# ============================================================================
# Javis Bot — Docker Compose
#   ollama      : the LLM backend for the jarvis brain
#   ollama-init : one-shot, auto-pulls the chat + embed models on startup
#   javis       : all-in-one container (VNC desktop + Chrome + bridge + bot)
#
# Just bring it up — everything (incl. Ollama models) comes up automatically:
#   docker compose up -d --build
#
# The Discord credential can be added LAST: without it the desktop, brain
# bridge, Ollama and models all run; only the bot waits. This deployment runs
# in userbot mode, so put DISCORD_SELFBOT_TOKEN in .env and re-run
# `docker compose up -d`. (A normal-bot DISCORD_BOT_TOKEN is optional and only
# needed for the legacy slash-command bot; leave it blank for userbot mode.)
#
# Watch the desktop:  VNC viewer -> localhost:5901  (or browser -> localhost:6080)
# ============================================================================
services:
  ollama:
    image: ollama/ollama:latest
    restart: unless-stopped
    # Model residency is controlled per-request, not globally. The brain pins
    # the chat model with keep_alive=30m (src/jarvis/llm.py) so voice turns
    # never pay a cold reload, while embeddings pass keep_alive=0
    # (src/jarvis/memory/embeddings.py) so nomic-embed unloads right after use.
    # A global OLLAMA_KEEP_ALIVE=-1 was removed because it also kept the embed
    # model resident forever, wasting VRAM next to the chat model.
    volumes:
      - ollama_models:/root/.ollama
    # GPU: needs nvidia-container-toolkit on the host (CDI). Verified on the
    # RTX 5050 (Blackwell sm_120) — Ollama offloads 100% to GPU.
    devices:
      - "nvidia.com/gpu=all"

  # Auto-pull the models the brain needs, then exit. Idempotent (re-runnable).
  ollama-init:
    image: ollama/ollama:latest
    depends_on:
      - ollama
    restart: "no"
    environment:
      OLLAMA_HOST: http://ollama:11434
      CHAT_MODEL: ${OLLAMA_CHAT_MODEL:-qwen2.5:3b}
      EMBED_MODEL: ${OLLAMA_EMBED_MODEL:-nomic-embed-text}
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        echo "[ollama-init] waiting for ollama server...";
        until ollama list >/dev/null 2>&1; do sleep 2; done;
        echo "[ollama-init] pulling $$CHAT_MODEL";
        ollama pull "$$CHAT_MODEL";
        echo "[ollama-init] pulling $$EMBED_MODEL";
        ollama pull "$$EMBED_MODEL";
        echo "[ollama-init] models ready.";

  javis:
    build: .
    restart: unless-stopped
    env_file:
      - path: .env
        required: false
    environment:
      # Point the brain at the ollama service and the bot at the in-container bridge.
      OLLAMA_BASE_URL: http://ollama:11434
      OLLAMA_CHAT_MODEL: ${OLLAMA_CHAT_MODEL:-qwen2.5:3b}
      OLLAMA_EMBED_MODEL: ${OLLAMA_EMBED_MODEL:-nomic-embed-text}
      WHISPER_MODEL: ${WHISPER_MODEL:-medium}
      WHISPER_DEVICE: ${WHISPER_DEVICE:-cuda}
      WHISPER_COMPUTE_TYPE: ${WHISPER_COMPUTE_TYPE:-float16}
      # MeloTTS on the GPU (cu128 torch baked by docker/setup-melo.sh). CPU synth
      # serialised under load and pushed TTS to 7-8s; GPU does ~0.3s/sentence.
      MELO_DEVICE: ${MELO_DEVICE:-cuda}
      # Optional single-language lock for replies (empty = user's own language).
      OUTPUT_LANGUAGE: ${OUTPUT_LANGUAGE:-ko}
      # Drop the pre-loop planner LLM call to cut voice-reply latency on small
      # hardware (the planner adds a full model round-trip per turn).
      PLANNER_ENABLED: ${PLANNER_ENABLED:-0}
      # Lock STT to Korean (skip Whisper auto-detect).
      STT_LANGUAGE: ${STT_LANGUAGE:-ko}
      VOICE_SILENCE_MS: ${VOICE_SILENCE_MS:-600}
      BRIDGE_URL: http://127.0.0.1:8765
      # Split-deployment role: full (default, all-in-one), browser (only the
      # desktop + Chrome + CDP, reused over the LAN), or bot (only bot + bridge
      # + TTS, driving a remote browser via CDP_HOST). See docker/run-if-role.sh.
      JARVIS_ROLE: ${JARVIS_ROLE:-full}
      # Chrome CDP bind address INSIDE the container. 0.0.0.0 lets a remote bot
      # (JARVIS_ROLE=bot on another PC) drive this host's browser. Loopback by
      # default so the all-in-one layout stays unreachable off-host.
      CDP_BIND: ${CDP_BIND:-127.0.0.1}
      CDP_PORT: ${CDP_PORT:-9222}
      # Where the bot drives Chrome. Loopback for full/browser; on a remote bot
      # set CDP_HOST to the browser host's LAN IP (e.g. 192.168.10.9).
      CDP_HOST: ${CDP_HOST:-127.0.0.1}
    depends_on:
      - ollama
    # GPU: accelerates Whisper STT (and anything else CUDA) in this container.
    # Verified: faster-whisper float16 works on the RTX 5050 (sm_120).
    devices:
      - "nvidia.com/gpu=all"
    shm_size: "1gb"          # Chrome needs a larger /dev/shm
    ports:
      # All published to loopback only by default — VNC/noVNC use a weak default
      # password and the bridge is an unauthenticated internal API, so none
      # should be reachable off-host. For remote access use an SSH tunnel, or
      # set a strong VNC_PASSWORD and override the bind (e.g. VNC_BIND=0.0.0.0).
      # Host VNC port is overridable; this server already runs Xvnc on 5901 so
      # .env pins VNC_PORT=5902.
      - "${VNC_BIND:-127.0.0.1}:${VNC_PORT:-5901}:5901"      # VNC
      - "${VNC_BIND:-127.0.0.1}:${NOVNC_PORT:-6080}:6080"    # noVNC (browser)
      # Chrome CDP for a remote bot (JARVIS_ROLE=bot). Loopback by default; for a
      # LAN browser-host set CDP_PUBLISH_BIND=0.0.0.0 (internal network, no auth).
      - "${CDP_PUBLISH_BIND:-127.0.0.1}:${CDP_PORT:-9222}:9222"  # Chrome CDP
      # The brain bridge is NOT published: it binds the container's loopback
      # (BRIDGE_HOST=127.0.0.1) and is only consumed by the bot in this same
      # container, so it needs no host port and stays unreachable off-container.
    volumes:
      - javis_data:/data                         # jarvis db + memory
      - whisper_cache:/root/.cache/huggingface   # cached Whisper models
      - piper_voices:/opt/piper-voices           # TTS voices
      # Gemini account login for GEMINI_AUTH=oauth real-time search. Mounts a
      # DEDICATED dir holding only the Gemini OAuth creds (not the whole
      # ~/.gemini), so the container can refresh its token without exposing
      # unrelated host state. Seed it once with the host login:
      #   mkdir -p ~/.config/javis/gemini
      #   cp ~/.gemini/oauth_creds.json ~/.config/javis/gemini/
      # Override GEMINI_OAUTH_DIR to point elsewhere. Only used when
      # GEMINI_AUTH=oauth.
      - ${GEMINI_OAUTH_DIR:-${HOME}/.config/javis/gemini}:/root/.gemini

volumes:
  ollama_models:
  javis_data:
  whisper_cache:
  piper_voices: