docker-compose.apple.yaml

# CAAL Voice Framework - Apple Silicon (M1/M2/M3/M4)
# ==================================================
#
# This compose file is for Apple Silicon Macs. It excludes GPU containers
# (Speaches, Kokoro) since they require NVIDIA CUDA.
#
# Prerequisites:
#   1. Install mlx-audio for STT/TTS:
#      pip install mlx-audio
#
#   2. Start mlx-audio server (runs on port 8000):
#      python -m mlx_audio.server --port 8000
#
#   3. Install Ollama for LLM (native MPS support):
#      brew install ollama
#      ollama pull ministral-3:8b
#
# Usage:
#   ./start-apple.sh
#   Access: https://<CAAL_HOST_IP>:3443
#
# HTTPS is enabled by default with auto-generated self-signed certificates.
# See .env.example for configuration options.

services:
  # ===========================================================================
  # LiveKit Server - WebRTC Infrastructure
  # ===========================================================================
  livekit:
    image: livekit/livekit-server:latest
    container_name: caal-livekit
    platform: linux/arm64
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        if [ -n "$${HTTPS_DOMAIN}" ]; then
          echo "HTTPS mode: enabling TURN/TLS for $${HTTPS_DOMAIN}"
          apk add --no-cache gettext > /dev/null 2>&1
          envsubst < /etc/livekit.yaml.template > /etc/livekit.yaml
        else
          echo "LAN mode: using basic config"
          cp /etc/livekit-lan.yaml /etc/livekit.yaml
        fi
        exec /livekit-server --config /etc/livekit.yaml --node-ip $${CAAL_HOST_IP}
    ports:
      - "7880:7880"       # WebSocket
      - "7881:7881"       # TCP for WebRTC
      - "7881:7881/udp"   # UDP for WebRTC
      - "5349:5349"       # TURN/TLS (only used in HTTPS mode)
      - "30000-30100:30000-30100/udp"  # TURN relay ports
      - "51000-51100:51000-51100/udp"  # WebRTC media ports
    volumes:
      - ./livekit.yaml:/etc/livekit-lan.yaml:ro
      - ./livekit-tailscale.yaml.template:/etc/livekit.yaml.template:ro
      - ./certs:/etc/livekit/certs:ro
    environment:
      - HTTPS_DOMAIN=${HTTPS_DOMAIN:-}
      - CAAL_HOST_IP=${CAAL_HOST_IP}
    networks:
      - caal-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:7880"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

  # ===========================================================================
  # Speaches - Piper TTS (CPU, ARM64)
  # ===========================================================================
  # Provides high-quality French TTS via Piper voices
  speaches:
    image: ghcr.io/speaches-ai/speaches:0.9.0-rc.3-cpu
    container_name: caal-speaches
    platform: linux/arm64
    volumes:
      - speaches-cache:/home/ubuntu/.cache/huggingface
    networks:
      - caal-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s

  # ===========================================================================
  # CAAL Agent - Voice Processing Pipeline
  # ===========================================================================
  # STT: mlx-audio on host (Metal-accelerated Whisper)
  # TTS: Kokoro via mlx-audio OR Piper via Speaches
  agent:
    build:
      context: .
      dockerfile: Dockerfile
      platforms:
        - linux/arm64
    container_name: caal-agent
    platform: linux/arm64
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "8889:8889"  # Webhook server
    env_file:
      - ./.env
    environment:
      - LIVEKIT_URL=ws://livekit:7880
      - CAAL_MEMORY_DIR=/app/data
      # STT + Piper TTS via Speaches container (CPU faster-whisper)
      - SPEACHES_URL=http://speaches:8000
      - PIPER_URL=http://speaches:8000
      - WHISPER_MODEL=Systran/faster-whisper-medium
      # TTS Kokoro via mlx-audio on host (optional, for English)
      - KOKORO_URL=${MLX_AUDIO_URL:-http://host.docker.internal:8001}
      - TTS_MODEL=${TTS_MODEL:-prince-canuma/Kokoro-82M}
      - TTS_VOICE=${TTS_VOICE:-af_heart}
    volumes:
      - caal-memory:/app/data
      - caal-config:/app/config  # Runtime config (settings.json, mcp_servers.json)
      - ./prompt:/app/prompt
    networks:
      - caal-network
    depends_on:
      livekit:
        condition: service_healthy
      speaches:
        condition: service_healthy
    restart: unless-stopped

  # ===========================================================================
  # Frontend - Next.js Web Interface
  # ===========================================================================
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      platforms:
        - linux/arm64
      args:
        - NEXT_PUBLIC_LIVEKIT_URL=wss://${HTTPS_DOMAIN:-${CAAL_HOST_IP}}:7443
        - NEXT_PUBLIC_PORCUPINE_ACCESS_KEY=${PORCUPINE_ACCESS_KEY:-}
    container_name: caal-frontend
    platform: linux/arm64
    ports:
      - "3000:3000"
    environment:
      - LIVEKIT_URL=ws://livekit:7880
      - LIVEKIT_API_KEY=${LIVEKIT_API_KEY:-devkey}
      - LIVEKIT_API_SECRET=${LIVEKIT_API_SECRET:-secret}
      - NEXT_PUBLIC_LIVEKIT_URL=wss://${HTTPS_DOMAIN:-${CAAL_HOST_IP}}:7443
      - WEBHOOK_URL=http://agent:8889
    networks:
      - caal-network
    depends_on:
      livekit:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s

  # ===========================================================================
  # nginx - HTTPS Reverse Proxy (auto-generates self-signed certs if missing)
  # ===========================================================================
  nginx:
    image: nginx:alpine
    container_name: caal-nginx
    platform: linux/arm64
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        # Generate self-signed cert if none exists
        if [ ! -f /etc/nginx/certs/server.crt ]; then
          echo "No certificate found, generating self-signed cert..."
          mkdir -p /etc/nginx/certs
          apk add --no-cache openssl > /dev/null 2>&1
          openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
            -keyout /etc/nginx/certs/server.key \
            -out /etc/nginx/certs/server.crt \
            -subj "/CN=$${CAAL_HOST_IP:-localhost}" \
            -addext "subjectAltName=DNS:localhost,IP:$${CAAL_HOST_IP:-127.0.0.1},IP:127.0.0.1" 2>/dev/null
          echo "Self-signed certificate generated for $${CAAL_HOST_IP:-localhost}"
        else
          echo "Using existing certificate"
        fi
        exec nginx -g "daemon off;"
    ports:
      - "3443:3443"
      - "7443:7443"
    environment:
      - CAAL_HOST_IP=${CAAL_HOST_IP}
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certs:/etc/nginx/certs
    networks:
      - caal-network
    depends_on:
      - frontend
      - livekit
    restart: unless-stopped

# =============================================================================
# Networks
# =============================================================================
networks:
  caal-network:
    name: caal-network
    driver: bridge

# =============================================================================
# Volumes
# =============================================================================
volumes:
  caal-memory:
    name: caal-memory
  caal-config:
    name: caal-config
  speaches-cache:
    name: caal-speaches-cache