docker-compose.yml

name: podflix

networks:
  t3_proxy:
    external: true
  podflix-network:
    name: podflix-network
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.10.0/24

x-deploy: &gpu-deploy
  deploy:
    resources:
      reservations:
        devices:
          - driver: nvidia
            count: all
            capabilities: [gpu]

services:
  ########## TRAEFIK ##########
  traefik:
    image: traefik:v3.2.3
    container_name: traefik
    restart: ${RESTART_POLICY:-always}
    security_opt:
      - no-new-privileges:true
    command:
      - --api.dashboard=true
      - --api.insecure=true
      - --providers.docker=true
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entryPoints.traefik.address=:8080
      # Certificates related
      - --providers.docker.exposedbydefault=false
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http.tls.certificates.certFile=/etc/certs/local-dev.crt
      - --entrypoints.websecure.http.tls.certificates.keyFile=/etc/certs/local-dev.key
    networks:
      - podflix-network
    ports:
      - "8008:80"
      - "4443:443"
      - "5080:8080" # Traefik dashboard
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./deployment/certs:/etc/certs:ro"
    healthcheck:
      test: "traefik healthcheck --ping"
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      # HTTP-to-HTTPS Redirect
      - "traefik.http.routers.http-catchall.entrypoints=http"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # HTTP Routers
      - "traefik.http.routers.traefik-rtr.entrypoints=websecure"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAIN_NAME`)"
      - "traefik.http.routers.traefik-rtr.tls=true" # Some people had 404s without this
      - "traefik.http.routers.traefik-rtr.tls.domains[0].main=$DOMAIN_NAME"
      - "traefik.http.routers.traefik-rtr.tls.domains[0].sans=*.$DOMAIN_NAME"
      ## Services - API
      - "traefik.http.routers.traefik-rtr.service=api@internal"
      ## Healthcheck/ping
      # - "traefik.http.routers.ping.rule=Host(`traefik.$DOMAIN_NAME`) && Path(`/ping`)"
      #- "traefik.http.routers.ping.tls=true"
      #- "traefik.http.routers.ping.service=ping@internal"

  ########## PODFLIX ##########
  # NOTE: Reverse proxy doesn't work for databases. Only TCP connection works.
  podflix-db:
    image: postgres:16.4
    container_name: podflix-db
    restart: ${RESTART_POLICY:-unless-stopped}
    networks:
      - t3_proxy
      - podflix-network
    ports:
      - $POSTGRES_PORT:5432
    environment:
      - POSTGRES_USER=$POSTGRES_USER
      - POSTGRES_PASSWORD=$POSTGRES_PASSWORD
      - POSTGRES_DB=$POSTGRES_DB
      - PGDATA=/pgdata
    volumes:
      - ./deployment/volumes/podflix-db:/pgdata
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 3

  podflix-dev:
    image: podflix-dev:latest
    container_name: podflix-dev
    build:
      context: .
      dockerfile: docker/Dockerfile
      target: development
    # command: ["uv", "run", "chainlit", "run", "src/podflix/gui/audio.py", "--host", "0.0.0.0", "--port", "5000", "--headless"]
    networks:
      - t3_proxy
      - podflix-network
    # command: ["tail", "-f", "/dev/null"] # NOTE: For testing the container
    restart: "no"
    depends_on:
      podflix-db:
        condition: service_healthy
      # langfuse-server:
      #   condition: service_healthy
      # localstack:
      #   condition: service_healthy
    develop:
      watch:
        # Sync the working directory with the `/app` directory in the container
        - action: sync
          path: .
          target: /app
          # Exclude the project virtual environment
          ignore:
            - .venv/

        # Rebuild the image on changes to the `pyproject.toml`
        - action: rebuild
          path: ./pyproject.toml
    env_file:
      - .env
    environment:
      - LIBRARY_BASE_PATH=/app
      - CHAINLIT_APP_ROOT=/app/configs/chainlit
      - DATABASE_URL=postgresql://postgres:postgres@podflix-db:5432/postgres
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.podflix-rtr.entrypoints=websecure"
      - "traefik.http.routers.podflix-rtr.rule=Host(`podflix.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.podflix-rtr.service=podflix-svc"
      - "traefik.http.services.podflix-svc.loadbalancer.server.port=5000"

  podflix-prod:
    image: podflix-prod:latest
    container_name: podflix-prod
    build:
      context: .
      dockerfile: docker/Dockerfile
      target: production
    networks:
      - t3_proxy
      - podflix-network
    command: ["tail", "-f", "/dev/null"] # NOTE: For testing the container
    restart: "no"
    depends_on:
      podflix-db:
        condition: service_healthy
    env_file:
      - .env
    environment:
      - LIBRARY_BASE_PATH=/app
      - CHAINLIT_APP_ROOT=/app/configs/chainlit
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.podflix-rtr.entrypoints=websecure"
      - "traefik.http.routers.podflix-rtr.rule=Host(`podflix.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.podflix-rtr.service=podflix-svc"
      - "traefik.http.services.podflix-svc.loadbalancer.server.port=5000"

  ############ LANGFUSE #############
  langfuse-db:
    image: postgres:16.4
    container_name: langfuse-db
    restart: ${RESTART_POLICY:-unless-stopped}
    networks:
      - t3_proxy
      - podflix-network
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
      - POSTGRES_DB=postgres
      - PGDATA=/pgdata
    volumes:
      - ./deployment/volumes/langfuse-db:/pgdata
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 3

  langfuse-server:
    image: ghcr.io/langfuse/langfuse:${LANGFUSE_VERSION:-2.93.5}
    container_name: langfuse-server
    restart: ${RESTART_POLICY:-unless-stopped}
    depends_on:
      # podflix-traefik:
      #   condition: service_healthy
      langfuse-db:
        condition: service_healthy
    networks:
      - t3_proxy
      - podflix-network
    environment:
      - DATABASE_URL=postgresql://postgres:postgres@langfuse-db:5432/postgres
      - NEXTAUTH_SECRET=mysecret
      - SALT=mysalt
      - HOSTNAME=0.0.0.0
      - PORT=3000
      - NEXTAUTH_URL=http://localhost:3000
      - TELEMETRY_ENABLED=false
      - NEXT_PUBLIC_SIGN_UP_DISABLED=false
      - LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=false
      # - LANGFUSE_DEFAULT_PROJECT_ID=1
      # - LANGFUSE_DEFAULT_PROJECT_ROLE=ADMIN
      # - AUTH_DISABLE_SIGNUP=true
      # - AUTH_DISABLE_USERNAME_PASSWORD=true
    # healthcheck:
    #   test: "curl -f http://langfuse-server:3000/api/public/health"
    #   interval: 10s
    #   timeout: 5s
    #   retries: 3
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.langfuse-rtr.entrypoints=websecure"
      - "traefik.http.routers.langfuse-rtr.rule=Host(`langfuse.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.langfuse-rtr.service=langfuse-svc"
      - "traefik.http.services.langfuse-svc.loadbalancer.server.port=3000"

  ############ WHISPER API #############
  speaches:
    container_name: speaches
    image: ghcr.io/speaches-ai/speaches:latest-cuda
    restart: "no"
    <<: *gpu-deploy
    networks:
      - t3_proxy
      - podflix-network
    environment:
      - HOST=0.0.0.0
      - PORT=8000
      - ENABLE_UI=True
      - DEFAULT_LANGUAGE=en
      - DEFAULT_RESPONSE_FORMAT=json
      # - DEFAULT_RESPONSE_FORMAT=srt # vtt
      - MAX_MODELS=1
      - TTL=-1 # Never unload the model
      - WHISPER__MODEL=$WHISPER_MODEL_NAME
      - WHISPER__COMPUTE_TYPE=default
      # - WHISPER__COMPUTE_TYPE=bfloat16
    volumes:
      - ./deployment/volumes/huggingface:/root/.cache/huggingface
    healthcheck: # NOTE: Workaround for healthcheck since both curl and wget are not available
      test: ["CMD", "curl", "--fail", "http://0.0.0.0:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.speaches-rtr.entrypoints=websecure"
      - "traefik.http.routers.speaches-rtr.rule=Host(`speaches.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.speaches-rtr.service=speaches-svc"
      - "traefik.http.services.speaches-svc.loadbalancer.server.port=8000"

  # whisper-cpp:
  #   container_name: whisper-cpp
  #   image: ghcr.io/ggerganov/whisper.cpp:main-cuda
  #   restart: "no"
  #   # --diarize, --tinydiarize
  #   command: ["./server", "--model", $WHISPER_MODEL_NAME, "--gpu", "auto", "--request-path", "/audio/transcriptions", "--inference-path", "''", "--host", "0.0.0.0", "--port", "80"]
  #   # command: ["tail", "-f", "/dev/null"]
  #   # command: ["./server", "--host", "0.0.0.0", "--port", "80"]
  #   networks:
  #     - podflix-network
  #   volumes:
  #     - ./deployment/models/whisperfile:/models
  #     - ./notebooks/resources:/resources

  ########## OPENAI LIKE API ##########

  # https://github.com/ggerganov/llama.cpp/blob/master/examples/server/README.md
  llama-cpp:
    image: ghcr.io/ggerganov/llama.cpp:server-cuda
    container_name: llama-cpp
    restart: ${RESTART_POLICY:-no}
    <<: *gpu-deploy
    networks:
      - t3_proxy
      - podflix-network
    environment:
      LLAMA_ARG_HOST: 0.0.0.0
      LLAMA_ARG_PORT: 8000
      LLAMA_ARG_MODEL: /models/$MODEL_NAME
      LLAMA_ARG_ALIAS: $MODEL_NAME
      LLAMA_ARG_CTX_SIZE: 4096
      LLAMA_ARG_N_GPU_LAYERS: 10
      LLAMA_ARG_FLASH_ATTN: 1
      LLAMA_ARG_N_PREDICT: -1 # infinity
      LLAMA_ARG_NO_WEBUI: 0
      # LLAMA_ARG_ENDPOINT_METRICS: 1
      # HF_TOKEN: $HF_TOKEN
    volumes:
      - ./deployment/models/GGUF:/models:ro
    healthcheck:
      test: "curl -f http://llama-cpp:8000/health"
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.llama-cpp-rtr.entrypoints=websecure"
      - "traefik.http.routers.llama-cpp-rtr.rule=Host(`llamacpp.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.llama-cpp-rtr.service=llama-cpp-svc"
      - "traefik.http.services.llama-cpp-svc.loadbalancer.server.port=8000"

  # vllm:
  #   image: vllm/vllm-openai:${VLLM_VERSION:-v0.6.6}
  #   container_name: vllm
  #   restart: ${RESTART_POLICY:-unless-stopped}
  #   <<: *gpu-deploy
  #   networks:
  #     - podflix-network
  #   ipc: host
  #   command:
  #     - "--model"
  #     - "/models/$MODEL_NAME"
  #     - "--served-model-name"
  #     - $MODEL_NAME
  #     - "--dtype"
  #     - "bfloat16"
  #     - "--gpu-memory-utilization"
  #     - "0.3"
  #     # - "--tensor-parallel-size"
  #     # - "4"
  #     - "--enable-prefix-caching"
  #     - "--max-model-len"
  #     - ${VLLM_MAX_MODEL_LEN:-6000}
  #     - "--host"
  #     - "0.0.0.0"
  #     - "--port"
  #     - "8000"
  #   environment:
  #     - HF_HOME=/root/.cache/huggingface
  #   volumes:
  #     - ./deployment/volumes/huggingface:/root/.cache/huggingface
  #     - ./deployment/models:/models:ro
  #   healthcheck:
  #     test: "curl -f http://vllm:8000/health"
  #     interval: 10s
  #     timeout: 5s
  #     retries: 3

  ############## EMBEDDING SERVER #####################
  hf_embedding:
    image: ghcr.io/huggingface/text-embeddings-inference:1.6
    container_name: hf_embedding
    restart: ${RESTART_POLICY:-unless-stopped}
    command: ["--model-id", $EMBEDDING_MODEL_NAME, --hostname, "0.0.0.0", "--port", "80"]
    <<: *gpu-deploy
    # depends_on:
    #   - podflix-traefik
    networks:
      - t3_proxy
      - podflix-network
    environment:
      - HF_HOME=/root/.cache/huggingface
      - HF_HUB_OFFLINE=1
      - AUTO_TRUNCATE=true
    volumes:
      # - ./deployment/volumes/huggingface:/root/.cache/huggingface
      - ./deployment/volumes/hf_tei:/data
    healthcheck:
      test: "curl -f http://hf_embedding:80/health"
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.hf_embedding-rtr.entrypoints=websecure"
      - "traefik.http.routers.hf_embedding-rtr.rule=Host(`hf_embedding.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.hf_embedding-rtr.service=hf_embedding-svc"
      - "traefik.http.services.hf_embedding-svc.loadbalancer.server.port=80"

  hf_rerank:
    image: ghcr.io/huggingface/text-embeddings-inference:1.6
    container_name: hf_rerank
    restart: ${RESTART_POLICY:-unless-stopped}
    command: ["--model-id", $RERANK_MODEL_NAME, --hostname, "0.0.0.0", "--port", "80"]
    <<: *gpu-deploy
    # depends_on:
    #   - podflix-traefik
    networks:
      - t3_proxy
      - podflix-network
    environment:
      - HF_HOME=/root/.cache/huggingface
      - HF_HUB_OFFLINE=1
      - AUTO_TRUNCATE=true
    volumes:
      # - ./deployment/volumes/huggingface:/root/.cache/huggingface
      - ./deployment/volumes/hf_tei:/data
    healthcheck:
      test: "curl -f http://hf_rerank:80/health"
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.hf_rerank-rtr.entrypoints=websecure"
      - "traefik.http.routers.hf_rerank-rtr.rule=Host(`hf_rerank.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.hf_rerank-rtr.service=hf_rerank-svc"
      - "traefik.http.services.hf_rerank-svc.loadbalancer.server.port=80"

  ############## BLOB STORAGE CLIENT #####################
  # NOTE: Persistency is a pro feature, hence official image is not used
  # localstack-s3:
  #   image: localstack/localstack:s3-latest
  #   container_name: localstack-s3
  #   restart: ${RESTART_POLICY:-unless-stopped}
  #   networks:
  #     - t3_proxy
  #     - podflix-network
  #   environment:
  #     - DEBUG=0
  #     - EXTRA_CORS_ALLOWED_ORIGINS=https://podflix.$DOMAIN_NAME,http://localhost:5000
  #     - CREATED_BUCKET_NAME=$BUCKET_NAME
  #     - APP_AWS_REGION=$APP_AWS_REGION
  #   volumes:
  #     - /var/run/docker.sock:/var/run/docker.sock
  #     - ./scripts/create_s3_bucket.sh:/etc/localstack/init/ready.d/script.sh
  #     - ./deployment/volumes/localstack:/var/lib/localstack
  #   labels:
  #     - "traefik.enable=true"
  #     ## HTTP Routers
  #     - "traefik.http.routers.localstack-s3-rtr.entrypoints=websecure"
  #     - "traefik.http.routers.localstack-s3-rtr.rule=Host(`s3.$DOMAIN_NAME`)"
  #     ## HTTP Services
  #     - "traefik.http.routers.localstack-s3-rtr.service=localstack-s3-svc"
  #     - "traefik.http.services.localstack-s3-svc.loadbalancer.server.port=4566"

  localstack:
    image: gresau/localstack-persist:3
    container_name: localstack
    restart: ${RESTART_POLICY:-unless-stopped}
    environment:
      DEBUG: 0
      SERVICES: s3
      CREATED_BUCKET_NAME: $BUCKET_NAME
      APP_AWS_REGION: $APP_AWS_REGION
    networks:
      - t3_proxy
      - podflix-network
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./scripts/create_s3_bucket.sh:/etc/localstack/init/ready.d/script.sh
      - ./deployment/volumes/localstack:/persisted-data
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.localstack-rtr.entrypoints=websecure"
      - "traefik.http.routers.localstack-rtr.rule=Host(`s3-podflix.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.localstack-rtr.service=localstack-svc"
      - "traefik.http.services.localstack-svc.loadbalancer.server.port=4566"