docker-compose.cpu.yaml

# CAAL Voice Framework - CPU Only (No GPU Required)
# ==================================================
#
# This compose file runs CAAL without GPU containers.
# Uses Speaches CPU image for STT and Piper for TTS.
#
# Prerequisites:
#   - Groq API key (free tier available): https://console.groq.com/
#
# Usage:
#   1. cp .env.example .env && nano .env  # Set CAAL_HOST_IP
#   2. docker compose -f docker-compose.cpu.yaml up -d
#   3. Access: https://<CAAL_HOST_IP>:3443
#
# HTTPS is enabled by default with auto-generated self-signed certificates.
# See .env.example for configuration options.

services:
  # ===========================================================================
  # LiveKit Server - WebRTC Infrastructure
  # ===========================================================================
  livekit:
    image: livekit/livekit-server:latest
    container_name: caal-livekit
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        if [ -n "$${HTTPS_DOMAIN}" ]; then
          echo "HTTPS mode: enabling TURN/TLS for $${HTTPS_DOMAIN}"
          apk add --no-cache gettext > /dev/null 2>&1
          envsubst < /etc/livekit.yaml.template > /etc/livekit.yaml
        else
          echo "LAN mode: using basic config"
          cp /etc/livekit-lan.yaml /etc/livekit.yaml
        fi
        exec /livekit-server --config /etc/livekit.yaml --node-ip $${CAAL_HOST_IP}
    ports:
      - "7880:7880"       # WebSocket
      - "7881:7881"       # TCP for WebRTC
      - "7881:7881/udp"   # UDP for WebRTC
      - "5349:5349"       # TURN/TLS (only used in HTTPS mode)
      - "30000-30100:30000-30100/udp"  # TURN relay ports
      - "51000-51100:51000-51100/udp"  # WebRTC media ports (changed from 50000 to avoid Chrome conflicts)
    volumes:
      - ./livekit.yaml:/etc/livekit-lan.yaml:ro
      - ./livekit-tailscale.yaml.template:/etc/livekit.yaml.template:ro
      - ./certs:/etc/livekit/certs:ro
    environment:
      - HTTPS_DOMAIN=${HTTPS_DOMAIN:-}
      - CAAL_HOST_IP=${CAAL_HOST_IP}
    networks:
      - caal-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:7880"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

  # ===========================================================================
  # CAAL Agent - Voice Processing Pipeline
  # ===========================================================================
  agent:
    build:
      context: .
      dockerfile: Dockerfile
      labels:
        org.opencontainers.image.source: https://github.com/CoreWorxLab/caal
        org.opencontainers.image.description: CAAL Voice Assistant Agent
    container_name: caal-agent
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "8889:8889"  # Webhook server for announcements and tool reload
    env_file:
      - ./.env
    environment:
      - LIVEKIT_URL=ws://livekit:7880
      - SPEACHES_URL=http://speaches:8000
      - CAAL_MEMORY_DIR=/app/data
    volumes:
      - caal-memory:/app/data
      - caal-config:/app/config  # Runtime config (settings.json, mcp_servers.json)
      - ./prompt:/app/prompt  # Prompt files (custom.md is gitignored)
    networks:
      - caal-network
    depends_on:
      livekit:
        condition: service_healthy
      speaches:
        condition: service_healthy
    restart: unless-stopped

  # ===========================================================================
  # Speaches - STT (Faster-Whisper) + Piper TTS (CPU)
  # ===========================================================================
  speaches:
    image: ghcr.io/speaches-ai/speaches:0.9.0-rc.3-cpu
    container_name: caal-speaches
    ports:
      - "${SPEACHES_PORT:-8000}:8000"
    volumes:
      - speaches-cache:/home/ubuntu/.cache/huggingface
    restart: unless-stopped
    networks:
      - caal-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s

  # ===========================================================================
  # Frontend - Next.js Web Interface
  # ===========================================================================
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      labels:
        org.opencontainers.image.source: https://github.com/CoreWorxLab/caal
        org.opencontainers.image.description: CAAL Voice Assistant Frontend
      args:
        - NEXT_PUBLIC_LIVEKIT_URL=wss://${HTTPS_DOMAIN:-${CAAL_HOST_IP}}:7443
        - NEXT_PUBLIC_PORCUPINE_ACCESS_KEY=${PORCUPINE_ACCESS_KEY:-}
    container_name: caal-frontend
    ports:
      - "3000:3000"
    environment:
      - LIVEKIT_URL=ws://livekit:7880
      - LIVEKIT_API_KEY=${LIVEKIT_API_KEY:-devkey}
      - LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET:-secret}
      - NEXT_PUBLIC_LIVEKIT_URL=wss://${HTTPS_DOMAIN:-${CAAL_HOST_IP}}:7443
      - WEBHOOK_URL=http://agent:8889
    networks:
      - caal-network
    depends_on:
      livekit:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s

  # ===========================================================================
  # nginx - HTTPS Reverse Proxy (auto-generates self-signed certs if missing)
  # ===========================================================================
  nginx:
    image: nginx:alpine
    container_name: caal-nginx
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        # Generate self-signed cert if none exists
        if [ ! -f /etc/nginx/certs/server.crt ]; then
          echo "No certificate found, generating self-signed cert..."
          mkdir -p /etc/nginx/certs
          apk add --no-cache openssl > /dev/null 2>&1
          openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
            -keyout /etc/nginx/certs/server.key \
            -out /etc/nginx/certs/server.crt \
            -subj "/CN=$${CAAL_HOST_IP:-localhost}" \
            -addext "subjectAltName=DNS:localhost,IP:$${CAAL_HOST_IP:-127.0.0.1},IP:127.0.0.1" 2>/dev/null
          echo "Self-signed certificate generated for $${CAAL_HOST_IP:-localhost}"
        else
          echo "Using existing certificate"
        fi
        exec nginx -g "daemon off;"
    ports:
      - "3443:3443"
      - "7443:7443"
    environment:
      - CAAL_HOST_IP=${CAAL_HOST_IP}
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certs:/etc/nginx/certs
    networks:
      - caal-network
    depends_on:
      - frontend
      - livekit
    restart: unless-stopped

# =============================================================================
# Networks
# =============================================================================
networks:
  caal-network:
    name: caal-network
    driver: bridge

# =============================================================================
# Volumes
# =============================================================================
volumes:
  caal-memory:
    name: caal-memory
  caal-config:
    name: caal-config
  speaches-cache:
    name: caal-speaches-cache