WeLe Agentic AI with Docker deployment

Dockerfile

@@ -0,0 +1,39 @@
+# ============================================
+# WeLe Agentic AI — production image
+#
+# Node service only. The voice service is deliberately NOT in this image: it
+# needs a CUDA GPU and several GB of RAM, and the target host has neither.
+# See DEPLOY.md.
+# ============================================
+
+FROM node:20-alpine AS deps
+WORKDIR /app
+COPY package*.json ./
+# `npm ci` builds exactly the lockfile, so a deploy can never silently pick up
+# a different dependency tree than the one that was tested.
+RUN npm ci --omit=dev
+
+FROM node:20-alpine
+WORKDIR /app
+
+# Run unprivileged. The base image already ships a `node` user.
+ENV NODE_ENV=production \
+    PORT=4000
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY package.json ./
+COPY src/ ./src/
+
+# Generated reports are written here. Owned by `node` so the unprivileged
+# process can write, and a volume is mounted over it in compose so files
+# survive a rebuild.
+RUN mkdir -p /app/storage/artifacts && chown -R node:node /app/storage
+
+USER node
+EXPOSE 4000
+
+# Compose owns restart policy; this is the in-container liveness signal.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||4000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["node", "src/server.js"]