FaceKom — End-to-End System Architecture

FaceKom is a video-identification (KYC) + video-banking + e-signing platform. It is a polyglot, message-bus-centric system: a Node.js operator/customer web pair (vuer_oss / vuer_css) is the spine, a Python CV engine (vuer_cv) does the ML, Janus carries WebRTC media, and a swarm of single-purpose RabbitMQ RPC microservices (PDF signing, antivirus, timestamping, trust-list, ID-registry scraping, reporting, resource admission) hang off the bus. A separate eSign product pair (esign_oss / esign_css) reuses the same shape. A newer TypeScript janus-sdk monorepo is a v2 WebRTC media plane (its own RabbitMQ + Postgres).

What "talks to what" means here

Every edge below is proven from a queue-name constant, a service URL/port literal, or an explicit client/server registration in code. RabbitMQ RPC pairs are matched by identical queue-name string on both ends (client getRPCClient('X') ↔ server getRPCServer('X')). Edges I could not prove from opened source are under Gaps / unproven.

devel is the core; deployments ship from customization/<partner> branches

All claims are verified against the devel (or master/main) base branch via git show <branch>:<path>. Some edges (e.g. ID-registry scraper, resource-manager admission) are wired only on customization branches / hooks, not core devel — those are flagged. See customization-architecture and customization-branch-catalog.

---

1. Topology (Mermaid)

flowchart TB
    subgraph client["Customer / Operator devices"]
        browser["Customer browser / kiosk / mobile webview"]
        operator["Operator / admin browser"]
    end

    subgraph rt["Realtime media plane (v1)"]
        janus["Janus WebRTC Gateway<br/>(external image)<br/>wss :8989 signalling / :7989 admin"]
        turn["TURN/STUN server<br/>turnserver.facekomtest.net:3478"]
    end

    subgraph cssbox["vuer_css — Client Side Server (Node)"]
        css["Express 5 + Socket.IO 4<br/>server.js"]
    end

    subgraph ossbox["vuer_oss — Operator Side Server (7 Node procs + nginx + redis = 9 supervisord programs)"]
        oss["server.js (web + Socket.IO + RPC)"]
        convert["convert.js (queue-convert consumer, FFmpeg)"]
        media["media.js"]
        bg["background.js"]
        cron["cron.js"]
        storage["storage.js"]
        ilog["integrationLog.js"]
    end

    subgraph cvbox["vuer_cv — Computer Vision (Python, supervisord)"]
        cvnginx["nginx (TLS front)"]
        cvhttp["Falcon+uWSGI HTTP<br/>/api/v1..v3/*"]
        cvws["websockets server<br/>127.0.0.1:40082+worker /ws"]
        cvworkers["per-model workers<br/>face/mrz/ocr/onnx/detectron2/pad"]
        cvredis["Redis<br/>(unix socket)"]
    end

    pg[("PostgreSQL<br/>vuer_oss @ :5432")]
    rmq{{"RabbitMQ<br/>amqps :5671 (mTLS)"}}
    ossredis[("Redis (OSS)<br/>HARedis / unix socket")]

    subgraph svc["Single-purpose RabbitMQ RPC services"]
        pdf["pdfservice (Kotlin)<br/>pdf-prepareSignedDocument / -insertSignature / -validate"]
        av["antivirus_service (Node)<br/>anti-virus-scanner"]
        ts["timestamp_service (lib)"]
        tlp["trust_list_proxy (Kotlin lib)"]
        scraper["nyilvantarto_scraper (Node)<br/>kkszb-rpc"]
        report["report-engine (Node)<br/>logger-report-request + TimescaleDB"]
        rm["resource-manager (Node)<br/>identification admission + Postgres"]
        emrtd["vuer_emrtd (Kotlin CLI)"]
    end

    subgraph esignbox["eSign product (Node pair)"]
        esoss["esign_oss<br/>esign:rpc-app/-customer/-offer/-contract/-signature/-timestamp"]
        escss["esign_css"]
    end

    subgraph v2["janus-sdk — v2 WebRTC media plane (TS monorepo)"]
        sig["signaling-server (socket.io + AMQP)"]
        rss["room-state-server (AMQP RPC + Postgres)"]
        mc["media-converter (AMQP RPC, janus-pp-rec)"]
        janus2["Janus (orbit image)<br/>RabbitMQ transport"]
        rmq2{{"RabbitMQ (janus-sdk)<br/>queue 'to-janus'"}}
        pg2[("Postgres 18<br/>janus-sdk")]
    end

    browser -->|HTTPS pages + Socket.IO| css
    operator -->|HTTPS pages + Socket.IO| oss
    browser -.->|WebRTC media + Janus WS signalling| janus
    operator -.->|WebRTC media| janus
    browser -.->|ICE relay| turn

    css <-->|"RabbitMQ RPC (~46 distinct RPC queue names in OSS server.js: 32 getRPCServer + 17 getRPCClient, 49 unioned incl. conditional/daemon): rpc-create-customer, rpc-waiting-room, rpc-videochat-oss, rpc-system-check (getJanus) ..."| rmq
    oss <--> rmq
    rmq <--> oss
    rmq <--> css

    oss -->|"HTTPS /api/v1..v3/*"| cvnginx
    oss -->|"WSS /ws"| cvnginx
    cvnginx --> cvhttp
    cvnginx --> cvws
    cvhttp --> cvredis
    cvws --> cvredis
    cvworkers <-->|"Redis-RPC (rpc: prefix, per-model)"| cvredis
    oss -.->|"Janus VideoRoom publisher 'cv' + listener (records CV stream)"| janus
    oss -.->|"Janus room inspect / listener"| janus

    oss -->|owns: Sequelize migrate+r/w| pg
    css -.->|"sessions (connect-redis)"| ossredis
    oss --> ossredis

    convert -.->|reads Janus .mjr recordings| janus

    oss -->|"rpc-esign:external"| esoss
    escss <-->|"esign:rpc-* RPC pairs"| esoss

    pdf --- rmq
    av --- rmq
    scraper --- rmq
    report --- rmq
    rm --- rmq
    ts -.-> emrtd

    sig <--> rmq2
    rss <--> rmq2
    mc <--> rmq2
    janus2 <--> rmq2
    rss --> pg2
    sig -->|socket.io| browser

Solid arrows = proven request/transport edges. Dotted = WebRTC/media or session/side edges. --- to RabbitMQ = "this service's only transport is the bus" (direction varies per call).

---

2. Service / process table

Service	Repo	Language / Runtime	Role	Talks to (proven)
vuer_oss (server.js)	vuer_oss	Node.js (Express 5, Socket.IO 4, Sequelize)	Operator/back-office web + system-of-record. Owns PostgreSQL + crypto/keys + WebRTC record→convert pipeline; exposes 32 unique getRPCServer queues and consumes 17 via getRPCClient (~46+ distinct RPC names incl. conditional/branch-gated, 49 unioned; server.js devel).	Operator browser (HTTPS+Socket.IO); RabbitMQ (server+client, ~46+ distinct RPC queue names: 32 server + 17 client); vuer_cv over HTTPS /api/v1..v3/* + WSS /ws; Janus via @techteamer/janus-api; PostgreSQL :5432; Redis (HARedis); esign_oss via rpc-esign:external
vuer_oss / convert.js	vuer_oss	Node.js daemon	Consumes queue-convert; transcodes Janus .mjr recordings via FFmpeg, timestamps, stores.	RabbitMQ (queue-convert server); Janus recordings on disk; crypto/timestamp services in-process
vuer_oss / media.js, background.js, cron.js, storage.js, integrationLog.js	vuer_oss	Node.js daemons (supervisord)	Background processing: media (media-ping), reports/archive/recognition (background-*), scheduled jobs (cron-ping), storage (queue-storage/queue-storage-state), integration logging (integration-log).	RabbitMQ; PostgreSQL; disk
vuer_css (server.js)	vuer_css	Node.js (Express 5, Socket.IO 4)	Customer-facing web/socket front door (homepage→system-check→waiting-room→videochat + self-service). No DB/business logic; bridges to OSS over RabbitMQ.	Customer browser (HTTPS pages + Socket.IO 4); RabbitMQ (client+server, ~40 queues); Redis (sessions); relays Janus coordinates from OSS to browser
vuer_cv	vuer_cv	Python 3.10+ (Falcon 4 + uWSGI; websockets)	CV/ML engine: face/doc/MRZ/barcode/liveness/PAD/hologram. HTTP REST + streaming WS; per-model worker fleet over a Redis-RPC bus. Leaf service.	nginx fronts HTTP /api/v1..v3/* + WS /ws (called by OSS); internal Redis (unix socket) + Redis-RPC to workers; receives WebRTC stream relayed from OSS/Janus
mq (@techteamer/mq)	mq	TypeScript → npm lib	RabbitMQ wrapper: RPC, Pub/Sub, Work-queue, Gathering patterns over amqplib. Not a service.	Imported by all Node FaceKom backends
janus-api (@techteamer/janus-api)	janus-api	JS → npm lib	Janus WebRTC-Gateway client (videoroom/streaming/videocall plugins); SDP munging; Admin API. Isomorphic (Node+browser).	Imported by vuer_oss (CV record, room inspect); speaks Janus JSON-over-WebSocket
pdfservice	pdfservice	Kotlin (Spring Boot, WebApplicationType.NONE)	PDF signing/validation (PDFBox, EU DSS). RPC-only, stateless.	RabbitMQ RPC server: pdf-prepareSignedDocument, pdf-insertSignature, pdf-validate, pdf-checkActiveComponents; outbound HTTPS to PKI/TSA. Caller = gap
antivirus_service	antivirus_service	Node.js	AV scanning gateway. RPC-only, no HTTP/DB/Redis.	RabbitMQ RPC server anti-virus-scanner (quorum queue, delivery-limit 30); local Unix socket to AV daemon. Caller = gap
timestamp_service	timestamp_service	Node.js → library	RFC3161 trusted-timestamp client. No RabbitMQ/HTTP server/DB.	Imported in-process; outbound HTTP to TSA
trust_list_proxy	trust_list_proxy	Kotlin → library	EU trusted-list (LOTL/TL) fetch/cache/validate. No RabbitMQ/DB/Redis.	Outbound HTTPS to trust-list URLs; consumed in-process
nyilvantarto_scraper	nyilvantarto_scraper	Node.js	Hungarian official ID-registry (KKSZB) verification + image/data retrieval; tamper-evidence ZIPs. RPC-only.	RabbitMQ RPC server kkszb-rpc on connection nyilvantarto (actions getDocumentDataBy4T, getDocumentDataByIdNumber). Referenced by customization/dap (not core devel)
report-engine	report-engine	Node.js + TimescaleDB	Metrics/report aggregation.	RabbitMQ RPC server logger-report-request; TimescaleDB (Postgres 18) metrics @ :5433
resource-manager	resource-manager	Node.js + Sequelize/Postgres	Admission control / capacity FIFO for the identification flow. RPC-only.	RabbitMQ RPC (per-resource queues, e.g. identification); PostgreSQL resource_manager @ :5432. OSS wires it via customization hooks (identificationRouter:*), not core
vuer_emrtd	vuer_emrtd	Kotlin CLI	eMRTD/NFC passport chip parsing + passive auth. Out-of-process: JSON in → JSON out.	CLI invocation only; outbound CRL/OCSP/AIA on --revocation
cert_utils	cert_utils	(lib)	Certificate utilities. Pure in-process library, no network.	Consumers import it
acl	acl	(lib)	Access-control-list logic. Pure in-process library.	Consumers import it
video-processor	video-processor	TypeScript → browser lib	Client-side virtual-background/blur via MediaPipe. Copy-pasted into front-ends.	Runs in browser; no backend edges
vuer_web_sdk	vuer_web_sdk	(browser SDK)	Embeddable web SDK for the customer journey.	Browser; talks to CSS (see repo doc)
esign_oss	esign_oss	Node.js	eSign operator-side server + bank webhook API. Owns eSign DB (Offers/Contracts/Signatures/App registry).	RabbitMQ: serves esign:rpc-app/-customer/-offer/-contract/-signature/-signature-check/-timestamp/-document; calls esign:css-ping, esign:rpc-system-oss, esign:cron-ping; exposes rpc-esign:external to vuer; HTTP loopback (web :10181, external :10182, socket :10180) behind nginx
esign_css	esign_css	Node.js (Express 5, Socket.IO 4)	eSign customer signing UI. No DB.	Customer browser; RabbitMQ: serves esign:css-ping, esign:rpc-system-oss; calls esign:rpc-app/-customer/-offer/-contract/-signature/-timestamp/-document/-jwt-auth; Redis sessions
portal_css	portal_css	Node.js (Express 4, Socket.IO 4)	Customer Portal front end (login/registration/personal-data). Proxies to OSS via RPC (rpc-vuer-portal/rpc-portal-vuer).	Customer browser; RabbitMQ RPC to OSS; Redis (customer cache)
janus-sdk / signaling-server	janus-sdk	TypeScript (socket.io + amqplib)	v2 WebSocket front door; orchestrates Janus over AMQP.	Browser (socket.io); RabbitMQ (to-janus queue, exchange reply); room-state-server via AMQP RPC
janus-sdk / room-state-server	janus-sdk	TypeScript + Postgres	v2 single source of truth for rooms/members/streams/locks.	RabbitMQ AMQP RPC server; Postgres 18
janus-sdk / media-converter	janus-sdk	TypeScript	v2 .mjr→.webm/.opus via janus-pp-rec.	RabbitMQ AMQP RPC server; recording/converted volumes

---

3. Connection details by transport

3.1 RabbitMQ (the spine)

• Broker: amqps://localhost:5671, mTLS with client cert/key/CA under /workspace/vuer_mq_cert/ (vuer_oss config/dev.json:677-686; vuer_css config/dev.json:277). Dev profiles of the Kotlin/standalone services fall back to plaintext amqp://...:5672 (pdfservice application-dev.properties, antivirus/scraper travisci).
• Library: @techteamer/mq (mq) for all Node services; Kotlin services use amqp-client + a TechTeamer QueueConfig/RpcServerOptions port. Patterns: RPC (reply queue + correlationId), Pub/Sub (fanout), Work-queue (durable named), Gathering (scatter/gather). Several services declare quorum queues with delivery-limit=30 (pdfservice, antivirus).
• vuer_css ↔ vuer_oss RPC pairs — matched by identical queue name (CSS getRPCClient ↔ OSS getRPCServer): rpc-create-customer, rpc-customer-portal-data, rpc-jwt-auth, rpc-get-customer, rpc-waiting-room, rpc-videochat-oss, rpc-callback-request, rpc-openhours, rpc-openhours-calendars, rpc-partner-service, rpc-custom-content, rpc-selfservice-actions, rpc-selfservice-upload, client-gate, rpc-system-check (carries systemCheck:getJanus), rpc-jwt-kiosk-auth, rpc-kiosk-alive-check, rpc-media-content, rpc-identification-router, rpc-device-compatibility-check, rpc-appointment, rpc-selfservice-v2, rpc-device-change, rpc-document-upload/-delete, rpc-customer-documents, rpc-flow-documents, rpc-presentation, kiosk-document-scan. Source: vuer_css server.js:116-163 (clients) vs vuer_oss server.js:372-422 (servers).
• Reverse pairs (OSS client → CSS/peer server): OSS calls css-ping, rpc-system-oss (served by CSS server.js:84-85); plus convert-ping, cron-ping, background-ping, media-ping, background-reports, background-archive, background-recognition, integration-log (own daemons). Source: vuer_oss server.js:432-458.
• Work queues / transport (symmetric both directions): queue-service-bus, queue-waiting-room, queue-videochat-css/-oss, queue-convert, queue-customer, queue-feedback, queue-customer-history, queue-webrtc-log, queue-clienterror-log, queue-convert-state, queue-storage/-state, queue-job-status-change, queue-selfservice-css/-events/-cron/-v2/-v2-css, css-client-ping-result, queue-transport-oss/queue-transport-css + rpc-transport-oss/rpc-transport-css (the bidirectional Transport pool). Source: vuer_oss server.js:481-585, vuer_css server.js:172-217.
• Pub/Sub: customer-key, settings-change, background-process (publisher+subscriber in OSS, server.js:545-571).
• eSign: OSS → rpc-esign:external (client, vuer_oss server.js:466-468, gated by esign.active:true, config/dev.json:532-534) ↔ served by esign_oss. esign_css ↔ esign_oss share esign:rpc-app/-customer/-offer/-contract/-signature/-signature-check/-timestamp/-document/-jwt-auth and esign:css-ping/esign:rpc-system-oss (esign_css server.js:89-110, esign_oss server.js:250-266).
• Standalone RPC servers (queue name = the edge): pdfservice pdf-prepareSignedDocument/pdf-insertSignature/pdf-validate/pdf-checkActiveComponents; antivirus anti-virus-scanner; scraper kkszb-rpc (conn nyilvantarto); report-engine logger-report-request; resource-manager per-resource (identification).

3.2 HTTP (vuer_oss → vuer_cv)

• OSS VuerCVService builds vuerCVBaseUrl = ${cv.httpProtocol||'https'}://${host} and calls /api/v1/ping (vuer_oss server/service/VuerCVService.js:24,110) plus per-vision routes via the registered vision APIs.
• CV registers exactly these 24 Falcon routes (all app.add_route(...) calls, vuer_cv app_http.py:66-89): /api/v1/{ping,image-upload,mrz,face-detect,face-compare,face-draw,reference-face-extract,face-gender-age,image-download,sharpness,barcode,barcode-detect,document-ocr,ocr,background-mask,kaptcha-decoder,card-warp,card-integrity-check,document-types,status} (note /api/v1/document-ocr and /api/v1/ocr are distinct routes — DocumentOcrResource vs OcrResource), plus /api/v2/document-recognition, /api/v3/document-recognition, /api/v2/document-warp, /api/v3/document-warp. nginx terminates TLS in front (nginx_vuer_cv_*.conf.j2).

3.3 WebSocket (vuer_oss → vuer_cv streaming)

• OSS VuerCVWebSocket connects ${cv.wsProtocol||'wss'}://${host}/ws (vuer_oss server/cv/VuerCVWebSocket.js:20, ws client).
• CV app_websocket.py runs a websockets server on 127.0.0.1:40082 + workerId (app_websocket.py:108-115); per-task processors (face/doc/mrz/barcode/sharpness/speech/holo) in server/websocket/task/. The image stream itself arrives as a WebRTC publish into Janus that OSS sets up: VuerCVListenerSession creates a VideoRoomPublisherJanusPlugin(..., 'cv', ...) and a VideoRoomListenerJanusPlugin (vuer_oss server/cv/VuerCVListenerSession.js:162-203), bridging the customer’s Janus room frames to CV.

3.4 Socket.IO (vuer_css ↔ browser)

• CSS attaches a Socket.IO v4 server to the Express HTTP server with config.get('web.socket') options (vuer_css server/socket/socket-server.js:14); event modules include videochat, videochat.presentation, videochat.validation, selfservice, selfservice-v2 (server/socket/events/*). The browser obtains Janus coordinates from OSS via rpc-system-check → systemCheck:getJanus (vuer_css server/queue/rpc_client/SystemCheck.js:5, used in web/routes/lobby.endpoint.js:24, system-check.endpoint.js:16) and connects to Janus directly for media.

3.5 Janus WebRTC

• Config (dev): signalling wss://localhost:8989, admin wss://localhost:7989, adminSecret janusoverlord (vuer_oss config/dev.json:357-361). ICE via TURN/STUN turnserver.facekomtest.net:3478 (:366-368; same block in vuer_css config/dev.json:218-223).
• The browser and OSS both attach to Janus VideoRoom; convert.js reads the resulting .mjr recordings from disk (recordDirectory:/workspace/records/, vuer_oss config/dev.json:540). Janus itself is an external image, not in any FaceKom repo (see janus-api, janus-sdk).

3.6 PostgreSQL

• OSS owns it: postgres://dev:dev@localhost:5432/vuer_oss (vuer_oss config/dev.json:570); OSS server.js is the only entrypoint that migrates/syncs (per vuer_oss). 61 Sequelize models.
• resource-manager: postgres://dev:dev@localhost:5432/resource_manager (resource-manager config/dev.json:4). report-engine: TimescaleDB (Postgres 18) metrics @ :5433. janus-sdk: its own Postgres 18 (docker-compose.yml:9-10). esign_oss: its own DB (Offers/Contracts/etc.).

3.7 Redis

• OSS: redis client (HARedis) bootstrapped at server.js:731 → server/bootstrap/connection/redis.js:3,21; unix socket /var/run/redis/redis-server.sock (config/dev.json:900). OSS runs its own redis process under supervisord (supervisor_vuer_oss_docker.conf:21-22).
• CSS / portal_css / esign_css: Redis as the session store (connect-redis) over unix socket /var/run/redis/redis-server.sock (vuer_css config/dev.json:17-19,375-377).
• CV: Redis over unix socket is core — both an image/frame cache (server/appcache.py) and the internal RPC transport between front-ends and per-model workers via RedisRpcServer/Client(queue, redis, prefix='rpc:') using blpop/rpush (server/rpc/pyredisrpc.py:34-133); worker queues face, mrz, ocr, onnx, detectron2, pad.
• janus-sdk: uses RabbitMQ + Postgres, no Redis evidenced.

---

4. Two WebRTC generations

• v1 (current product): Janus driven from vuer_oss via @techteamer/janus-api; browser signalled by vuer_css over Socket.IO; recordings converted by OSS convert.js. Janus = external image.
• v2 (janus-sdk): stateless signaling-server replicas orchestrate Janus over RabbitMQ (to-janus queue), with a Postgres-backed room-state-server and AMQP media-converter. Janus uses its RabbitMQ transport (RABBITMQ_HOST=janus-sdk-rabbitmq, docker-compose.yml:159-163). This is a separate plane with its own broker + DB; cross-wiring into vuer_oss/css is not evidenced here — see gaps.

---

5. Process supervision & TLS edge

• vuer_oss runs exactly 9 supervised programs (9 [program:*] blocks in supervisor_vuer_oss_docker.conf): nginx, redis, vuer_oss (server.js), vuer_integration_log (integrationLog.js), vuer_media (media.js), vuer_oss_convert (convert.js), vuer_cron (cron.js), vuer_background (background.js), vuer_oss_storage (storage.js).
• vuer_cv runs nginx + redis + uWSGI HTTP + websocket workers + per-model workers under supervisord (per vuer_cv).
• esign_oss binds HTTP loopback only (web :10181, external :10182, socket :10180) behind nginx (per esign_oss).
• nginx fronts TLS for vuer_oss, vuer_cv, esign_oss; the Node/Python servers bind loopback.

---

6. Gaps / unproven

Edges I could NOT verify from opened source — do not treat as fact:

• Who calls pdfservice / antivirus_service / timestamp_service / trust_list_proxy. Their queue names/libraries are proven, but no reference to pdf-*, anti-virus-scanner, or trust-list/timestamp queues exists in vuer_oss devel or esign_oss devel (grep returned nothing). The caller is most likely the eSign signing path or a deployment-specific orchestrator, but it is not evidenced in the branches read. (pdfservice’s own doc calls the partner “the FaceKom core/orchestration” without naming it.)
• resource-manager ↔ vuer_oss wiring. OSS IdentificationRouterRPCServer resolves results through hooks (callOnlyHook('identificationRouter:getResult', ...), server/queue/rpc_server/IdentificationRouterRPCServer.js:83-85), and core devel has a single RabbitMQ connection with no identification/resource_manager client. The actual RPC call into resource-manager is therefore in a customization hook, not read here.
• nyilvantarto_scraper caller is customization/dap only (customization/bin/kkszb-test.js, customization/background-customization.js) — not core devel. Treat as partner-specific.
• report-engine logger-report-request caller not located in OSS devel (the background-reports/background-archive queues are OSS-internal daemons, a different thing).
• janus-sdk (v2) ↔ vuer_oss/css integration. janus-sdk is self-contained (own RabbitMQ vhost + Postgres); how/whether vuer_oss adopts it is not evidenced in either repo.
• vuer_web_sdk / portal_css exact browser↔server edges were taken from sibling repo docs, not re-verified line-by-line here.
• Exact OSS→CV host value (cv.host / cv config key) is empty in dev.json (config/dev.json:150 "cv": ""); the host is injected per-room/deployment (new VuerCVService(host, ...)), so the concrete hostname is environment-supplied, not a static literal.

---

Sources

Files actually opened (via git show <branch>:<path> / git grep, read-only):

• vuer_oss (devel): server.js (29-640), config/dev.json (52-95, 357-368, 530-548, 570, 677-720, 900), server/service/VuerCVService.js, server/cv/VuerCVSession.js, server/cv/VuerCVWebSocket.js, server/cv/VuerCVListenerSession.js, server/room-inspector/RoomInspector.js + VideoRoomInspectorJanusPlugin.js, server/queue/rpc_server/IdentificationRouterRPCServer.js, convert.js, server/bootstrap/connection/redis.js, supervisor_vuer_oss_docker.conf; branch scan of customization/dap|nusz, update/customization/instacash-2026-05-27.
• vuer_css (origin/devel): server.js (76-352), server/socket/socket-server.js, server/queue/rpc_client/SystemCheck.js, server/web/routes/lobby.endpoint.js, server/web/routes/system-check.endpoint.js, server/service/TurnPasswordService.js, config/dev.json (17-19, 218-223, 277, 375-397).
• vuer_cv (devel): app_http.py (3-60), app_websocket.py (1-115), server/rpc/pyredisrpc.py (34-133), server/appcache.py, config/dev.json (3-4), server/cv/background_mask_engine.py, server/cv/barcode_engine.py; git ls-tree server/websocket/**.
• esign_oss (devel): server.js (250-305), config/dev.json (esign block).
• esign_css (devel): server.js (89-128).
• resource-manager (master): server.js (18-69), config/dev.json (4-25).
• janus-sdk (master): signaling-server/src/index.ts (1-64), room-state-server/src/roomStateServer.ts (head), docker-compose.yml (2-163).
• Sibling repo docs cross-checked (for queue/port facts re-derived from their cited source): repos/pdfservice.md, repos/antivirus_service.md, repos/report-engine.md, repos/timestamp_service.md, repos/trust_list_proxy.md, repos/nyilvantarto_scraper.md, repos/acl.md, repos/cert_utils.md, repos/vuer_emrtd.md, repos/mq.md, repos/janus-api.md, repos/janus-sdk.md, repos/video-processor.md, repos/portal_css.md, plus heads of repos/vuer_oss.md / vuer_css.md / vuer_cv.md / esign_oss.md / esign_css.md.

Related: INDEX · customization-architecture · customization-branch-catalog