docker-compose.yml

services:
  # ===========================================
  # PostgreSQL Database
  # ===========================================
  postgres:
    image: pgvector/pgvector:pg16
    container_name: callcenter-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./services/backend/database/sql/local_schema.sql:/docker-entrypoint-initdb.d/01_schema.sql
      - ./services/backend/vocabulary_schema.sql:/docker-entrypoint-initdb.d/02_vocabulary.sql
      - ./infra/pgbackrest/pgbackrest.conf:/etc/pgbackrest/pgbackrest.conf:ro
      - pgbackrest_repo:/var/lib/pgbackrest
    # Port 5432 not exposed externally — access via Docker network only
    # WAL archiving for pgBackRest (point-in-time recovery)
    command:
      - postgres
      - -c
      - archive_mode=on
      - -c
      - archive_command=pgbackrest --stanza=callcenter archive-push %p
      - -c
      - max_wal_senders=3
      - -c
      - wal_level=replica
      - -c
      - shared_preload_libraries=pg_stat_statements
      - -c
      - pg_stat_statements.track=all
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}" ]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - callcenter-network

  # ===========================================
  # Redis — Session cache, rate limiting, pub/sub
  # ===========================================
  redis:
    image: redis:7-alpine
    container_name: callcenter-redis
    restart: unless-stopped
    command: redis-server --maxmemory 256mb --maxmemory-policy allkeys-lru --appendonly yes
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
    networks:
      - callcenter-network
    security_opt:
      - no-new-privileges:true

  # ===========================================
  # Backend API + WebSocket Manager
  # ===========================================
  backend:
    build:
      context: ./services/backend
      dockerfile: Dockerfile
    container_name: callcenter-backend
    restart: unless-stopped
    environment:
      - POSTGRES_HOST=${POSTGRES_HOST}
      - POSTGRES_PORT=${POSTGRES_PORT}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
      - TTS_URL=http://tts:8001
      - STT_URL=http://stt:8002
      - LLM_URL=http://llm:8003
      - CALL_CENTER_GREETING=${CALL_CENTER_GREETING}
      # License configuration (required for on-premise deployments)
      - LICENSE_KEY=${LICENSE_KEY:-}
      - LICENSE_SERVER_URL=${LICENSE_SERVER_URL:-https://license.callcenter-ai.com}
      - LICENSE_CACHE_DIR=/var/lib/callcenter/license
      - ADMIN_API_KEY=${ADMIN_API_KEY:-change-me-in-production}
      # Supabase (Platform Database)
      - SUPABASE_DB_URL=${SUPABASE_DB_URL:-}
      - SUPABASE_DB_SSL=${SUPABASE_DB_SSL:-prefer}
      # SIP Trunk Encryption
      - SIP_CREDENTIAL_KEY=${SIP_CREDENTIAL_KEY:-}
      - ASTERISK_CONFIG_PATH=/asterisk-config
      # Asterisk connection for config reload
      - ASTERISK_HOST=asterisk
      # AudioSocket authentication
      - AUDIOSOCKET_SECRET=${AUDIOSOCKET_SECRET:-}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-*}
      # Recording & VAD
      - ENABLE_RECORDING=${ENABLE_RECORDING:-true}
      - VAD_AGGRESSIVENESS=${VAD_AGGRESSIVENESS:-3}
      - STORAGE_LOCAL_PATH=/app/audio/recordings
      # SMTP for incident ticket emails
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASSWORD=${SMTP_PASSWORD:-}
      - SMTP_FROM=${SMTP_FROM:-noreply@callcenter-ai.com}
      - ADMIN_ALERT_EMAIL=${ADMIN_ALERT_EMAIL:-call_admin@vara-alta.lat}
    # Port 8000 not exposed externally — access via nginx reverse proxy
    security_opt:
      - no-new-privileges:true
    volumes:
      - ./shared/audio:/app/audio
      - backend_license_cache:/var/lib/callcenter/license
      - asterisk_config:/asterisk-config
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - callcenter-network

  # ===========================================
  # License Server (Internal - Only for your company)
  # ===========================================
  license_server:
    build:
      context: ./services/license_server
      dockerfile: Dockerfile
    container_name: callcenter-license-server
    restart: unless-stopped
    environment:
      - LICENSE_DATABASE_URL=sqlite:///./licenses.db
    ports:
      - "8100:8000"
    volumes:
      - license_data:/app/data
    networks:
      - callcenter-network
    # IMPORTANTE: Este servicio NO debe desplegarse en instalaciones de clientes
    # Solo debe correr en tu infraestructura interna
    profiles:
      - internal

  # ===========================================
  # TTS Service (Kokoro for production calls)
  # ===========================================
  tts:
    build:
      context: ./services/tts
      dockerfile: Dockerfile
    image: call-tts:latest
    container_name: callcenter-tts
    restart: unless-stopped
    entrypoint: []
    command: ["uvicorn", "tts_server:app", "--host", "0.0.0.0", "--port", "8001"]
    environment:
      - HUGGINGFACE_API_KEY=${HUGGINGFACE_API_KEY}
      - DEVICE=${TTS_DEVICE:-cuda}
      # Kokoro = production (210x realtime, lightweight)
      - TTS_BACKEND=${TTS_BACKEND:-kokoro}
      - KOKORO_VOICE_PATH=${KOKORO_VOICE_PATH:-}
      - KOKORO_VOICE_STYLE=${KOKORO_VOICE_STYLE:-ef_dora}
      - KOKORO_LANG=${KOKORO_LANG:-e}
      # Fish Speech proxy (for on-demand high-quality synthesis)
      - FISH_TTS_URL=${FISH_TTS_URL:-http://fish-speech:8080}
      - FISH_TTS_ENABLED=${FISH_TTS_ENABLED:-true}
      # CosyVoice 2 proxy (production Spanish LATAM voice)
      - COSYVOICE_URL=${COSYVOICE_URL:-http://cosyvoice:8006}
      - COSYVOICE_ENABLED=${COSYVOICE_ENABLED:-false}
    # Port 8001 not exposed externally — access via Docker network only
    volumes:
      - ./shared/models:/app/models
      - ./shared/audio:/app/audio
      - distillation_data:/data/distillation
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [ gpu ]
    networks:
      - callcenter-network

  # ===========================================
  # Triton Inference Server (STT Backend)
  # ===========================================
  triton:
    build:
      context: ./services/triton
      dockerfile: Dockerfile
    container_name: callcenter-triton
    restart: unless-stopped
    environment:
      - STT_MODEL=${TRITON_STT_MODEL:-small}
      - DEVICE=cuda
      - COMPUTE_TYPE=${TRITON_COMPUTE_TYPE:-float16}
      - LANGUAGE=${STT_LANGUAGE:-es}
      - MODEL_CACHE=/models/whisper
    ports:
      - "${TRITON_HTTP_PORT:-8010}:8010"
      - "${TRITON_GRPC_PORT:-8011}:8011"
      - "${TRITON_METRICS_PORT:-8012}:8012"
    volumes:
      - ./services/triton/model_repository:/model_repository
      - ./shared/models:/models/whisper
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [ gpu ]
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:8010/v2/health/ready" ]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    networks:
      - callcenter-network
    profiles:
      - triton

  # ===========================================
  # Whisper STT Service
  # ===========================================
  stt:
    build:
      context: ./services/stt
      dockerfile: Dockerfile
    container_name: callcenter-stt
    restart: unless-stopped
    environment:
      - STT_MODEL=${STT_MODEL}
      - DEVICE=${STT_DEVICE}
      - LANGUAGE=${STT_LANGUAGE}
      - STT_BACKEND=${STT_BACKEND:-whisper}
      - RIVA_URL=${RIVA_URL:-riva-asr:50051}
      - USE_TRITON=${USE_TRITON:-false}
      - TRITON_URL=http://triton:8010
      - TRITON_MODEL_NAME=whisper_stt
    # Port 8002 not exposed externally — access via Docker network only
    volumes:
      - ./shared/models:/app/models
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [ gpu ]
    networks:
      - callcenter-network

  # ===========================================
  # Ollama runs NATIVELY on Windows (not in Docker)
  # Install: winget install Ollama.Ollama
  # Pull model: ollama pull qwen2.5:7b
  # Ollama starts automatically as a Windows service
  # ===========================================

  # ===========================================
  # LLM Service (LangChain + Ollama on host)
  # ===========================================
  llm:
    build:
      context: ./services/llm
      dockerfile: Dockerfile
    container_name: callcenter-llm
    restart: unless-stopped
    environment:
      - OLLAMA_URL=${OLLAMA_URL:-http://host.docker.internal:11434/v1}
      - OLLAMA_MODEL=${OLLAMA_MODEL:-qwen2.5:7b}
      - LLM_BACKEND=${LLM_BACKEND:-ollama}
      - TENSORRT_URL=${TENSORRT_URL:-http://tensorrt-llm:8000/v1}
      - TENSORRT_MODEL=${TENSORRT_MODEL:-qwen2.5-7b}
      - POSTGRES_HOST=${POSTGRES_HOST}
      - POSTGRES_PORT=${POSTGRES_PORT}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    # Port 8003 not exposed externally — access via Docker network only
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - callcenter-network

  # ===========================================
  # Audio Preprocessing (Noise Suppression + Speaker ID)
  # ===========================================
  audio_preprocess:
    build:
      context: ./services/audio_preprocess
      dockerfile: Dockerfile
    container_name: callcenter-audio-preprocess
    restart: unless-stopped
    environment:
      - DEVICE=${AUDIO_DEVICE:-cuda}
      - SAMPLE_RATE=16000
      - DENOISE_MODEL=${DENOISE_MODEL:-deepfilternet}
      # pyannote diarization requires a HuggingFace token (free, gated model)
      - HF_TOKEN=${HF_TOKEN:-}
    # Port 8004 not exposed externally — access via Docker network only
    volumes:
      - ./shared/models:/app/models
      - audio_preprocess_data:/app/data
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [ gpu ]
    networks:
      - callcenter-network

  # ===========================================
  # MariaDB (Para FreePBX)
  # ===========================================
  mariadb:
    image: mariadb:10.11
    container_name: callcenter-mariadb
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-rootpassword}
      MYSQL_DATABASE: asterisk
      MYSQL_USER: ${MYSQL_USER:-asteriskuser}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-asteriskpass}
    volumes:
      - mariadb_data:/var/lib/mysql
    # Port 3306 not exposed externally — access via Docker network only
    networks:
      - callcenter-network
    healthcheck:
      test: [ "CMD", "healthcheck.sh", "--connect", "--innodb_initialized" ]
      interval: 10s
      timeout: 5s
      retries: 5

  # ===========================================
  # Asterisk PBX
  # ===========================================
  asterisk:
    build:
      context: ./services/asterisk
      dockerfile: Dockerfile
    container_name: callcenter-asterisk
    restart: unless-stopped
    environment:
      - ASTERISK_USER=${ASTERISK_USER}
      - ASTERISK_PASSWORD=${ASTERISK_PASSWORD}
      - ARI_PASSWORD=${ARI_PASSWORD:-ari123}
      - FREEPBX_AMI_PASSWORD=${FREEPBX_AMI_PASSWORD:-freepbx123}
      - BACKEND_AMI_PASSWORD=${BACKEND_AMI_PASSWORD:-backend123}
      - GATEWAY_FXO_IP=${GATEWAY_FXO_IP:-192.168.1.100}
      - GATEWAY_FXO_USER=${GATEWAY_FXO_USER:-gateway}
      - GATEWAY_FXO_PASSWORD=${GATEWAY_FXO_PASSWORD:-gateway123}
      # GSM Gateway (GoIP/GMF via VPN)
      - GSM_GATEWAY_VPN_IP=${GSM_GATEWAY_VPN_IP:-10.0.0.2}
      - GSM_GATEWAY_USER=${GSM_GATEWAY_USER:-goip}
      - GSM_GATEWAY_PASSWORD=${GSM_GATEWAY_PASSWORD:-goip_secure_change_me}
      - GSM_GATEWAY_CHANNELS=${GSM_GATEWAY_CHANNELS:-4}
      # NAT / Network Configuration
      - EXTERNAL_IP=${EXTERNAL_IP:-}
      - LOCAL_NETWORK=${LOCAL_NETWORK:-192.168.1.0/24}
      - RTP_PORT_START=${RTP_PORT_START:-10000}
      - RTP_PORT_END=${RTP_PORT_END:-20000}
      # SIP Trunk
      - SIP_TRUNK_HOST=${SIP_TRUNK_HOST:-}
      - SIP_TRUNK_USER=${SIP_TRUNK_USER:-}
      - SIP_TRUNK_PASSWORD=${SIP_TRUNK_PASSWORD:-}
      # DDNS (Dynamic IP)
      - DDNS_ENABLED=${DDNS_ENABLED:-false}
      - DDNS_PROVIDER=${DDNS_PROVIDER:-duckdns}
      - DDNS_DOMAIN=${DDNS_DOMAIN:-}
      - DDNS_TOKEN=${DDNS_TOKEN:-}
      # WebRTC
      - WEBRTC_PASSWORD=${WEBRTC_PASSWORD:-webrtc123}
      # AudioSocket authentication
      - AUDIOSOCKET_SECRET=${AUDIOSOCKET_SECRET:-}
    ports:
      - "${ASTERISK_SIP_PORT:-5060}:5060/udp"
      - "${ASTERISK_SIP_PORT:-5060}:5060/tcp"
      - "5061:5061/tcp" # SIP TLS
      - "${ASTERISK_WS_PORT:-8088}:8088"
      - "8089:8089" # WebSocket Secure
      - "5038:5038" # AMI port
      - "${RTP_PORT_START:-10000}-${RTP_PORT_END:-20000}:${RTP_PORT_START:-10000}-${RTP_PORT_END:-20000}/udp" # RTP ports
    volumes:
      - ./services/asterisk/config:/etc/asterisk/custom
      - asterisk_config:/etc/asterisk/generated
      - asterisk_logs:/var/log/asterisk
      - asterisk_spool:/var/spool/asterisk
    # Descomenta si usas tarjetas DAHDI:
    # privileged: true
    # devices:
    #   - /dev/dahdi:/dev/dahdi
    networks:
      - callcenter-network
    depends_on:
      mariadb:
        condition: service_healthy

  # ===========================================
  # FreePBX (Interfaz de Gestión)
  # ===========================================
  freepbx:
    image: tiredofit/freepbx:latest
    container_name: callcenter-freepbx
    restart: unless-stopped
    environment:
      # Base de datos
      - DB_EMBEDDED=FALSE
      - DB_HOST=mariadb
      - DB_PORT=3306
      - DB_NAME=asterisk
      - DB_USER=${MYSQL_USER:-asteriskuser}
      - DB_PASS=${MYSQL_PASSWORD:-asteriskpass}

      # RTP ports
      - RTP_START=10000
      - RTP_FINISH=10100

      # UCP (User Control Panel)
      - ENABLE_UCP=TRUE

      # Asterisk config location
      - ASTERISK_CONFIG_LOCATION=custom

      # Timezone
      - TZ=America/Mexico_City

      # Admin credentials
      - ADMIN_USER=${FREEPBX_ADMIN_USER:-admin}
      - ADMIN_PASS=${FREEPBX_ADMIN_PASSWORD:-admin123}
    ports:
      - "8080:80" # FreePBX Web UI
      - "8443:443" # FreePBX HTTPS
    volumes:
      - ./services/asterisk/config:/etc/asterisk/custom
      - freepbx_data:/data
      - freepbx_backup:/var/lib/asterisk/backup
    networks:
      - callcenter-network
    depends_on:
      mariadb:
        condition: service_healthy
      asterisk:
        condition: service_started

  # ===========================================
  # CosyVoice 2 (Production Spanish LATAM TTS)
  # ===========================================
  # Zero-shot voice cloning with native Spanish support.
  # Apache 2.0 license. ~2GB VRAM. Replaces Kokoro for production.
  #
  # Setup:
  #   1. Set COSYVOICE_ENABLED=true and TTS_BACKEND=cosyvoice in .env
  #   2. docker compose up cosyvoice tts -d
  #   3. Register a speaker:
  #      curl -X POST http://localhost:8006/v1/speakers \
  #        -F "audio=@voice_sample.wav" \
  #        -F "name=Agente Maria" \
  #        -F "reference_text=Hola buenos días, bienvenido al servicio..."
  #   4. Use the returned speaker_id in agent voice_style config
  #
  # First build downloads model (~2GB), cached in Docker layer.
  # ===========================================
  cosyvoice:
    build:
      context: ./services/cosyvoice
      dockerfile: Dockerfile
    container_name: callcenter-cosyvoice
    restart: unless-stopped
    environment:
      - COSYVOICE_MODEL_DIR=/app/models/CosyVoice2-0.5B
      - COSYVOICE_SPEAKERS_DIR=/app/speakers
    ports:
      - "${COSYVOICE_PORT:-8006}:8006"
    volumes:
      - cosyvoice_speakers:/app/speakers
      - ./shared/audio:/app/audio
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [ gpu ]
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8006/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    networks:
      - callcenter-network

  # ===========================================
  # Fish Speech S1-mini (High-Quality Voice Cloning & Emotion)
  # On-demand: docker compose --profile fish up fish-speech -d
  # Used for: reference generation, voice cloning, emotion targets
  # WARNING: ~12GB VRAM - stop tts+stt before starting
  # ===========================================
  fish-speech:
    # PINNED: Do NOT use 'latest' — S2 (v2.0.0) broke API, needs 40GB VRAM, changed license
    image: fishaudio/fish-speech:v1.5.1
    container_name: callcenter-fish-speech
    restart: unless-stopped
    environment:
      - COMPILE=1
      - BACKEND=cuda
    ports:
      - "${FISH_TTS_PORT:-8005}:8080"
    volumes:
      - fish_checkpoints:/app/checkpoints
      - ./shared/audio/fish_references:/app/references
      - ./shared/audio:/app/audio
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [ gpu ]
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 120s
    networks:
      - callcenter-network
    profiles:
      - fish

  # ===========================================
  # Voice Training Scheduler (F5-TTS → Kokoro distillation)
  # Runs nightly at TRAINING_SCHEDULE_HOUR (default 11PM)
  # F5 generates reference audio, evolves Kokoro voice tensors
  # GPU is shared: during day = vLLM+Kokoro, at night = training
  # ===========================================
  voice_training:
    build:
      context: ./services/voice_distillation
      dockerfile: Dockerfile
    image: call-voice-distillation:latest
    container_name: callcenter-voice-training
    restart: unless-stopped
    entrypoint: []
    command: ["python", "/app/voice_distillation/training_scheduler.py"]
    working_dir: /app/voice_distillation
    environment:
      - TTS_URL=http://tts:8001
      - AUDIO_PREPROCESS_URL=http://audio_preprocess:8004
      - DISTILLATION_OUTPUT=/data/distillation
      - DEVICE=${TTS_DEVICE:-cuda}
      - TRAINING_SCHEDULE_HOUR=${TRAINING_SCHEDULE_HOUR:-23}
    volumes:
      - distillation_data:/data/distillation
      - ./shared/audio:/app/audio
      - ./shared/models:/app/models
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [ gpu ]
    depends_on:
      - tts
    networks:
      - callcenter-network

  # ===========================================
  # Voice Distillation (Manual run)
  # Use: docker compose --profile training run voice_distillation --stage all
  # ===========================================
  voice_distillation:
    build:
      context: ./services/voice_distillation
      dockerfile: Dockerfile
    image: call-voice-distillation:latest
    container_name: callcenter-voice-distillation
    entrypoint: []
    working_dir: /app/voice_distillation
    environment:
      - TTS_URL=http://tts:8001
      - AUDIO_PREPROCESS_URL=http://audio_preprocess:8004
      - DISTILLATION_OUTPUT=/data/distillation
      - DEVICE=${TTS_DEVICE:-cuda}
    volumes:
      - distillation_data:/data/distillation
      - ./shared/audio:/app/audio
      - ./shared/models:/app/models
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [ gpu ]
    depends_on:
      - tts
    networks:
      - callcenter-network
    profiles:
      - training

  # ===========================================
  # React Dashboard (Client-Facing)
  # ===========================================
  dashboard:
    build:
      context: ./services/dashboard
      dockerfile: Dockerfile
    container_name: callcenter-dashboard
    restart: unless-stopped
    environment:
      - VITE_API_URL=${VITE_API_URL:-http://localhost:8000}
    # Port 3001 not exposed externally — access via nginx reverse proxy
    networks:
      - callcenter-network

  # ===========================================
  # WhatsApp Cloud API Service
  # ===========================================
  # Handles WhatsApp Business webhook integration
  # Receives messages from Meta, routes to agent LLM, responds via Cloud API
  # Shares PostgreSQL with backend for conversations/messages
  whatsapp:
    build:
      context: ./services/whatsapp
      dockerfile: Dockerfile
    container_name: callcenter-whatsapp
    restart: unless-stopped
    environment:
      - BACKEND_URL=http://backend:8000
      - LLM_URL=http://llm:8003
      - ADMIN_API_KEY=${ADMIN_API_KEY:-change-me-in-production}
      # WhatsApp Cloud API credentials
      - WHATSAPP_VERIFY_TOKEN=${WHATSAPP_VERIFY_TOKEN:-}
      - WHATSAPP_APP_SECRET=${WHATSAPP_APP_SECRET:-}
      - WHATSAPP_API_VERSION=${WHATSAPP_API_VERSION:-v21.0}
      # Redis for dedup + caching
      - REDIS_URL=redis://redis:6379/1
      # Conversation timeout (minutes)
      - WA_CONVERSATION_TIMEOUT_MINUTES=${WA_CONVERSATION_TIMEOUT_MINUTES:-30}
      # Database (shared with backend)
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    volumes:
      - ./services/whatsapp/logs:/app/logs
    # Port 8006 not exposed externally — access via nginx reverse proxy
    networks:
      - callcenter-network
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      backend:
        condition: service_started
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "python", "-c", "import httpx; r = httpx.get('http://localhost:8006/health'); r.raise_for_status()"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # ===========================================
  # pgAdmin 4 - Database Administration Tool
  # ===========================================
  # Activate with: docker compose --profile internal up pgadmin
  # Access at: http://localhost:5050
  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: callcenter-pgadmin
    restart: unless-stopped
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL:-admin@callcenter-ai.com}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD:-admin123}
      PGADMIN_CONFIG_SERVER_MODE: "True"
      PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: "False"
    ports:
      - "${PGADMIN_PORT:-5050}:80"
    volumes:
      - pgadmin_data:/var/lib/pgadmin
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - callcenter-network
    profiles:
      - internal

  # ===========================================
  # Directus - Visual Database Manager (Multi-tenant CMS)
  # ===========================================
  # Activate with: docker compose --profile internal up directus
  # Use this to create client-specific tables visually (carros, medico, etc.)
  # Each client gets a PostgreSQL schema with auto-generated REST/GraphQL API
  directus:
    image: directus/directus:11
    container_name: callcenter-directus
    restart: unless-stopped
    environment:
      # Security keys (generate with: openssl rand -hex 32)
      KEY: ${DIRECTUS_KEY:-replace-with-random-key}
      SECRET: ${DIRECTUS_SECRET:-replace-with-random-secret}
      # Admin credentials
      ADMIN_EMAIL: ${DIRECTUS_ADMIN_EMAIL:-admin@callcenter-ai.com}
      ADMIN_PASSWORD: ${DIRECTUS_ADMIN_PASSWORD:-admin123}
      # Database connection (same PostgreSQL as backend)
      DB_CLIENT: pg
      DB_HOST: postgres
      DB_PORT: 5432
      DB_DATABASE: ${POSTGRES_DB}
      DB_USER: ${POSTGRES_USER}
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      # Redis for caching (optional but recommended)
      # CACHE_ENABLED: "true"
      # CACHE_STORE: "redis"
      # REDIS_HOST: redis
      # Public URL
      PUBLIC_URL: ${DIRECTUS_PUBLIC_URL:-http://localhost:8055}
    ports:
      - "${DIRECTUS_PORT:-8055}:8055"
    volumes:
      - directus_uploads:/directus/uploads
      - directus_extensions:/directus/extensions
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - callcenter-network
    profiles:
      - internal

  # ===========================================
  # Landing Page (Vara-Alta Public Website)
  # ===========================================
  landing-page:
    build:
      context: ../Pagina_despliegue
      dockerfile: Dockerfile
    container_name: callcenter-landing-page
    restart: unless-stopped
    environment:
      - CHAT_BACKEND_URL=${LANDING_CHAT_BACKEND_URL:-http://localhost:8000}
    ports:
      - "${LANDING_PAGE_PORT:-3000}:80"
    networks:
      - callcenter-network

  # ===========================================
  # Admin Dashboard (Internal Only - Installers/Tech Team)
  # ===========================================
  # Activate with: docker compose --profile internal up admin-dashboard
  # This dashboard is for your team to configure deployments,
  # NOT for end clients. Never deploy this to client installations.
  admin-dashboard:
    build:
      context: ./services/admin-dashboard
      dockerfile: Dockerfile
    container_name: callcenter-admin-dashboard
    restart: unless-stopped
    environment:
      - VITE_API_URL=http://localhost:8000
      - VITE_ADMIN_MODE=true
    ports:
      - "${ADMIN_DASHBOARD_PORT:-3002}:3000"
    networks:
      - callcenter-network
    profiles:
      - internal

  # ===========================================
  # WireGuard VPN (for GSM Gateway connectivity)
  # ===========================================
  # Provides encrypted tunnel between this server and remote GSM gateways (GoIP/GMF).
  # The GoIP registers as SIP endpoint through the VPN tunnel.
  #
  # Setup:
  #   1. Place your wg0.conf in ./infra/wireguard/config/
  #   2. docker compose --profile vpn up wireguard -d
  #   3. Configure GoIP to connect to VPN peer IP
  #
  # Activate with: docker compose --profile vpn up wireguard -d
  # ===========================================
  wireguard:
    image: lscr.io/linuxserver/wireguard:latest
    container_name: callcenter-wireguard
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ:-America/Bogota}
    volumes:
      - ./infra/wireguard/config:/config
      - /lib/modules:/lib/modules:ro
    ports:
      - "${WG_PORT:-51820}:51820/udp"
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    networks:
      - callcenter-network
    profiles:
      - vpn

volumes:
  postgres_data:
  mariadb_data:
  asterisk_config:
  asterisk_logs:
  asterisk_spool:
  audio_preprocess_data:
  freepbx_data:
  freepbx_backup:
  license_data:
  backend_license_cache:
  distillation_data:
  cosyvoice_speakers:
  fish_checkpoints:
  pgadmin_data:
  directus_uploads:
  directus_extensions:
  redis_data:
  pgbackrest_repo:


networks:
  callcenter-network:
    driver: bridge