vuer_docker — FaceKom local dev & build orchestration

vuer_docker

vuer_docker is the Docker Compose orchestration + image-build repo that stands up a complete local FaceKom development environment (and the CI/test environment). It contains no application code of its own — there is no package.json, build.gradle, or pom.xml anywhere in the tree (verified: find . -name package.json/build.gradle/pom.xml returns nothing). Instead it ships: per-service Dockerfiles, a set of Compose YAML files (one or a few services each, composed à la carte), an .env pinning every image tag, install/ shell scripts baked into the images, and a developer convenience CLI bin/vuer.sh.

Working tree is on devel, NOT master — and they diverge heavily

The checked-out branch is devel (git rev-parse --abbrev-ref HEAD = devel). The task nominated master as base, but master and devel are structurally different repos. Files this doc describes — bin/, install/, install2/, otel/, sftp/, mssql/, oracledb19/, vuer_cv_dev/, pdfservice/, nyilvantarto/, testenv/, facekom_library/, avast/, README.md, services.yml — do not exist on master (verified via git ls-tree master -- <path> → empty; git cat-file -e master:bin/vuer.sh → “MISSING on master”). master instead tracks a sparser, customization/production-leaning layout with files like platform-css.yml, platform-pss.yml, platform_pss/, vuer-cv-microsec.yml, vuer-cv-unicredit-srb.yml. Everything below was read from the devel working tree (the branch the README tells you to check out: line 66 git checkout devel). See customization-branch-catalog for the many per-customer branches (remotes/origin/aegon-kar, allianz-instant, bankmonitor, cofidis, …).

---

1. Purpose & role in FaceKom

• Orchestrates the full FaceKom stack locally so an engineer can run vuer_oss, vuer_css, esign_oss, esign_css, portal_css, vuer_cv, plus all backing services (RabbitMQ, Postgres/MSSQL/MySQL/Oracle, Janus WebRTC gateway, Redis-in-app, ClamAV, MinIO, SFTP, an OTel/Grafana stack, Toxiproxy fault injection).
• Acts as the image factory: each first-party service has a Dockerfile here (e.g. vuer_oss/Dockerfile, vuer_css/Dockerfile, rabbitmq/Dockerfile, postgresql/Dockerfile, janus/Dockerfile, pdfservice/Dockerfile, nyilvantarto/Dockerfile, clamav/Dockerfile, turn/Dockerfile, mssql/Dockerfile, facekom_library/Dockerfile, testenv/Dockerfile, portal_css/Dockerfile, esign_*/Dockerfile, vuer_cv_dev/Dockerfile). Built images are tagged into Harbor: harbor.techteamer.com/${PROJECT_NAME}/<svc>:<version> (PROJECT_NAME=facekom-devel, .env:1).
• README.md (479 lines on devel) is a step-by-step developer onboarding guide: SSH/Git setup, /etc/hosts wildcard DNS (*.facekomdev.net / *.test), Harbor + Oracle registry login, cloning sibling repos into /workspace, and per-stack docker-compose … pull / up -d recipes.
• Source repos are mounted from the host into containers (e.g. vuer-oss.yml:39 /workspace/vuer_oss:/workspace/vuer_oss); the container runs the live code via supervisor, so dev is edit-on-host / run-in-container.

Naming

vuer is FaceKom’s internal/product codename. oss = the back-end (“Operator Server Side”/API service), css = the front-end/client server (“Client Server Side”). Confirmed by nginx upstreams (nginx_proxy/proxy_servers.conf) and the bin/vuer.sh project list.

2. Tech stack & runtime

• This repo’s “language” is Docker Compose YAML + Bash. No Node/JVM/Python project manifest exists in it.
• Compose: docker-compose v1 syntax (version: '3' header on most *.yml). Two files omit the version key (Compose-v2 style): otel.yml and toxiproxy.yaml. README and bin/vuer.sh invoke the legacy docker-compose -f … binary; some service READMEs use docker compose (v2 plugin) — both are used.
• Image base for first-party Node services: registry.access.redhat.com/ubi9/ubi-minimal (RHEL UBI9), package mgr microdnf with Oracle-Linux-9 + EPEL-9 repos (vuer_oss/Dockerfile:1, vuer_css/Dockerfile:1).
• Node version baked into vuer images: Node 24.x — both vuer_oss/Dockerfile and vuer_css/Dockerfile run install/install-nodejs-24.sh (which pins NODE_VERSION="24.x" from rpm.nodesource.com/pub_24.x). Older installers (install-nodejs-20.sh=20.x, install-nodejs-22.sh=22.x, install-nodejs.sh=18.x) remain in install/ for other images. The app package manager inside the containers is yarn (installed via yarn.repo); CV uses pip and facekom_library uses pnpm (README §Post installation).
• .env is the single source of truth for versions (.env, 41 vars). Key pins (devel): VUER_VERSION=2026.1.UBI9, ESIGN_VERSION=2024.4, PORTAL_VERSION=2026.1.UBI9, VUERCV_TAG=4.6.2, RABBIT_VERSION_NUMBER=4.1.4 (Erlang 27.3.4.2-1.el9 default in rabbitmq/Dockerfile:5), POSTGRESQL_VERSION_NUMBER=16.6, JANUS_VERSION_NUMBER=0.12.4 (pinned to commit JANUS_VERSION_COMMIT=b02e09ed…), TURN_VERSION_NUMBER=4.5.2, CLAMAV_VERSION=ubuntu-bionic, DEV_UID/DEV_GID=1000, SECURITY_NUMBER=20220315 / SECURITY_NUMBER_ESIGN=20240614 (appended to every image tag).
• Networking: virtually every service runs network_mode: "host" — there is no Docker bridge network in the default Linux flow; services find each other on localhost. The exception is macos-vuer-dev.yml, which defines explicit bridge networks (oss 172.16.238.0/24, css 172.16.239.0/24) with static IPs, since network_mode: host doesn’t work on Docker Desktop for Mac.

3. Build & run

There is no scripts block to enumerate — no package.json exists. The build/run surface is: Compose files + the bin/vuer.sh CLI + per-service helper scripts.

Entry points

• bin/vuer.sh (10.1 KB) — the developer CLI, dispatched as vuer.sh <command> <subcommand>. devel-only (absent on master). It is meant to be run from inside a sibling project root (vuer_oss|vuer_css|esign_css|esign_oss) and shells into containers via docker exec. Full command tree (from its own vuer_help, lines 49–97) and verified implementations:
  • vuer_checkout <branch> [project] (126) → runs git_status → server_stop → git_checkout → dev_install → server_start → dev_build for the project (or vuer/esign fan-out).
  • workspace init (156) → mkdir -p /workspace/{records,ocr,archive}. workspace wipe is a stub (echo only).
  • db init <container> (185) → docker exec <c> bin/db/create_user admin … operator … (creates an admin + operator user via the app’s own bin/db/create_user). db wipe stub.
  • server start|stop|status|restart [process] (202–287) → docker exec <container> supervisorctl <action> <process>; vuer/esign aliases fan out to the _oss+_css pair. (Note: server restart actually calls server_start, lines 273–275 — a verified bug.)
  • docker up|down|restart|update (303–336) → cd /workspace/vuer_docker then docker-compose -f esign-css.yml -f esign-oss.yml -f vuer-css.yml -f vuer-oss.yml -f dev.yml <action>; docker update also git pulls and re-pulls images.
  • git status|checkout (355–424) → guards against uncommitted changes, git checkout <branch> + git pull in /workspace/<repo>.
  • dev build|install|reinstall|watch (432–501) → docker exec <c> running npm run build / yarn / rm -r node_modules && yarn / npm run watch.
  • cd <project> (291) is documented as “not working!” (it cds in the subshell only).
  • BRANCHES const (109–122) lists the customization branches it knows about (customization/bankmonitor, …/barion, …/cofidis, …/dlapiper, …/generali-*, …/kh, …/magnet, …/mikrocredit, …/mkb, …/sberbank).
• No image-level ENTRYPOINT/CMD in most service Dockerfiles — containers are driven by supervisor; e.g. rabbitmq/Dockerfile ends with CMD ["/usr/local/bin/supervisord","-n","-c","/etc/supervisor/supervisord.conf"]. vuer_oss/vuer_css Dockerfiles install supervisor + redis + nginx and rely on supervisor configs mounted from sibling repos at runtime.

Compose files (each defines a slice of the stack)

Run by composing the relevant files with -f. Verified inventory (devel root):

File	Services defined	Notes
dev.yml	rabbitmq, postgresql, nginx_proxy, syslog-ng	the always-on core; nginx_proxy is plain nginx:stable mounting nginx_proxy/*.conf
vuer-oss.yml	janus, vuer_oss	builds vuer_oss/Dockerfile; Janus built from pinned commit
vuer-css.yml	vuer_css	front-end server
vuer-cv.yml	vuer_cv	prebuilt CV image (restart: "no")
vuer-cv-dev.yml	vuer_cv (container vuer_cv_dev)	mounts /workspace/vuer_cv; GPU env commented out
vuer-cv-gpu.yml	vuer_cv (container vuer_cv_dev)	builds ./vuer_cv_dev, NVIDIA env enabled
esign-oss.yml / esign-css.yml	esign_oss / esign_css	eSign back/front; oss sets TSA test creds + mounts a .p12 seal
portal-css.yml	portal_css	portal front-end
facekom-library.yml	facekom-library	only service publishing a port (50080:80); pnpm app
services.yml	pdfservice, nyilvantarto	shared Java/PDF + registry-scraper services (JAVA_HOME set)
testenv.yml	testenv, postgresql, rabbitmq	CI image harbor.techteamer.com/travisci-facekom/testenv
otel.yml	otel-collector, init-tempo, tempo, prometheus, grafana, cadvisor, init-loki, loki, promtail	full observability stack; publishes ports 4317/9090/3000
toxiproxy.yaml	toxiproxy	ghcr.io/shopify/toxiproxy:2.12.0, fault injection
clamav.yml	clamav	AV scanner
minio.yml	minio	S3 (minio/minio:RELEASE.2025-02-28…), web on :9000
mssql.yml	mssql	builds ./mssql, SA pw Root1234!
mysql.yml	mysql	mysql/mysql-server:5.7, db vuer_oss
oracledb19.yml	oracledb19	container-registry.oracle.com/database/enterprise:19.3.0.0
sftp.yaml	sftp	atmoz/sftp, port 2222:22
janus-dev.yml	janus_dev	dev variant mounting /workspace/janus-gateway, builds janus_dev.Dockerfile
macos-vuer-dev.yml	bridge-network variant of core+vuer	Docker-Desktop-for-Mac path (static IPs)

Typical start commands (from README + bin/vuer.sh)

# core only
docker-compose -f dev.yml up -d
# full vuer
docker-compose -f vuer-css.yml -f vuer-oss.yml up -d
# everything bin/vuer.sh treats as "the stack"
docker-compose -f esign-css.yml -f esign-oss.yml -f vuer-css.yml -f vuer-oss.yml -f dev.yml up -d
# post-build inside a container
docker exec -it vuer_oss bash -lc 'yarn && yarn build'

Oracle needs a one-time ./oracledb19/oracledb19-init.sh after the container is healthy (README:309).

4. Top-level structure (devel working tree)

Build-context / Dockerfile dirs:

Path	What it is
bin/	the vuer.sh developer CLI (1 file). devel-only.
install/	shell scripts + repo/GPG files baked into images (Node/yarn/redis/rabbitmq/supervisor/nginx/tsa/softhsm/puppeteer/avast installers; yum/, dnf/, apt/, nginx/, supervisor/, rabbitmq/, haproxy/, tools/, certs/ subdirs). devel-only.
install2/	parallel/alt install tree (dnf/ nginx/ supervisor/ tools/ yum/) — empty of top-level files. devel-only.
vuer_oss/	Dockerfile (UBI9 + Node24 + janus build), build_janus.sh, emrtd/ pdf/ tsa/ yum/, a vendored oracle.tar.gz (28 MB OCI client)
vuer_css/	front-end Dockerfile (UBI9 + Node24 + redis + nginx)
vuer_cv_dev/	small Dockerfile for the CV dev image. devel-only.
esign_oss/ esign_css/	eSign Dockerfiles; esign_oss/pdf/ extras
portal_css/	portal front-end Dockerfile
janus/	Janus WebRTC build: Dockerfile, janus_dev.Dockerfile, build_janus.sh, dev_build.sh, prepare_janus.sh, supervisor_janus.conf
rabbitmq/	RabbitMQ image: Dockerfile, rabbitmq.config (TLS-only :5671), rabbitmq-env.conf, rabbitmq.sh, supervisor conf
postgresql/	Postgres image: Dockerfile + 13.5 KB entrypoint.sh (multi-DB bootstrap)
mssql/	MSSQL image: Dockerfile, entrypoint.sh, mssql-init.sh, mssql-init.sql. devel-only.
oracledb19/	oracledb19-init.sh + .sql (creates dev user, AL32UTF8). devel-only.
clamav/	AV image: Dockerfile, clamav.conf, supervisor conf
turn/	coturn TURN server image
pdfservice/ nyilvantarto/	shared services build dirs (dnf/ supervisor/ tools/ tsa/ yum/). devel-only.
facekom_library/	library image (Dockerfile, nginx/, supervisor/). devel-only.
testenv/	the big CI image (8.4 KB Dockerfile, build_janus.sh, 12 config subdirs incl. emrtd/ janus/ tsa/ syslog-ng/). devel-only.
avast/	Avast AV image (Dockerfile, avast-gpg-key.asc, TODO, dnf/ yum/). devel-only.
nginx_proxy/	the host reverse-proxy configs: proxy_servers.conf (6.1 KB, all upstream routing), ssl.conf, security.conf, gzip.conf, proxy.conf
otel/	observability configs: collector/, grafana/ (provisioning + 2 dashboards), loki/, prometheus/, promtail/, tempo/. devel-only.
toxiproxy/	fault-injection tooling: bin/ scripts, proxies/ (css/oss websocket), toxics/ (6 toxic JSONs), patches/ (nginx conf patches), README.
sftp/	SFTP test server assets: README.md, users.conf, keys/, upload/. devel-only.
etc/	.gitconfig template copied to ~ during setup
workspace/	large, branch-divergent runtime/config tree (certs, janus jcfgs, syslog-ng, mysql cnf, macos overrides, tsa test CAs, per-service log/ dirs). 393 files differ between master↔devel here.
*.md	README.md, build-cv.md (CV image build), esign.md (eSign image build one-liners)

5. First-party bin/ helper scripts (READ each)

Two first-party bin/ dirs exist (neither is node_modules):

bin/vuer.sh

Covered in §3 — the whole-stack developer CLI. Single Bash file, function-dispatch via the cmd <prefix> <name> helper (line 25), cmd vuer $@ at the bottom (503).

toxiproxy/bin/ (4 scripts, all Bash, all hit Toxiproxy HTTP API at http://localhost:8474)

• fetch-config — curl -s $TOXIPROXY_URL/proxies | jq . — dump current proxy config.
• populate-proxies [name] — POSTs each proxies/**/*.json (css/oss websocket) to /proxies to create/update proxies; optional name filter; tolerates “already exists”. (Note: the loop’s for proxy_file in … header line is not visible in the on-disk file as shown — the body iterates proxy JSONs.)
• apply-toxic <proxy> [toxic] — verifies the proxy exists, then applies one or all toxic JSONs from toxics/ (bandwidth, latency, limit_data, reset_peer, slow_close, timeout).
• reset — curl -s -X POST $TOXIPROXY_URL/reset — clears all toxics but keeps proxies. Usage flow and the nginx git apply patches to route vuer_css/vuer_oss websockets through Toxiproxy are in toxiproxy/README.md.

install/, oracledb19/, mssql/, janus/, rabbitmq/, sftp/ also contain shell scripts, but they live in service/build dirs (not a bin/). The important ones are summarized in §6/§3.

6. Key modules / services (representative source reads)

• vuer_oss/Dockerfile (UBI9): microdnf update; installs gcc-c++ make redis nginx htop git openssl; runs install/install-nodejs-24.sh; installs nodejs yarn python3 python3-devel python3-pip; pip3 install supervisor; builds Janus in-image via vuer_oss/build_janus.sh; heavily rewrites /etc/redis/redis.conf to run Redis as a unix-socket-only (port 0, unixsocket /var/run/redis/redis-server.sock), no-persistence, 512 MB LRU cache. Sets Oracle OCI env (LD_LIBRARY_PATH=/workspace/oracle/, OCI_INC_DIR/OCI_LIB_DIR) and JAVA_HOME for java-11. → confirms vuer_oss talks to Oracle and embeds Redis + Janus.
• vuer_css/Dockerfile: same UBI9 + Node24 + Redis-socket pattern, minus Janus/Oracle (front-end server with its own nginx + redis).
• rabbitmq/: Dockerfile builds RabbitMQ 4.1.4 / Erlang 27 on UBI9 via install/install-rabbitmq.sh, supervisor-managed; rabbitmq.config disables plain TCP and enables TLS-only on :5671 with mutual auth (verify_peer, fail_if_no_peer_cert, certs under /workspace/vuer_mq_cert), max_message_size 536870911. install/rabbitmq/health-check.sh checks supervisor + ≥2 cluster nodes via the mgmt API (monitoring:monitoring@localhost:15672).
• postgresql/entrypoint.sh (13.5 KB) bootstraps multiple DBs from DB_NAME="vuer_oss,esign_oss,vuer_oss_test" with user/pass dev/dev and PG_TRUST_LOCALNET (dev.yml:29-33). (Read by size/role; not line-by-line — see gaps.)
• janus/build_janus.sh / vuer_oss/build_janus.sh: download Janus tarball at pinned commit, ./configure --enable-post-processing --disable-data-channels --disable-all-plugins --enable-plugin-echotest --enable-plugin-videoroom --disable-all-transports --enable-websockets, make && make install. janus/dev_build.sh rebuilds an already-mounted /workspace/janus-gateway.
• install/install-os.sh (base layer: dnf.conf + shadow-utils/procps/tar/findutils/openssl), install/install-supervisor.sh (pip install supervisor==4.2.5, copies install/supervisor → /etc/supervisor), install/supervisor/supervisord.conf ([include] files = /etc/supervisor/conf.d/*.conf). These three are the shared build primitives reused across --mount=type=bind,source=/install Dockerfiles (see rabbitmq/Dockerfile).
• nginx_proxy/proxy_servers.conf: the single host reverse proxy. Upstreams (verified): vuer-oss→:20080, vuer-css→:30080, vuer-css-sdk→:30081, esign-oss→:20180, esign-api→:20181, esign-css→:30180, portal-css→:30380, vuer-cv→:40080, facekom-library→:50080. Server blocks match ~^oss-(.+)\.facekomdev\.net$ / ~^…\.test$ wildcard hostnames, terminate TLS with /workspace/cert/dev.crt|key, and proxy with websocket upgrade headers.
• otel/collector/config.yaml: OTLP in (gRPC :4317 / HTTP :4318) → traces to tempo:4317, metrics to Prometheus exporter :9090. Grafana provisioned anonymous-admin (otel.yml).

7. Configuration

• .env (repo root) — pins all image versions/build numbers + PROJECT_NAME=facekom-devel, COMPOSE_IGNORE_ORPHANS=true, DEV_UID/DEV_GID=1000, and the SECURITY_NUMBER* tag suffixes. Every Compose image: interpolates from here. There is no getconfig/AJV/JSON-schema config in this repo — config schemas live in the application repos (vuer_oss etc.). The README shows example app configs (DB URLs, sftp block) that the engineer writes into the sibling repos’ config/local.json, not files stored here.
• DEV_DOMAIN env var — the per-engineer wildcard domain (e.g. you.facekomdev.net), set in /etc/environment (README:78) and passed into vuer/esign/portal/cv containers (environment: - DEV_DOMAIN=$DEV_DOMAIN).
• .buildignore = avast/avast-gpg-key.asc; .gitignore = .idea *.log* *.key *.pub.
• Service-level config files (mounted, not built): rabbitmq/rabbitmq.config & rabbitmq-env.conf; nginx_proxy/*.conf; otel/**/*.yaml; clamav/clamav.conf; workspace/janus/*.jcfg; workspace/syslog-ng/*.conf; sftp/users.conf (techteamer:1000:1000::upload). Secrets/creds are hardcoded dev values (Postgres dev/dev, MSSQL sa/Root1234!, MySQL dev/dev, MinIO facekom/root_password, Oracle dev/dev, esign TSA test/test).

8. Tests

• No test framework or test files in this repo (it builds/runs other services). Search for package.json/test configs returns nothing.
• The CI/integration test environment is an image built here: testenv/Dockerfile (8.4 KB) → harbor.techteamer.com/travisci-facekom/testenv, composed via testenv.yml alongside postgresql + rabbitmq, mounting /workspace/vuer_css, /workspace/vuer_oss, /workspace/test_resources, and writing /workspace/test_results. The actual test suites live in the application repos run inside this container.

9. Dependencies on other FaceKom services (evidenced in code)

• RabbitMQ — central message bus. Built & TLS-only (mutual auth) on :5671 (rabbitmq/rabbitmq.config); mgmt API on :15672 (install/rabbitmq/health-check.sh). Every back-end service mounts vuer_mq_cert to speak to it (vuer-oss.yml:43, esign-oss.yml, services.yml:20, portal-css.yml). defs.json (install/rabbitmq/defs.json) is empty {} here — no queue/exchange definitions are declared in this repo; queues are created by the apps. The macos-vuer-dev.yml depends_on graph (janus→rabbitmq, vuer_oss→janus, vuer_css→vuer_oss) documents the intended start order.
• PostgreSQL (:5432, dbs vuer_oss,esign_oss,vuer_oss_test, dev/dev) — primary DB; alt DBs MSSQL/MySQL/Oracle are optional drop-ins (README §optional). vuer_oss image carries the Oracle OCI client (oracle.tar.gz + OCI env) so it can target Oracle. See FKITDEV-8252-oracle-ol10-memo for Oracle-client work.
• Janus (WebRTC gateway) — built from pinned commit, used by vuer_oss for video rooms / recording (/workspace/records).
• HTTP routing — nginx_proxy fronts all services on the host; cross-service HTTP is via the upstreams in §6 (e.g. esign-api on :20181, vuer-cv on :40080, facekom-library on :50080).
• Redis — not a separate service; embedded per-container as a unix-socket cache (configured in each Node Dockerfile).
• ClamAV / Avast — virus scanning images; MinIO — S3 for object storage; SFTP (atmoz/sftp :2222) — exercised by vuer_oss (README sftp config snippet). pdfservice / nyilvantarto — shared PDF-signing + Hungarian registry-scraper services (services.yml).
• OTel/Grafana/Loki/Tempo/Prometheus/Promtail/cAdvisor — full local observability (otel.yml); promtail tails workspace/log/vuer_{oss,css,cv}.

10. Gotchas (verified)

master ≠ devel (repeat)

See the top callout. If you git ls-tree master, most files described here vanish. Always work on devel for the dev environment.

network_mode: host everywhere (Linux-only)

The default Compose files assume Linux host networking; services talk over localhost:<port>. On macOS you MUST use macos-vuer-dev.yml (bridge networks + static IPs) — host networking is a no-op on Docker Desktop.

bin/vuer.sh server restart doesn't restart

Lines 273–275: server_restart’s vuer/esign cases call server_start (not server_restart/stop+start). Use server stop then server start, or docker restart, if you need a true restart.

Hardcoded dev credentials & test certs

Postgres dev/dev, MSSQL sa/Root1234!, MySQL dev/dev, MinIO facekom/root_password, Oracle dev/dev, esign TSA test/test, RabbitMQ mgmt monitoring/monitoring. Dev-only — never reuse. RabbitMQ requires the vuer_mq_cert PKI to even connect (TLS-only, client cert mandatory).

Oracle one-time init & ~20 min health

oracledb19 can take up to ~20 min to become healthy; you must then run ./oracledb19/oracledb19-init.sh (creates dev user + AL32UTF8 charset, does several SHUTDOWN/STARTUP). Pulling the Oracle image needs a container-registry.oracle.com login.

Many sibling repos are prerequisites

The Compose files bind-mount /workspace/<repo> from the host; you must clone vuer_oss, vuer_css, esign_oss, esign_css, cert, pdfservice, nyilvantarto_scraper, facekom_library (+ optionally vuer_cv, janus-gateway) into /workspace first, or containers start against empty mounts.

install/rabbitmq/defs.json is empty; CV build path changed

No broker topology is shipped here. Also build-cv.md notes CV ≥4.2.0 is built from the vuer_localdev repo (./bin/facekom build cv_dev_fk), not from this repo.

---

Unverified / gaps

• master branch contents were only enumerated (git ls-tree master), not read. The master-only files (platform-css.yml, platform-pss.yml, platform_pss/, vuer-cv-microsec.yml, vuer-cv-unicredit-srb.yml) are not documented here. This doc describes the devel working tree.
• workspace/ (large, 393 files differ between branches) was surveyed structurally and via the master↔devel diff stat only; individual files (janus jcfgs, syslog-ng confs, macos overrides, tsa CAs) were not read line-by-line, except as referenced by Compose mounts.
• Read by role/size, not line-by-line: postgresql/entrypoint.sh (13.5 KB), testenv/Dockerfile (8.4 KB), and the remaining service Dockerfiles (esign_oss, esign_css, portal_css, clamav, turn, pdfservice, nyilvantarto, facekom_library, mssql, vuer_cv_dev, janus) — their purpose is confirmed via the Compose files and dir listings; their internal RUN steps were not all read.
• install/ & install2/ subtrees: representative installers read (install-os/-supervisor/-nodejs*/-rabbitmq/-redis.sh, supervisord.conf, rabbitmq/health-check.sh, rabbitmq/defs.json); the rest (install-tsa.sh, install-softhsm.sh, install-puppeteer-*.sh, install-java-11.sh, haproxy/*, tools/*, certs/*, all yum/*.repo/GPG keys, apt/*) were listed but not all read. install2/ has no top-level files (only empty/placeholder subdirs).
• nginx_proxy/proxy_servers.conf read for the first 120 lines (all upstreams + the oss/esign server blocks); the css/portal/cv/library server blocks past line 120 were not read in full.
• avast/ image internals (Dockerfile RUN steps) not read; only TODO (Hungarian, lists unfinished systemd→supervisor + license-mount work) was read.

Sources

Read on the devel working tree of /Users/levander/coding/facekom/vuer_docker:

• README.md, .env, .gitignore, .buildignore, build-cv.md, esign.md
• bin/vuer.sh
• Compose: dev.yml, services.yml, vuer-oss.yml, vuer-css.yml, vuer-cv.yml, vuer-cv-dev.yml, vuer-cv-gpu.yml, esign-oss.yml, esign-css.yml, portal-css.yml, facekom-library.yml, testenv.yml, otel.yml, toxiproxy.yaml, clamav.yml, minio.yml, mssql.yml, mysql.yml, oracledb19.yml, sftp.yaml, janus-dev.yml, macos-vuer-dev.yml
• Dockerfiles: vuer_oss/Dockerfile, vuer_css/Dockerfile, rabbitmq/Dockerfile
• Scripts: toxiproxy/bin/{fetch-config,populate-proxies,apply-toxic,reset}, install/{install-os.sh,install-supervisor.sh,install-nodejs.sh,install-nodejs-22.sh,install-nodejs-24.sh,install-nodejs-20.sh,install-rabbitmq.sh,install-redis.sh}, install/supervisor/supervisord.conf, install/rabbitmq/{health-check.sh,defs.json}, rabbitmq/{rabbitmq.sh,rabbitmq.config}, oracledb19/{oracledb19-init.sh,oracledb19-init.sql}, mssql/mssql-init.sh, janus/{build_janus.sh,dev_build.sh}
• Config: nginx_proxy/proxy_servers.conf (head), otel/collector/config.yaml, sftp/users.conf, sftp/README.md, toxiproxy/README.md, avast/TODO
• Dir listings: repo root, bin/, toxiproxy/, otel/, install/, install2/, all top-level service dirs
• Git (read-only): git log master -1, git diff --stat master devel, git ls-tree master/devel, git cat-file -e master:bin/vuer.sh, git branch -a, git rev-parse --abbrev-ref HEAD