caption-ninja/compose.yml

---
version: "3.8"

services:
  app:
    image: git.autonomic.zone/recipe-maintainers/caption-ninja-web:2026.10.13-12fe0fa
    networks:
      - proxy
    environment:
      - RELAY_URL=wss://${DOMAIN}/relay
      - CAPTURE_URL=https://${STT_DOMAIN}/
      - RELAY_UPSTREAM=${STACK_NAME}_relay:8787
      - TRANSLATION_MODELS=${TRANSLATION_MODELS:-all}
    volumes:
      - translation_models:/usr/share/nginx/models
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    deploy:
      update_config:
        failure_action: rollback
        order: start-first
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
        - "coop-cloud.${STACK_NAME}.version=0.2.0+v2026.10.13"

  relay:
    image: git.autonomic.zone/recipe-maintainers/caption-ninja-relay:2026.10.13-12fe0fa
    networks:
      - proxy
    environment:
      - DOMAIN
      - STT_DOMAIN
      - RELAY_EXTRA_ORIGINS
      - RELAY_PER_IP
    secrets:
      - src_read
      - src_write
      - out_read
      - out_write
    configs:
      - source: relay_entrypoint
        target: /relay-entrypoint.sh
        mode: 0555
    entrypoint: /relay-entrypoint.sh
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8787/health').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    deploy:
      update_config:
        failure_action: rollback
        order: start-first
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.${STACK_NAME}_relay.rule=Host(`${DOMAIN}`) && Path(`/relay`)"
        - "traefik.http.routers.${STACK_NAME}_relay.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}_relay.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}_relay.service=${STACK_NAME}_relay"
        - "traefik.http.routers.${STACK_NAME}_relay.middlewares=${STACK_NAME}_relay_strip"
        - "traefik.http.middlewares.${STACK_NAME}_relay_strip.stripprefix.prefixes=/relay"
        - "traefik.http.services.${STACK_NAME}_relay.loadbalancer.server.port=8787"

  stt:
    image: git.autonomic.zone/recipe-maintainers/caption-ninja-stt:2026.10.13-12fe0fa
    networks:
      - proxy
    environment:
      - DOMAIN
      - STT_DOMAIN
      - STT_EXTRA_ORIGINS
      - CAPTION_MODEL=${CAPTION_MODEL:-small}
      - CAPTION_BEAM_SIZE=${CAPTION_BEAM_SIZE:-5}
      - CAPTION_WORKERS=${CAPTION_WORKERS:-1}
      - CAPTION_THREADS=${CAPTION_THREADS:-4}
      - CAPTION_MAX_STREAMS=${CAPTION_MAX_STREAMS:-12}
      - CAPTION_COMPUTE_TYPE=${CAPTION_COMPUTE_TYPE:-auto}
      - CAPTION_DEVICE=cpu
      - CAPTION_OFFLINE=${CAPTION_OFFLINE:-0}
      - CAPTION_LOG_REQUESTS=${CAPTION_LOG_REQUESTS:-0}
      - RELAY_AUTOFILL=${RELAY_AUTOFILL:-source}
    secrets:
      - stt_api_key
      - src_read
      - src_write
      - out_read
      - out_write
    configs:
      - source: stt_entrypoint
        target: /stt-entrypoint.sh
        mode: 0555
    entrypoint: /stt-entrypoint.sh
    volumes:
      - models:/models
    healthcheck:
      # The image's own healthcheck reads CAPTION_API_KEY from the environment,
      # which only the entrypoint process has; feed it the secret here.
      test: ["CMD", "sh", "-c", "CAPTION_API_KEY=$$(cat /run/secrets/stt_api_key) python healthcheck.py"]
      interval: 30s
      timeout: 10s
      retries: 3
      # First start downloads the Whisper model into the volume.
      start_period: 600s
    stop_grace_period: 100s
    deploy:
      update_config:
        failure_action: rollback
        order: stop-first
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.${STACK_NAME}_stt.rule=Host(`${STT_DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}_stt.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}_stt.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}_stt.service=${STACK_NAME}_stt"
        # Caption Local only accepts Host: localhost (upstream expects an SSH tunnel)
        - "traefik.http.routers.${STACK_NAME}_stt.middlewares=${STACK_NAME}_stt_host"
        - "traefik.http.middlewares.${STACK_NAME}_stt_host.headers.customrequestheaders.Host=localhost"
        - "traefik.http.services.${STACK_NAME}_stt.loadbalancer.server.port=8765"

secrets:
  src_read:
    name: ${STACK_NAME}_src_read_${SECRET_SRC_READ_VERSION}
    external: true
  src_write:
    name: ${STACK_NAME}_src_write_${SECRET_SRC_WRITE_VERSION}
    external: true
  out_read:
    name: ${STACK_NAME}_out_read_${SECRET_OUT_READ_VERSION}
    external: true
  out_write:
    name: ${STACK_NAME}_out_write_${SECRET_OUT_WRITE_VERSION}
    external: true
  stt_api_key:
    name: ${STACK_NAME}_stt_api_key_${SECRET_STT_API_KEY_VERSION}
    external: true

configs:
  relay_entrypoint:
    name: ${STACK_NAME}_relay_entrypoint_${RELAY_ENTRYPOINT_VERSION}
    file: relay-entrypoint.sh
  stt_entrypoint:
    name: ${STACK_NAME}_stt_entrypoint_${STT_ENTRYPOINT_VERSION}
    file: stt-entrypoint.sh

networks:
  proxy:
    external: true

volumes:
  models:
  translation_models: