Add Dockerfile, docker-compose stack, Kubernetes manifests, and CI workflow

.dockerignore

@@ -0,0 +1,32 @@
+# Git
+.git
+.gitignore
+
+# Python bytecode and caches
+__pycache__
+*.py[cod]
+*.pyo
+.pytest_cache
+.mypy_cache
+.ruff_cache
+
+# uv caches (built inside the image; don't copy from host)
+.uv_cache
+
+# Virtual environments
+.venv
+
+# Output and upload dirs (mounted as volumes at runtime)
+apps/backend/outs
+apps/backend/uploads
+apps/backend/cache
+
+# Dev / editor
+.env
+*.env.local
+.vscode
+.idea
+
+# Docs
+CONTRIBUTING.md
+README.md

.github/workflows/docker.yml

@@ -0,0 +1,67 @@
+name: Docker
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+      - feature/**
+  pull_request:
+    branches:
+      - "*"
+
+jobs:
+  build-backend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    strategy:
+      matrix:
+        include:
+          - service: asr
+            target: final-asr
+          - service: translation
+            target: final-translation
+          - service: tts
+            target: final-tts
+          - service: orchestrator
+            target: final-orchestrator
+      fail-fast: false
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build ${{ matrix.service }} image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          dockerfile: Dockerfile
+          target: final-${{ matrix.service }}
+          push: false
+          tags: ghcr.io/codemowers/bluez-dubbing/${{ matrix.service }}:${{ github.sha }}
+          cache-from: type=gha,scope=${{ matrix.service }}
+          cache-to: type=gha,scope=${{ matrix.service }},mode=max
+
+  build-frontend:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build frontend image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          dockerfile: Dockerfile.frontend
+          push: false
+          tags: ghcr.io/codemowers/bluez-dubbing/frontend:${{ github.sha }}
+          cache-from: type=gha,scope=frontend
+          cache-to: type=gha,scope=frontend,mode=max

Dockerfile

@@ -0,0 +1,80 @@
+# Single parameterised Dockerfile for the four backend services.
+# Usage:
+#   docker build --build-arg SERVICE=orchestrator -t bluez-orchestrator .
+#   docker build --build-arg SERVICE=asr          -t bluez-asr .
+#   docker build --build-arg SERVICE=translation  -t bluez-translation .
+#   docker build --build-arg SERVICE=tts          -t bluez-tts .
+#
+# The orchestrator uses beveradb/audio-separator as its base so that
+# audio-separator, ffmpeg, rubberband, and torch ship pre-installed.
+# All other services use python:3.11-slim.
+
+ARG SERVICE=orchestrator
+
+# ── orchestrator base ────────────────────────────────────────────────────────
+FROM beveradb/audio-separator:latest AS base-orchestrator
+# audio-separator image ships Python 3.11, ffmpeg, rubberband, torch, onnxruntime.
+# Install uv on top.
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+
+# ── all other services base ──────────────────────────────────────────────────
+FROM python:3.11-slim AS base-default
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ffmpeg \
+    rubberband-cli \
+    git \
+  && rm -rf /var/lib/apt/lists/*
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+
+# ── select base ─────────────────────────────────────────────────────────────
+# Docker does not support conditional FROM, so we build both bases above and
+# select via the SERVICE arg at final-stage copy time.  The actual selection
+# happens in the service-specific compose / k8s build targets.
+# For a single-image build the default target is used; override with
+#   DOCKER_BUILDKIT=1 docker build --build-arg SERVICE=orchestrator \
+#     --target final-orchestrator .
+
+FROM base-orchestrator AS final-orchestrator
+WORKDIR /app
+COPY . .
+ENV UV_CACHE_DIR=/root/.cache/uv
+RUN uv sync --frozen --project apps/backend/services/orchestrator
+ENV PYTHONPATH=/app/apps/backend:/app
+EXPOSE 8000
+CMD ["uv", "run", "--project", "apps/backend/services/orchestrator", \
+     "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+
+FROM base-default AS final-asr
+WORKDIR /app
+COPY . .
+ENV UV_CACHE_DIR=/root/.cache/uv
+RUN uv sync --frozen --project apps/backend/services/asr \
+  && uv sync --frozen --project apps/backend/services/asr/models/whisperxModel
+ENV PYTHONPATH=/app/apps/backend:/app
+EXPOSE 8000
+CMD ["uv", "run", "--project", "apps/backend/services/asr", \
+     "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8001"]
+
+FROM base-default AS final-translation
+WORKDIR /app
+COPY . .
+ENV UV_CACHE_DIR=/root/.cache/uv
+RUN uv sync --frozen --project apps/backend/services/translation \
+  && uv sync --frozen --project apps/backend/services/translation/models/deepTranslationModel \
+  && uv sync --frozen --project apps/backend/services/translation/models/facebook_m2m100Model
+ENV PYTHONPATH=/app/apps/backend:/app
+EXPOSE 8000
+CMD ["uv", "run", "--project", "apps/backend/services/translation", \
+     "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8002"]
+
+FROM base-default AS final-tts
+WORKDIR /app
+COPY . .
+ENV UV_CACHE_DIR=/root/.cache/uv
+RUN uv sync --frozen --project apps/backend/services/tts \
+  && uv sync --frozen --project apps/backend/services/tts/models/chatterboxModel \
+  && uv sync --frozen --project apps/backend/services/tts/models/edgeTTsModel
+ENV PYTHONPATH=/app/apps/backend:/app
+EXPOSE 8000
+CMD ["uv", "run", "--project", "apps/backend/services/tts", \
+     "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8003"]

Dockerfile.frontend

@@ -0,0 +1,16 @@
+FROM nginx:1.27-alpine
+
+# Copy static assets
+COPY apps/frontend /usr/share/nginx/html
+
+# nginx config: listen on 8080 (non-root compatible), proxy /api and /outs
+COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+
+# Allow nginx to bind 8080 as non-root
+RUN chown -R nginx:nginx /var/cache/nginx /var/log/nginx /etc/nginx/conf.d \
+  && chmod -R g+w /var/cache/nginx /var/log/nginx \
+  && touch /var/run/nginx.pid \
+  && chown nginx:nginx /var/run/nginx.pid
+
+USER nginx
+EXPOSE 8080