# Deploying to AWS

Target: `ubuntu@52.66.12.133`, Ubuntu 24.04, Docker 29.7.2 / Compose v5.4.0.

The service runs **alongside** the existing CRM stack, attaching to its network
so it can reach `redis` and `whatsapp-api` by name. It does not modify the CRM.

> **Do not clone into `/opt/wele/whatsapp-crm`.** That directory is the live
> CRM's own git repo — cloning over it would destroy the running deployment.
> This project gets its own directory next to it.

## What is *not* deployed

`voice-service/` stays off this host. It needs a CUDA GPU and ~5 GB of RAM;
the instance has **no GPU, 2 vCPU and 3.7 GB total** (~2.3 GB free with the CRM
running). Attempting it would OOM the box and take the CRM down with it.

Voice needs a GPU instance (e.g. `g4dn.xlarge`) before it can be deployed.

## First deploy

```bash
ssh -i wele-product-aws.pem ubuntu@52.66.12.133

sudo mkdir -p /opt/wele/agentic-ai && sudo chown ubuntu:ubuntu /opt/wele/agentic-ai
git clone https://gitea.wele.in/Thulasiraman/Agentic-AI.git /opt/wele/agentic-ai
cd /opt/wele/agentic-ai

cp .env.example .env
nano .env          # fill in the values in the table below

sudo docker compose up --build -d
sudo docker compose logs -f agentic-ai
```

### Required in `.env`

| Variable | Value |
|---|---|
| `MONGODB_URI` | same connection string the CRM uses |
| `CRM_JWT_SECRET` | **must equal** the CRM's `JWT_SECRET`, or every login is rejected here |
| `GMI_API_KEY` | GMI Cloud key |
| `OPENROUTER_API_KEY` | OpenRouter key (failover) |
| `PUBLIC_BASE_URL` | `https://crm.wele.in` — used in artifact download links |

`REDIS_*` and `CRM_API_BASE` are set by compose and should be left alone.

Compose fails fast with a named error if `MONGODB_URI` or `CRM_JWT_SECRET` is
missing, rather than starting a container that cannot authenticate anyone.

## Updating

```bash
cd /opt/wele/agentic-ai
git pull origin main
sudo docker compose up --build -d
```

## Verify

```bash
curl -s localhost:4000/health | jq
```

Expect `mongo: connected`, `redis: redis`, `crm_api: reachable`, and the model
chains. `redis: memory` means it fell back to an in-process store — check that
the container really joined `whatsapp-crm_default`.

## Frontend

The chat UI lives in the **CRM** repo (`frontend/src/pages/AIAssistant.jsx`),
so it deploys with the CRM, not with this service. It needs to know where this
service is:

```bash
# in the CRM repo, frontend/.env.production
VITE_AGENT_URL=https://crm.wele.in/agent
```

Then add a reverse-proxy rule so that path reaches port 4000. Nginx:

```nginx
location /agent/ {
    proxy_pass http://127.0.0.1:4000/;
    proxy_http_version 1.1;

    # Required for SSE streaming and the voice WebSocket.
    proxy_set_header Upgrade    $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host       $host;
    proxy_buffering off;
    proxy_read_timeout 300s;   # a turn can take 45s; the default 60s is too tight
}
```

`proxy_buffering off` matters — with it on, nginx holds the SSE stream and the
UI shows nothing until the turn finishes, which looks like a hang.

## Ports

| Port | Service | Published |
|---|---|---|
| 3000 | CRM (`wele-whatsapp-api`) | yes |
| 4000 | **this service** | yes |
| 4000 | CRM `chat-service` | no — container-internal only, so no clash |
| 6379 | Redis (shared) | yes |
| 19530 | Milvus | yes |

## Resource notes

The container is capped at **768 MB**. On a 3.7 GB box already running the CRM,
chat-service, Redis and Milvus, an uncapped Node process having a bad turn can
starve the CRM. Raise it only if you see OOM kills:

```bash
sudo docker inspect wele-agentic-ai --format '{{.State.OOMKilled}}'
```

## Rollback

```bash
cd /opt/wele/agentic-ai
git log --oneline -5
git checkout <previous-sha>
sudo docker compose up --build -d
```

The CRM is a separate stack and is unaffected by anything here.