# W4 (Pinbox24) production stack — bms-1 (94.23.26.113)
#
# Generated from live `docker inspect` state 2026-07-11 (issue #3542, Gap 3 of
# docs/plans/w3-w4-cicd-full-deployment.md). This is the git-tracked source of
# truth for what SHOULD be running — it mirrors live reality as of generation
# time, but is NOT YET the actual deploy mechanism. GitLab CI (`p24-back-ts`
# repo, `.gitlab-ci.yml` `prod-back-end-deploy` job) still drives real deploys
# via its own scripts. Wiring this file into that pipeline is Faza 3C
# (tracked separately, blocked on this file landing first).
#
# Persistent patches stay volume-mounted, not baked into the image (Gap 8
# decision, 2026-07-11) — same pattern as W3. Paths below match the GitLab
# CI builder directory (`/root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/`) that
# the "autoheal" step (radieu/p24-infra#3611) keeps populated.
#
# Env vars: NEVER hardcode values here. Each service's env_file points at the
# builder-directory env file that GitLab CI's autoheal step + docker-deploy-
# prod.sh already maintain from SOPS (secrets/pinbox24-w4.env.sops,
# secrets/pinbox24-backends.env.sops) — see CLAUDE.md §Secrets.

version: '2.4'

x-builder-path: &builder-path /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts

networks:
  prod-v-4-net:
    external: true
  test-net:
    external: true

services:
  v42-prod:
    image: 563740926945.dkr.ecr.eu-central-1.amazonaws.com/v42-prod
    restart: unless-stopped
    working_dir: /app
    command: ["pm2-runtime", "start", "/app/ecosystem.config.js"]
    env_file:
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/backend-environment.env
    networks:
      - prod-v-4-net
      - test-net
    depends_on:
      redis-v42:
        condition: service_healthy
    volumes:
      - /var/log:/var/log
      # Persistent patches (Gap 8: volume-mount, not baked into image)
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/persistent-patches/postbookReport.helper.js:/app/dist/apps/postbook/postbookReport.helper.js:ro
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/ecosystem.config.js:/app/ecosystem.config.js:ro
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/persistent-patches/gus-api-regon-wsdl:/app/dist/wsdl:ro
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/persistent-patches/uploadAwsS3.helper.js:/app/dist/globalHelpers/uploadAwsS3.helper.js:ro

  v42-notify-prod:
    image: private-registry.dev.pinbox24.com/v42-notify-prod:latest
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/backend-environment.env
    networks:
      - prod-v-4-net
      - test-net
    volumes:
      - /var/log:/var/log

  s3-v42-prod:
    image: 563740926945.dkr.ecr.eu-central-1.amazonaws.com/v4-s3
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/s3-environment.env
    networks:
      - prod-v-4-net
    volumes:
      - /var/log:/var/log

  s3-v2-v42-prod:
    image: 563740926945.dkr.ecr.eu-central-1.amazonaws.com/s3-v2-v42-prod:latest
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /opt/p24-infra/bms-1/pinbox24-backends.env
    networks:
      - prod-v-4-net
      - test-net
    volumes:
      - /var/log:/var/log
      - /root/s3v2-prod/patches/mailgunFileHandler.helper.js:/app/dist/apps/storage/mailgunFileHandler.helper.js:ro
      - /root/s3v2-prod/persistent-patches/app.routing.js:/app/dist/app.routing.js:ro
      - /root/s3v2-prod/persistent-patches/storage.config.js:/app/dist/config/storage.config.js:ro
      - /root/s3v2-prod/persistent-patches/storage.controller.js:/app/dist/apps/storage/storage.controller.js:ro

  mailgun-v42-prod:
    image: mailgun-v42-prod:latest
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /opt/p24-infra/bms-1/pinbox24-backends.env
    networks:
      - test-net
    volumes:
      - /root/mailgun-prod/patches/integration.helper.js:/app/helper/integration.helper.js:ro
      - mailgun-v42-prod-logs:/var/log

  redis-v42:
    image: redis:7-alpine
    restart: unless-stopped
    command: ["sh", "-c", "redis-server --requirepass \"$$REDIS_PASSWORD\""]
    env_file:
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/backend-environment.env
    networks:
      - prod-v-4-net
      - test-net
    volumes:
      - redis-v42-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s

  # DNS EAI_AGAIN incident (2026-07-08) resolved via dual-network isolation
  # (#3193, #3228) — NOT a DNS config change per se. Prometheus health check
  # follow-up tracked in issue #3739.
  wkhtml-v42-prod:
    image: openlabs/docker-wkhtmltopdf-aas
    restart: unless-stopped
    networks:
      - prod-v-4-net
      - test-net

  # Puppeteer/headless-Chromium HTML→PDF renderer for the p24-back-ts (W4 TS
  # backend). Stateless — zero credential env vars. Public vhost via nginx-proxy
  # (VIRTUAL_HOST/LETSENCRYPT_HOST come from backend-environment.env). Full
  # identity audit: issue #3735 (closed). Ops workbook + consolidation review
  # (vs wkhtml-v42-prod / wkhtml-v42-stage): docs/pdf-gen-v42-prod-operations.md
  # (issue #3975).
  pdf-gen-v42-prod:
    # Image was drifted vs the actual p24-ms-pdfgen CI target (registry.gitlab.com/...) - a
    # whole-stack redeploy from the stale reference here silently reverted the #4792 fix a few
    # hours after it was deployed and verified. See docs/playbooks/w3-w4-redeploy-idempotency.md -
    # this line is now the declared source; the old private-registry.dev.pinbox24.com path is dead.
    image: registry.gitlab.com/pinbox24/p24-ms-pdfgen/pdf-gen-v42-prod
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/backend-environment.env
    networks:
      - prod-v-4-net
      - test-net
    volumes:
      - /var/log:/var/log

  # Keep/remove decision (D5) pending audit outcome — see issue #3734 (closed,
  # PR #3745 — check whether it landed on `main` or `dev`; CLAUDE.md says
  # p24-infra has no dev-staging step).
  git-deploy-v42-prod:
    image: private-registry.dev.pinbox24.com/git-deploy-v42-prod
    restart: unless-stopped
    working_dir: /app
    entrypoint: ["docker-entrypoint.sh"]
    command: ["/bin/sh", "-c", "pm2 start ecosystem.config.js && tail -f /dev/null"]
    env_file:
      - /root/builds/7N4sbbrB/0/pinbox24/p24-back-ts/backend-environment.env
    networks:
      - test-net
    volumes:
      - /var/log:/var/log

  # v41-prod (Angular frontend) intentionally NOT included here — still an
  # untagged local image (single point of failure), tracked separately in
  # issue #3733 (rebuild from source into ECR). Add here once that lands.

volumes:
  redis-v42-data:
    external: true
  mailgun-v42-prod-logs:
    external: true