# W3 (Pinbox24) production stack — bms-1 (94.23.26.113)
#
# Generated from live `docker inspect` state 2026-07-11 (issue #3542, Gap 3 of
# docs/plans/w3-w4-cicd-full-deployment.md). This is the git-tracked source of
# truth for what SHOULD be running — it mirrors live reality as of generation
# time, but is NOT YET the actual deploy mechanism. GitLab CI (`p24-v-3.2`
# repo, `.gitlab-ci.yml` `prod-back-end-deploy` job) still drives real deploys
# via its own scripts. Wiring this file into that pipeline is Faza 3D
# (tracked separately, blocked on this file landing first).
#
# Persistent patches stay volume-mounted (established W3 pattern, and the
# Gap 8 decision made 2026-07-11 for W4 too). Paths below match the GitLab
# CI builder directory (`/home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/`)
# that the "autoheal" step (radieu/p24-infra#3611) keeps populated.
#
# Env vars: NEVER hardcode values here. Each service's env_file points at the
# builder-directory env file that GitLab CI's autoheal step + docker-deploy-
# prod.sh already maintain from SOPS (secrets/pinbox24-w3.env.sops) — see
# CLAUDE.md §Secrets.
#
# v32-prod-reso / v32-prod-socket: currently on secrets-sync (PR #3694,
# files-only, no force-recreate) pending resolution of issue #3740 (analyze
# actual WebSocket usage before finalizing that no-restart policy).
#
# s3-v32-prod-renamed: EXCLUDED from this file. `restart_policy: "no"` on the
# live container and a "-renamed" suffix strongly suggest a stale leftover
# from a prior redeploy (same pattern as the mailgun-v42-prod-stale rename
# seen during the 2026-07-10 incident), not an actively-managed service.
# Needs a follow-up read-only check before removal — not done here to avoid
# scope creep on this issue.

version: '2.4'

x-builder-path: &builder-path /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2

networks:
  prod-v-3-net:
    external: true
  test-net:
    external: true

services:
  v32-prod:
    image: 563740926945.dkr.ecr.eu-central-1.amazonaws.com/v32-prod
    restart: unless-stopped
    working_dir: /app
    command: ["pm2-runtime", "start", "ecosystem.config.js"]
    env_file:
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/backend-environment.env
    networks:
      - prod-v-3-net
      - test-net
    volumes:
      - /var/log:/var/log
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/pushNotification.helper.js:/app/app-backend/helperFunction/pushNotification.helper.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/app-backend/helperFunction/processHelper/tasksService/tasks/excel_import.js:/app/app-backend/helperFunction/processHelper/tasksService/tasks/excel_import.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/mongoose.js:/app/app-backend/config/mongoose.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/crudService.js:/app/app-backend/helperFunction/crudService.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/filesUpload.js:/app/app-backend/controllers/filesUpload.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/twilioService.js:/app/app-backend/services/twilioService.js:ro

  # No force-recreate on secrets rotation (PR #3694) — pending #3740 analysis
  # of actual WebSocket/live-session usage before finalizing that policy.
  v32-prod-reso:
    image: private-registry.dev.pinbox24.com/v32-prod
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/backend-environment.env
    networks:
      - prod-v-3-net
    volumes:
      - /var/log:/var/log
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/crudService.js:/app/app-backend/helperFunction/crudService.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/filesUpload.js:/app/app-backend/controllers/filesUpload.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/twilioService.js:/app/app-backend/services/twilioService.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/pushNotification.helper.js:/app/app-backend/helperFunction/pushNotification.helper.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/app-backend/helperFunction/processHelper/tasksService/tasks/excel_import.js:/app/app-backend/helperFunction/processHelper/tasksService/tasks/excel_import.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/mongoose.js:/app/app-backend/config/mongoose.js:ro

  # No force-recreate on secrets rotation (PR #3694) — pending #3740 analysis
  # of actual WebSocket/live-session usage before finalizing that policy.
  v32-prod-socket:
    image: private-registry.dev.pinbox24.com/v32-prod
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/backend-environment.env
    networks:
      - prod-v-3-net
    volumes:
      - /var/log:/var/log
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/mongoose.js:/app/app-backend/config/mongoose.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/crudService.js:/app/app-backend/helperFunction/crudService.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/filesUpload.js:/app/app-backend/controllers/filesUpload.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/twilioService.js:/app/app-backend/services/twilioService.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/pushNotification.helper.js:/app/app-backend/helperFunction/pushNotification.helper.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/app-backend/helperFunction/processHelper/tasksService/tasks/excel_import.js:/app/app-backend/helperFunction/processHelper/tasksService/tasks/excel_import.js:ro

  s3-v32-prod:
    image: 563740926945.dkr.ecr.eu-central-1.amazonaws.com/old-s3
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/s3-environment.env
    networks:
      - test-net
    volumes:
      - /var/log:/var/log
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/controller.js:/app/build/src/api/storage/controller.js:ro
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/persistent-patches/local.js:/app/config/local.js:ro

  # No persistent-patch mounts on live container (unlike main s3-v32-prod) —
  # reflects current reality, not a recommendation; worth revisiting once
  # #3740's WebSocket analysis clarifies whether this sidecar needs the same
  # patch set as the main s3 service.
  s3-v32-prod-reso:
    image: private-registry.dev.pinbox24.com/old-s3
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/s3-environment.env
    networks:
      - prod-v-3-net

  s3-v32-prod-socket:
    image: private-registry.dev.pinbox24.com/old-s3
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/s3-environment.env
    networks:
      - prod-v-3-net

  redis-v32:
    image: redis:7-alpine
    restart: unless-stopped
    command: ["sh", "-c", "redis-server --requirepass \"$$REDIS_PASSWORD\""]
    env_file:
      - /home/gitlab-runner/builds/eZQeLfuJe/0/pinbox24/p24-v-3.2/backend-environment.env
    networks:
      - test-net
    volumes:
      - redis-v32-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s

  cron-v32-prod:
    image: private-registry.dev.pinbox24.com/v32-cron
    restart: unless-stopped
    working_dir: /scripts
    command: ["crond", "-f", "-d", "8"]
    environment:
      - CLUSTER_NETWORK=prod-v-3-net
      - CONTAINER_NAME=cron-v32-prod
    networks:
      - prod-v-3-net

  cron-v32-prod-reso:
    image: private-registry.dev.pinbox24.com/v32-cron
    restart: unless-stopped
    working_dir: /scripts
    command: ["crond", "-f", "-d", "8"]
    environment:
      - CLUSTER_NETWORK=prod-v-3-net
      - CONTAINER_NAME=cron-v32-prod-reso
    networks:
      - prod-v-3-net

  cron-v32-prod-socket:
    image: private-registry.dev.pinbox24.com/v32-cron
    restart: unless-stopped
    working_dir: /scripts
    command: ["crond", "-f", "-d", "8"]
    environment:
      - CLUSTER_NETWORK=prod-v-3-net
      - CONTAINER_NAME=cron-v32-prod-socket
    networks:
      - prod-v-3-net

volumes:
  redis-v32-data:
    external: true