docker-compose.prod.yml

services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: ${DB_NAME:-clio_db}
      POSTGRES_USER: ${DB_USER:-clio}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-clio}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    environment:
      - DEBUG=False
      - SECRET_KEY=${SECRET_KEY}
      - DB_NAME=${DB_NAME:-clio_db}
      - DB_USER=${DB_USER:-clio}
      - DB_PASSWORD=${DB_PASSWORD}
      - DB_HOST=db
      - DB_PORT=5432
      - OPENAI_API_KEY=${OPENAI_API_KEY:-not-needed}
      - OPENAI_BASE_URL=${OPENAI_BASE_URL:-http://whisper-server:8000/v1}
      - WHISPER_MODEL=${WHISPER_MODEL:-Systran/faster-whisper-small}
      - DEEPGRAM_API_KEY=${DEEPGRAM_API_KEY:-}
      - DEEPGRAM_MODEL=${DEEPGRAM_MODEL:-nova-3}
      - ALLOWED_HOSTS=${ALLOWED_HOSTS:-clio.chadacus.dev,localhost}
      - REDIS_URL=redis://redis:6379/0
      - CSRF_TRUSTED_ORIGINS=https://clio.chadacus.dev
    volumes:
      - media_files:/app/media
      - static_files:/app/staticfiles
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped
    command: >
      sh -c "
        python manage.py migrate &&
        python manage.py collectstatic --noinput &&
        gunicorn --bind 0.0.0.0:8000 --workers 3 --timeout 120 config.wsgi:application
      "
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health/', timeout=10)"]
      interval: 30s
      timeout: 10s
      start_period: 15s
      retries: 3

  celery:
    build:
      context: ./backend
      dockerfile: Dockerfile
    command: celery -A config worker -l info --concurrency=2
    environment:
      - DEBUG=False
      - SECRET_KEY=${SECRET_KEY}
      - DB_NAME=${DB_NAME:-clio_db}
      - DB_USER=${DB_USER:-clio}
      - DB_PASSWORD=${DB_PASSWORD}
      - DB_HOST=db
      - DB_PORT=5432
      - OPENAI_API_KEY=${OPENAI_API_KEY:-not-needed}
      - OPENAI_BASE_URL=${OPENAI_BASE_URL:-http://whisper-server:8000/v1}
      - WHISPER_MODEL=${WHISPER_MODEL:-Systran/faster-whisper-small}
      - DEEPGRAM_API_KEY=${DEEPGRAM_API_KEY:-}
      - DEEPGRAM_MODEL=${DEEPGRAM_MODEL:-nova-3}
      - REDIS_URL=redis://redis:6379/0
    volumes:
      - media_files:/app/media
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      whisper-server:
        condition: service_started
    restart: unless-stopped
    healthcheck:
      # Celery workers serve no HTTP — ping the worker over the broker instead.
      test: ["CMD", "celery", "-A", "config", "inspect", "ping"]
      interval: 30s
      timeout: 10s
      start_period: 30s
      retries: 3

  # Self-hosted Whisper (OpenAI-compatible) inference. Previously a hand-run
  # container reachable only via the docker bridge gateway (172.17.0.1:8300),
  # which was undocumented and broke transcription when its port binding
  # changed. It now lives in compose: celery reaches it by service name at
  # http://whisper-server:8000/v1 (see OPENAI_BASE_URL default above).
  whisper-server:
    image: fedirz/faster-whisper-server:latest-cpu
    environment:
      - WHISPER__MODEL=${WHISPER_MODEL:-Systran/faster-whisper-small}
      - WHISPER__INFERENCE_DEVICE=cpu
      - WHISPER__DEVICE=cpu
      - WHISPER__COMPUTE_TYPE=int8
      - UVICORN_HOST=0.0.0.0
      - UVICORN_PORT=8000
    volumes:
      # Persist the downloaded model across recreates (no re-download).
      - whisper_cache:/root/.cache/huggingface
    restart: unless-stopped
    healthcheck:
      # The fedirz image ships python3 (not `python`) and no curl/wget.
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=10)"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile.prod
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.clio.rule=Host(`clio.chadacus.dev`)"
      - "traefik.http.routers.clio.entrypoints=https"
      - "traefik.http.routers.clio.tls=true"
      - "traefik.http.routers.clio.tls.certresolver=cloudflare"
      - "traefik.http.services.clio.loadbalancer.server.port=3000"
      # Frontend is on both `default` and `web`; tell Traefik which network to
      # reach the container on, otherwise routing to the container is ambiguous.
      - "traefik.docker.network=web"
    networks:
      - default
      - web
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/"]
      interval: 30s
      timeout: 10s
      start_period: 10s
      retries: 3

volumes:
  postgres_data:
  media_files:
  static_files:
  whisper_cache:

networks:
  web:
    external: true