docker-compose.yml

name: podflix

networks:
  t2_proxy:
    external: true
  podflix-network:
    name: podflix-network
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.10.0/24

x-deploy: &gpu-deploy
  deploy:
    resources:
      reservations:
        devices:
          - driver: nvidia
            count: all
            capabilities: [gpu]

services:
  ########## TRAEFIK ##########
  traefik:
    image: traefik:v3.2.3
    container_name: traefik
    restart: ${RESTART_POLICY:-always}
    security_opt:
      - no-new-privileges:true
    command:
      - --api.dashboard=true
      - --api.insecure=true
      - --providers.docker=true
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entryPoints.traefik.address=:8080
      # Certificates related
      - --providers.docker.exposedbydefault=false
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http.tls.certificates.certFile=/etc/certs/local-dev.crt
      - --entrypoints.websecure.http.tls.certificates.keyFile=/etc/certs/local-dev.key
    networks:
      - podflix-network
    ports:
      - "8008:80"
      - "4443:443"
      - "5080:8080" # Traefik dashboard
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./deployment/certs:/etc/certs:ro"
    healthcheck:
      test: "traefik healthcheck --ping"
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      # HTTP-to-HTTPS Redirect
      - "traefik.http.routers.http-catchall.entrypoints=http"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # HTTP Routers
      - "traefik.http.routers.traefik-rtr.entrypoints=https"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAIN_NAME`)"
      - "traefik.http.routers.traefik-rtr.tls=true" # Some people had 404s without this
      - "traefik.http.routers.traefik-rtr.tls.domains[0].main=$DOMAIN_NAME"
      - "traefik.http.routers.traefik-rtr.tls.domains[0].sans=*.$DOMAIN_NAME"
      ## Services - API
      - "traefik.http.routers.traefik-rtr.service=api@internal"
      ## Healthcheck/ping
      # - "traefik.http.routers.ping.rule=Host(`traefik.$DOMAIN_NAME`) && Path(`/ping`)"
      #- "traefik.http.routers.ping.tls=true"
      #- "traefik.http.routers.ping.service=ping@internal"

  ########## PODFLIX ##########
  # NOTE: Reverse proxy doesn't work for databases. Only TCP connection works.
  podflix-db:
    image: postgres:16.4
    container_name: podflix-db
    restart: ${RESTART_POLICY:-unless-stopped}
    networks:
      - t2_proxy
      - podflix-network
    ports:
      - $POSTGRES_PORT:5432
    environment:
      - POSTGRES_USER=$POSTGRES_USER
      - POSTGRES_PASSWORD=$POSTGRES_PASSWORD
      - POSTGRES_DB=$POSTGRES_DB
      - PGDATA=/pgdata
    volumes:
      - ./deployment/volumes/podflix-db:/pgdata
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 3

  podflix-dev:
    image: podflix-dev:latest
    container_name: podflix-dev
    build:
      context: .
      dockerfile: docker/Dockerfile
      target: development
    networks:
      - t2_proxy
      - podflix-network
    # command: ["tail", "-f", "/dev/null"] # NOTE: For testing the container
    restart: "no"
    depends_on:
      podflix-db:
        condition: service_healthy
    develop:
      watch:
        # Sync the working directory with the `/app` directory in the container
        - action: sync
          path: .
          target: /app
          # Exclude the project virtual environment
          ignore:
            - .venv/

        # Rebuild the image on changes to the `pyproject.toml`
        - action: rebuild
          path: ./pyproject.toml
    env_file:
      - .env
    environment:
      - LIBRARY_BASE_PATH=/app
      - CHAINLIT_APP_ROOT=/app/configs/chainlit
      - POSTGRES_HOST=podflix-db
      - POSTGRES_PORT=5432
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.podflix-rtr.entrypoints=https"
      - "traefik.http.routers.podflix-rtr.rule=Host(`podflix.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.podflix-rtr.service=podflix-svc"
      - "traefik.http.services.podflix-svc.loadbalancer.server.port=5000"

  podflix-prod:
    image: podflix-prod:latest
    container_name: podflix-prod
    build:
      context: .
      dockerfile: docker/Dockerfile
      target: production
    networks:
      - t2_proxy
      - podflix-network
    command: ["tail", "-f", "/dev/null"] # NOTE: For testing the container
    restart: "no"
    depends_on:
      podflix-db:
        condition: service_healthy
    env_file:
      - .env
    environment:
      - LIBRARY_BASE_PATH=/app
      - CHAINLIT_APP_ROOT=/app/configs/chainlit
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.podflix-rtr.entrypoints=https"
      - "traefik.http.routers.podflix-rtr.rule=Host(`podflix.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.podflix-rtr.service=podflix-svc"
      - "traefik.http.services.podflix-svc.loadbalancer.server.port=5000"

  ############ LANGFUSE #############
  langfuse-db:
    image: postgres:16.4
    container_name: langfuse-db
    restart: ${RESTART_POLICY:-unless-stopped}
    networks:
      - t2_proxy
      - podflix-network
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
      - POSTGRES_DB=postgres
      - PGDATA=/pgdata
    volumes:
      - ./deployment/volumes/langfuse-db:/pgdata
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 3

  langfuse-server:
    image: ghcr.io/langfuse/langfuse:${LANGFUSE_VERSION:-2.93.5}
    container_name: langfuse-server
    restart: ${RESTART_POLICY:-unless-stopped}
    depends_on:
      # podflix-traefik:
      #   condition: service_healthy
      langfuse-db:
        condition: service_healthy
    networks:
      - t2_proxy
      - podflix-network
    environment:
      - DATABASE_URL=postgresql://postgres:postgres@langfuse-db:5432/postgres
      - NEXTAUTH_SECRET=mysecret
      - SALT=mysalt
      - HOSTNAME=0.0.0.0
      - PORT=3000
      - NEXTAUTH_URL=http://localhost:3000
      - TELEMETRY_ENABLED=false
      - NEXT_PUBLIC_SIGN_UP_DISABLED=false
      - LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=false
      # - LANGFUSE_DEFAULT_PROJECT_ID=1
      # - LANGFUSE_DEFAULT_PROJECT_ROLE=ADMIN
      # - AUTH_DISABLE_SIGNUP=true
      # - AUTH_DISABLE_USERNAME_PASSWORD=true
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.langfuse-rtr.entrypoints=https"
      - "traefik.http.routers.langfuse-rtr.rule=Host(`langfuse.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.langfuse-rtr.service=langfuse-svc"
      - "traefik.http.services.langfuse-svc.loadbalancer.server.port=3000"

  ############ WHISPER API #############
  faster-whisper-server:
    container_name: faster-whisper-server
    image: fedirz/faster-whisper-server:latest-cuda
    restart: "no"
    <<: *gpu-deploy
    networks:
      - t2_proxy
      - podflix-network
    environment:
      - HOST=0.0.0.0
      - PORT=8000
      - ENABLE_UI=True
      - DEFAULT_LANGUAGE=en
      - DEFAULT_RESPONSE_FORMAT=json
      # - DEFAULT_RESPONSE_FORMAT=srt # vtt
      - MAX_MODELS=1
      - WHISPER__MODEL=$WHISPER_MODEL_NAME
      - WHISPER__COMPUTE_TYPE=default
      # - WHISPER__COMPUTE_TYPE=bfloat16
    volumes:
      - ./deployment/volumes/huggingface:/root/.cache/huggingface
    healthcheck: # NOTE: Workaround for healthcheck since both curl and wget are not available
      test: ["CMD-SHELL", "python3 -c \"import http.client; conn = http.client.HTTPConnection('localhost:8000'); conn.request('GET', '/health'); response = conn.getresponse(); exit(0 if response.status == 200 else 1)\""]
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.whisper-rtr.entrypoints=https"
      - "traefik.http.routers.whisper-rtr.rule=Host(`whisper.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.whisper-rtr.service=whisper-svc"
      - "traefik.http.services.whisper-svc.loadbalancer.server.port=8000"

  # whisper-cpp:
  #   container_name: whisper-cpp
  #   image: ghcr.io/ggerganov/whisper.cpp:main-cuda
  #   restart: "no"
  #   # --diarize, --tinydiarize
  #   command: ["./server", "--model", $WHISPER_MODEL_NAME, "--gpu", "auto", "--request-path", "/audio/transcriptions", "--inference-path", "''", "--host", "0.0.0.0", "--port", "80"]
  #   # command: ["tail", "-f", "/dev/null"]
  #   # command: ["./server", "--host", "0.0.0.0", "--port", "80"]
  #   networks:
  #     - podflix-network
  #   volumes:
  #     - ./deployment/models/whisperfile:/models
  #     - ./notebooks/resources:/resources

  ########## OPENAI LIKE API ##########

  # https://github.com/ggerganov/llama.cpp/blob/master/examples/server/README.md
  llama-cpp:
    image: ghcr.io/ggerganov/llama.cpp:server-cuda
    container_name: llama-cpp
    restart: ${RESTART_POLICY:-no}
    <<: *gpu-deploy
    networks:
      - t2_proxy
      - podflix-network
    environment:
      LLAMA_ARG_HOST: 0.0.0.0
      LLAMA_ARG_PORT: 8000
      LLAMA_ARG_MODEL: /models/$MODEL_NAME
      LLAMA_ARG_ALIAS: $MODEL_NAME
      LLAMA_ARG_CTX_SIZE: 4096
      LLAMA_ARG_N_GPU_LAYERS: 10
      LLAMA_ARG_FLASH_ATTN: 1
      LLAMA_ARG_N_PREDICT: -1 # infinity
      LLAMA_ARG_NO_WEBUI: 0
      # LLAMA_ARG_ENDPOINT_METRICS: 1
      # HF_TOKEN: $HF_TOKEN
    volumes:
      - ./deployment/models/GGUF:/models:ro
    healthcheck:
      test: "curl -f http://llama-cpp:8000/health"
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.llama-cpp-rtr.entrypoints=https"
      - "traefik.http.routers.llama-cpp-rtr.rule=Host(`llamacpp.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.llama-cpp-rtr.service=llama-cpp-svc"
      - "traefik.http.services.llama-cpp-svc.loadbalancer.server.port=8000"

  # vllm:
  #   image: vllm/vllm-openai:${VLLM_VERSION:-v0.6.6}
  #   container_name: vllm
  #   restart: ${RESTART_POLICY:-unless-stopped}
  #   <<: *gpu-deploy
  #   networks:
  #     - podflix-network
  #   ipc: host
  #   command:
  #     - "--model"
  #     - "/models/$MODEL_NAME"
  #     - "--served-model-name"
  #     - $MODEL_NAME
  #     - "--dtype"
  #     - "bfloat16"
  #     - "--gpu-memory-utilization"
  #     - "0.3"
  #     # - "--tensor-parallel-size"
  #     # - "4"
  #     - "--enable-prefix-caching"
  #     - "--max-model-len"
  #     - ${VLLM_MAX_MODEL_LEN:-6000}
  #     - "--host"
  #     - "0.0.0.0"
  #     - "--port"
  #     - "8000"
  #   environment:
  #     - HF_HOME=/root/.cache/huggingface
  #   volumes:
  #     - ./deployment/volumes/huggingface:/root/.cache/huggingface
  #     - ./deployment/models:/models:ro
  #   healthcheck:
  #     test: "curl -f http://vllm:8000/health"
  #     interval: 10s
  #     timeout: 5s
  #     retries: 3

  ############## EMBEDDING SERVER #####################
  hf_embedding:
    image: ghcr.io/huggingface/text-embeddings-inference:1.6
    container_name: hf_embedding
    restart: ${RESTART_POLICY:-unless-stopped}
    command: ["--model-id", $EMBEDDING_MODEL_NAME, --hostname, "0.0.0.0", "--port", "80"]
    <<: *gpu-deploy
    # depends_on:
    #   - podflix-traefik
    networks:
      - t2_proxy
      - podflix-network
    environment:
      - HF_HOME=/root/.cache/huggingface
      - HF_HUB_OFFLINE=1
      - AUTO_TRUNCATE=true
    volumes:
      # - ./deployment/volumes/huggingface:/root/.cache/huggingface
      - ./deployment/volumes/hf_tei:/data
    healthcheck:
      test: "curl -f http://hf_embedding:80/health"
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.hf_embedding-rtr.entrypoints=https"
      - "traefik.http.routers.hf_embedding-rtr.rule=Host(`hf_embedding.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.hf_embedding-rtr.service=hf_embedding-svc"
      - "traefik.http.services.hf_embedding-svc.loadbalancer.server.port=80"

  hf_rerank:
    image: ghcr.io/huggingface/text-embeddings-inference:1.6
    container_name: hf_rerank
    restart: ${RESTART_POLICY:-unless-stopped}
    command: ["--model-id", $RERANK_MODEL_NAME, --hostname, "0.0.0.0", "--port", "80"]
    <<: *gpu-deploy
    # depends_on:
    #   - podflix-traefik
    networks:
      - t2_proxy
      - podflix-network
    environment:
      - HF_HOME=/root/.cache/huggingface
      - HF_HUB_OFFLINE=1
      - AUTO_TRUNCATE=true
    volumes:
      # - ./deployment/volumes/huggingface:/root/.cache/huggingface
      - ./deployment/volumes/hf_tei:/data
    healthcheck:
      test: "curl -f http://hf_rerank:80/health"
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.hf_rerank-rtr.entrypoints=https"
      - "traefik.http.routers.hf_rerank-rtr.rule=Host(`hf_rerank.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.hf_rerank-rtr.service=hf_rerank-svc"
      - "traefik.http.services.hf_rerank-svc.loadbalancer.server.port=80"

  ############## BLOB STORAGE CLIENT #####################
  # FIXME: On container restart, all buckets are lost
  localstack-s3:
    image: localstack/localstack:s3-latest
    container_name: localstack-s3
    restart: ${RESTART_POLICY:-unless-stopped}
    networks:
      - t2_proxy
      - podflix-network
    environment:
      - DEBUG=0
      - EXTRA_CORS_ALLOWED_ORIGINS=https://podflix.$DOMAIN_NAME,http://localhost:5000
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./deployment/volumes/localstack:/var/lib/localstack
    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.localstack-s3-rtr.entrypoints=https"
      - "traefik.http.routers.localstack-s3-rtr.rule=Host(`s3.$DOMAIN_NAME`)"
      ## HTTP Services
      - "traefik.http.routers.localstack-s3-rtr.service=localstack-s3-svc"
      - "traefik.http.services.localstack-s3-svc.loadbalancer.server.port=4566"