hook = foremanapi.create(
         "webhooks",
         {
             "name": str(uuid.uuid4()),
-            "target_url": f"http://localhost:{LISTENER_PORT}",
+            "target_url": f"http://host.containers.internal:{LISTENER_PORT}",
             "http_method": "POST",
             "event": "domain_created.event.foreman",
             "http_content_type": "application/json",
diff --git a/tests/postgresql_test.py b/tests/postgresql_test.py
index 55c0185b5..8d2b56e53 100644
--- a/tests/postgresql_test.py
+++ b/tests/postgresql_test.py
@@ -13,6 +13,19 @@ def test_postgresql_port(database):
     assert postgresql.port("5432").is_reachable
 
 
+def test_postgresql_not_listening_on_all_interfaces(database, database_mode):
+    if database_mode == 'external':
+        pytest.skip("Remote DB host must accept connections from application hosts")
+
+    ports = database.run("podman port postgresql")
+    assert '127.0.0.1:5432' in ports.stdout
+    assert '0.0.0.0:5432' not in ports.stdout
+
+    ss = database.run("ss -ltn '( sport = :5432 )'")
+    assert '0.0.0.0:5432' not in ss.stdout
+    assert '[::]:5432' not in ss.stdout
+
+
 def test_postgresql_password_encryption(database):
     result = database.run("podman exec postgresql psql -U postgres -c 'SHOW password_encryption'")
     assert "scram-sha-256" in result.stdout