Add Dockerfile, docker-compose stack, Kubernetes manifests, and CI workflow

[matmlazi]

What

Full container stack: multi-target Dockerfile (with upstream base selection), docker-compose for local dev, Kubernetes manifests under deploy/k8s/, and a GHA matrix build.

Upstream image analysis

Each service runs model sub-processes in separate per-model venvs via venv_python + runner.py. There is no upstream image that matches this subprocess pattern for whisperx, chatterbox, or m2m100. The one genuine upstream win is the orchestrator:

Service	Upstream image	Reason
orchestrator	beveradb/audio-separator	Ships audio-separator, ffmpeg, rubberband, torch, onnxruntime pre-installed — exactly what the orchestrator needs
asr	python:3.11-slim	whisperx runs in a subprocess venv; no matching upstream
translation	python:3.11-slim	m2m100/deep_translator; no matching upstream
tts	python:3.11-slim	chatterbox/edge-tts subprocess venvs; no matching upstream
frontend	nginx:1.27-alpine	Static HTML + reverse proxy

Dockerfile changes

Replaced the single ARG SERVICE pattern with named multi-stage targets:

base-orchestrator  (FROM beveradb/audio-separator)
base-default       (FROM python:3.11-slim)
  ├── final-asr          — installs asr service + whisperxModel venv
  ├── final-translation  — installs translation service + deepTranslation + m2m100 venvs
  ├── final-tts          — installs tts service + chatterboxModel + edgeTTsModel venvs
  └── final-orchestrator — installs orchestrator service only (heavy deps from base)

Model sub-venvs are now installed at build time (uv sync --frozen --project models/<X>) so they're baked into the image rather than built at first request.

Kubernetes manifests (deploy/k8s/)

namespace.yaml      — bluez-dubbing namespace
secret.yaml         — HF_TOKEN shape (populate with kubectl create secret)
pvc.yaml            — outs-pvc (RWX, 50Gi), uploads-pvc (RWX, 20Gi), model-cache-pvc (RWO, 100Gi)
asr.yaml            — Deployment + headless Service
translation.yaml    — Deployment + Service
tts.yaml            — Deployment + Service
orchestrator.yaml   — Deployment + Service (env: ASR_URL, TR_URL, TTS_URL → cluster DNS)
frontend.yaml       — Deployment + Service + commented Ingress stub
kustomization.yaml  — kustomize entry point

Apply:

kubectl create secret generic bluez-secrets -n bluez-dubbing --from-literal=HF_TOKEN=hf_...
kubectl apply -k deploy/k8s/

Other changes

• nginx: moved to port 8080 so the frontend container can run non-root (runAsUser: 101)
• frontend Dockerfile: USER nginx, port 8080, file ownership fixed
• GHA workflow: switched to --target final-<service> matrix; image tags use ghcr.io/codemowers/bluez-dubbing/<service>:<sha>

Risk / open items

• beveradb/audio-separator doesn't guarantee a stable tag — pin to a digest or a versioned tag before production.
• model-cache-pvc is ReadWriteOnce — if you scale any service to >1 replica you'll need ReadWriteMany or per-pod EmptyDir + model download init containers.
• Resource limits are estimates; tune after profiling actual GPU/CPU usage.
• The Ingress stub is commented out — fill in your hostname and TLS config.
• outs-pvc and uploads-pvc are ReadWriteMany; confirm your storage class supports it (NFS, CephFS, etc.) or switch to ReadWriteOnce with a single-replica orchestrator.