# NEX-Sprachdienste (Task 6.2, Auftrag docs/auftraege/2026-10-12-sprachmodelle-nex.md)
#   nex-stt  Erkennung: whisper.cpp whisper-server (CUDA 12, sm_52/sm_61), Port 8178
#   nex-tts  Ausgabe:   Piper (CPU) hinter OpenAI-kompatiblem Wrapper, Port 8179
# Beide im Host-Netz: Veröffentlichte Docker-Ports laufen über DNAT/FORWARD und umgehen ufw.
# So gelten die ufw-Regeln der VM (8178/8179 nur von 192.168.100.29), siehe Ansible-Rolle nex-speech.
# Datenschutz: kein Access-Log, keine Texte im Log, Temp-Dateien nur im tmpfs.
name: nex-speech

x-logging: &logging
  driver: local
  options: {max-size: "5m", max-file: "2"}

services:
  nex-stt:
    build:
      context: ./whisper
      args:
        WHISPER_TAG: ${WHISPER_TAG:-v1.9.4}
        WHISPER_COMMIT: ${WHISPER_COMMIT:-927cfce34f31707e17f2bff35c349632fb9e2c3a}
        CUDA_ARCHS: ${CUDA_ARCHS:-52;61}
    image: knaster/nex-whisper:${WHISPER_TAG:-v1.9.4}-cu12.6
    container_name: nex-stt
    restart: unless-stopped
    network_mode: host
    read_only: true
    environment:
      WHISPER_PORT: ${STT_PORT:-8178}
      WHISPER_MODEL: /models/whisper/${WHISPER_MODEL_FILE:-ggml-large-v3-turbo.bin}
      WHISPER_LANGUAGE: de
      WHISPER_BEAM_SIZE: ${WHISPER_BEAM_SIZE:-5}
      WHISPER_EXTRA_ARGS: ${WHISPER_EXTRA_ARGS:-}
    volumes:
      - ${MODELS_DIR:-/srv/models}/whisper:/models/whisper:ro
    tmpfs:
      - /run/nex-whisper:size=512m,mode=0700
    deploy:
      resources:
        reservations:
          devices: [{driver: nvidia, device_ids: ["${STT_GPU:-0}"], capabilities: [gpu]}]
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:$${WHISPER_PORT}/health >/dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 300s
    logging: *logging

  nex-tts:
    build: ./piper
    image: knaster/nex-tts-piper:${PIPER_TTS_VERSION:-1.8.0}
    container_name: nex-tts
    restart: unless-stopped
    network_mode: host
    read_only: true
    environment:
      TTS_PORT: ${TTS_PORT:-8179}
      PIPER_VOICES_DIR: /voices
      PIPER_VOICES: ${PIPER_VOICES:-de_DE-thorsten-high,de_DE-kerstin-low}
      PIPER_DEFAULT_VOICE: ${PIPER_DEFAULT_VOICE:-de_DE-thorsten-high}
      PCM_SAMPLE_RATE: ${PCM_SAMPLE_RATE:-24000}
      TTS_MAX_CHARS: ${TTS_MAX_CHARS:-5000}
      TTS_PARALLEL: ${TTS_PARALLEL:-2}
    volumes:
      - ${MODELS_DIR:-/srv/models}/piper:/voices:ro
    tmpfs:
      - /tmp:size=64m
    deploy:
      resources:
        limits: {cpus: "3", memory: 2G}   # ein Kern bleibt für whisper-server und das System
    healthcheck:
      test: ["CMD", "python", "-c", "import os, urllib.request; urllib.request.urlopen(f\"http://127.0.0.1:{os.environ.get('TTS_PORT', '8179')}/health\", timeout=4)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
    logging: *logging