p24-infra Docs

gitlab-repo-locations

4 min read

Pinbox24 GitLab Source Repository Locations

Created: 2026-07-09 Author: Claude Code (p24-infra dev-coder) Closes documentation gap flagged in: #3562, docs/evaluation/04-pinbox24-map-dr-audit.md §5 (“The GitLab source repository location is not documented anywhere in p24-infra”) and §12 (missing DR documentation item).

✅ Access regression resolved (2026-07-30)

The pinbox24 group/project access loss reported 2026-07-11 (#3775, closed 2026-07-30) is over — pinbox24 group membership is restored. Root cause was never determined (GitLab-side, not p24-infra’s), so treat any recurrence as a new incident, not a reopening of #3775.

Re-verified via GitLab REST API v4 (token in PRIVATE-TOKEN header, value never printed):

CallResult
GET /api/v4/user200
GET /api/v4/projects/pinbox24%2Fp24-back-ts200
GET /api/v4/groups/pinbox24200
GET /api/v4/projects?membership=true&per_page=10085 project memberships (was 0 on 2026-07-11)

A full read-only clone of p24-back-ts (development branch) also succeeded the same day. The repository table below can be treated as reachable again.

Why this document exists

The Pinbox24 disaster-recovery audit (docs/evaluation/04-pinbox24-map-dr-audit.md) identified that p24-infra had no record of where the Pinbox24 application source code actually lives. This blocked any source-level fix (e.g. removing hardcoded credentials — see #3562) because nobody knew which repository to clone or open a merge request against. This gap is now closed.

Repository locations

StackRepositoryDefault branchNotes
W3 (v32-prod, legacy)gitlab.com/pinbox24/p24-v-3.2developmentNode.js backend, app-backend/ subfolder contains the API source (e.g. config/env.config.js, controllers/). Reachable and clonable via GITLAB_ADMIN_PAT (stored in secrets/administration.env.sops) — confirmed 2026-07-09, lost 2026-07-11–2026-07-30 (#3775, resolved), re-confirmed 2026-07-30.
W4 (v42-prod, current production)gitlab.com/pinbox24/p24-back-tsdevelopmentReachable via GitLab API and full clone confirmed 2026-07-30 (used to trace the ecotrans-hr-workflow webhook trigger — see docs/ecotrans-hr-workflow-operations.md). Same #3775 gap 2026-07-11–2026-07-30.
W4 microservice — s3-v2-v42-prod (Wasabi 3-bucket geo-redundant upload service)gitlab.com/pinbox24/pinbox24-ms-s3-v2feature/scanque (non-standard — CI builds from both feature/scanque and master, see repo’s own .gitlab-ci.yml)Gap closed 2026-08-04 — this was the repo p24-infra#2709 could not locate. Confirmed by ground-truthing the running container on bms-1 (docker exec s3-v2-v42-prod pm2 show s3-v2-v42-prod_backend → script /app/dist/apps/storage/storage.helper.js; the PM2 Plus-monitored ×4 processes named s3-v2-v42-prod_backend) and matching its compiled dist/ tree 1:1 against this repo’s src/ tree, then confirming byte-identical uploadMultiFiles() (src/apps/storage/storage.helper.ts, uses promise.any over STORAGE_PRIORITY) and the exact 3 Wasabi bucket names (test-replicated-to-us-bucket, p24-was-us-east-1, test-us-bucket-for-replication-testing) in src/config/storage.config.ts. This is a separate microservice repo, not a subtree of p24-back-ts. Deployed via its own GitLab CI runner tag s3-v2-bms1-autodeploy (shell executor on bms-1) — see the repo’s .gitlab-ci.yml header for the Faza-0 credential prerequisites and 4 persistent host-mounted patch files (/root/s3v2-prod/{patches,persistent-patches}/) that override storage.controller.js, storage.config.js, app.routing.js, mailgunFileHandler.helper.js at container-run time — same persistent-patches gotcha as W3/W4 (docs/w3-w4-stack-operations.md §"Persistent-patches gotcha"). The container named plain s3-v42-prod (image .../v4-s3, PM2 app v4-s3, 2 processes) is a different, older service — do not confuse the two; only s3-v2-v42-prod runs the 3-bucket Wasabi logic.
W4 frontend (v41-prod, current production)gitlab.com/pinbox24/pinbox24-version-4 (project id 16151783)developmentAngular frontend, deployed as v41-prod on bms-1. Found while tracing frontend behavior for p24-infra#2709 — relevant files: src/app/main/content/global-component/control-template/file-preview/file-preview.component.ts and helpers.service.ts. Accessed via GITLAB_ADMIN_PAT in secrets/pinbox24-gitlab.env.sops; reachable and default branch confirmed via GitLab API (GET /api/v4/projects/16151783) 2026-08-05.

Access

  • Credential: GITLAB_ADMIN_PAT in secrets/administration.env.sops (developer-only SOPS file, never deployed by secrets-sync.yml).

  • Clone pattern (Windows, safe — token never printed):

    $env:SOPS_AGE_KEY_FILE = "C:\Users\konar\.age\p24-infra-keys.txt"
$decrypted = sops --decrypt --input-type dotenv --output-type dotenv secrets\administration.env.sops
$line = $decrypted | Select-String "^GITLAB_ADMIN_PAT="
$env:GITLAB_ADMIN_PAT = $line.Line.Split("=",2)[1]
 
$basic = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("oauth2:$env:GITLAB_ADMIN_PAT"))
git -c http.extraHeader="Authorization: Basic $basic" clone "https://gitlab.com/pinbox24/<repo>.git" <dest>
 
$env:GITLAB_ADMIN_PAT = ""
$basic = ""

    Using an http.extraHeader passed via -c (not --config, which would persist it into the clone’s own .git/config) keeps the token out of the resulting repository’s on-disk config and out of git remote -v output.

  • Opening a merge request: GitLab REST API, POST /projects/:id/merge_requests with the token passed via the PRIVATE-TOKEN header — never embedded in the URL (which would leak it into shell history, error messages, and git remote -v).

Known limitation

p24-infra has read/write access to push branches and open MRs, but does not have merge rights and should never merge a GitLab MR without explicit human review — these are production app repositories owned by the Pinbox24 team, not p24-infra-owned infrastructure.

  • #3562 — W3 hardcoded credentials incident; first use of this documented repo location for a source-level fix.
  • #3768 — W4 GitLab CI pipeline apply; blocked by the access regression while attempting the live GitLab MR.
  • #3775 — GITLAB_ADMIN_PAT lost pinbox24 group/project access (2026-07-11); source of the ACCESS REGRESSION banner above.
  • docs/evaluation/04-pinbox24-map-dr-audit.md — original gap identification.

Graph View

Backlinks