data "openstack_images_image_v2" "os" {
  name        = var.image_name
  most_recent = true
}

data "openstack_networking_network_v2" "external" {
  name = var.external_network
}

resource "aws_s3_bucket" "input" {
  bucket = var.input_bucket_name
}

resource "aws_s3_bucket_acl" "input" {
  bucket = aws_s3_bucket.input.id
  acl    = "private"
}

resource "aws_s3_bucket" "output" {
  bucket = var.output_bucket_name
}

resource "aws_s3_bucket_acl" "output" {
  bucket = aws_s3_bucket.output.id
  acl    = "private"
}


resource "openstack_networking_network_v2" "private" {
  name           = "${var.instance_name}-private"
  admin_state_up = true
}

resource "openstack_networking_subnet_v2" "private" {
  name            = "${var.instance_name}-private-sn"
  network_id      = openstack_networking_network_v2.private.id
  cidr            = var.private_cidr
  ip_version      = 4
  enable_dhcp     = true
  dns_nameservers = ["8.8.8.8", "8.8.4.4"]
}

resource "openstack_networking_router_v2" "router" {
  name                = "${var.instance_name}-router"
  external_network_id = data.openstack_networking_network_v2.external.id
  admin_state_up      = true
}

resource "openstack_networking_router_interface_v2" "private" {
  router_id = openstack_networking_router_v2.router.id
  subnet_id = openstack_networking_subnet_v2.private.id
}

resource "openstack_networking_secgroup_v2" "worker" {
  name        = "${var.instance_name}-sg"
  description = "SSH from admin CIDR only; worker is egress-only to Object Storage"
}

resource "openstack_networking_secgroup_rule_v2" "ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.worker.id
}

resource "openstack_networking_port_v2" "worker" {
  name               = "${var.instance_name}-port"
  network_id         = openstack_networking_network_v2.private.id
  security_group_ids = [openstack_networking_secgroup_v2.worker.id]

  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.private.id
  }

  depends_on = [openstack_networking_router_interface_v2.private]
}

resource "openstack_compute_instance_v2" "worker" {
  name        = var.instance_name
  flavor_name = var.worker_flavor
  key_pair    = var.key_name

  user_data = templatefile("${path.module}/cloud-init/worker.yaml", {
    s3_endpoint           = var.s3_endpoint
    s3_region             = var.s3_region
    s3_access_key         = var.s3_access_key
    s3_secret_key         = var.s3_secret_key
    input_bucket          = aws_s3_bucket.input.id
    output_bucket         = aws_s3_bucket.output.id
    webhook_url           = var.webhook_url
    enable_transcription  = var.enable_transcription ? "true" : "false"
    poll_interval_seconds = var.poll_interval_seconds
    target_lufs           = var.target_lufs
  })

  block_device {
    uuid                  = data.openstack_images_image_v2.os.id
    source_type           = "image"
    destination_type      = "volume"
    volume_size           = 40
    boot_index            = 0
    delete_on_termination = true
  }

  network {
    port = openstack_networking_port_v2.worker.id
  }
}

variable "key_name" {
  description = "Existing SSH keypair name in the project for compute instances"
  type        = string
}

variable "s3_access_key" {
  description = "EC2-compatible access key for Object Storage (Keystone ec2 credentials create)"
  type        = string
  sensitive   = true
}

variable "s3_secret_key" {
  description = "EC2-compatible secret key paired with s3_access_key"
  type        = string
  sensitive   = true
}

variable "input_bucket_name" {
  description = "S3 bucket name for raw audio uploads"
  type        = string
}

variable "output_bucket_name" {
  description = "S3 bucket name for mastered audio output"
  type        = string
}

variable "worker_flavor" {
  description = "Compute flavor for the FFmpeg worker (CPU-only)"
  type        = string
  default     = "c2a.large"
}

variable "image_name" {
  description = "Boot image name"
  type        = string
  default     = "Ubuntu-24.04"
}

variable "external_network" {
  description = "Shared external network for router gateway and floating IPs; defaults to PublicStatic (persisted FIP / production pattern). Override with PublicEphemeral for ephemeral demos."
  type        = string
  default     = "PublicStatic"
}

variable "private_cidr" {
  description = "Private subnet CIDR for the worker"
  type        = string
  default     = "192.168.70.0/24"
}

variable "instance_name" {
  description = "Worker instance display name"
  type        = string
  default     = "audio-worker"
}

variable "s3_endpoint" {
  description = "Quake AI S3-compatible endpoint URL"
  type        = string
  default     = "https://object.us-east-1.rumble.cloud"
}

variable "s3_region" {
  description = "S3 region identifier passed to the AWS provider"
  type        = string
  default     = "us-east-1"
}

variable "webhook_url" {
  description = "Optional HTTPS URL the worker POSTs to after each successful job (empty disables webhooks)"
  type        = string
  default     = ""
}

variable "enable_transcription" {
  description = "When true, run whisper.cpp and upload SRT/VTT alongside mastered audio"
  type        = bool
  default     = false
}

variable "poll_interval_seconds" {
  description = "Seconds between input-bucket polls"
  type        = number
  default     = 60
}

variable "target_lufs" {
  description = "Integrated loudness target for FFmpeg loudnorm (LUFS)"
  type        = number
  default     = -14
}

output "worker_instance_id" {
  description = "Nova instance ID for the audio worker"
  value       = openstack_compute_instance_v2.worker.id
}

output "worker_private_ip" {
  description = "Private IPv4 address of the worker (no floating IP allocated by default)"
  value       = openstack_compute_instance_v2.worker.network[0].fixed_ip_v4
}

output "input_bucket" {
  description = "Object Storage bucket for raw uploads"
  value       = aws_s3_bucket.input.id
}

output "output_bucket" {
  description = "Object Storage bucket for mastered audio"
  value       = aws_s3_bucket.output.id
}

output "floating_ip_count" {
  description = "Floating IPs this template allocates (zero by default; worker is egress-only)"
  value       = 0
}

terraform {
  required_version = ">= 1.6.0"

  required_providers {
    openstack = {
      source  = "terraform-provider-openstack/openstack"
      version = "~> 2.0"
    }
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "openstack" {}

provider "aws" {
  region                      = var.s3_region
  access_key                  = var.s3_access_key
  secret_key                  = var.s3_secret_key
  skip_credentials_validation = true
  skip_metadata_api_check     = true
  skip_requesting_account_id  = true

  endpoints {
    s3 = var.s3_endpoint
  }
}

#cloud-config
package_update: true
write_files:
  - path: /etc/audio-worker.env
    owner: root:root
    permissions: "0600"
    content: |
      AWS_ACCESS_KEY_ID=${s3_access_key}
      AWS_SECRET_ACCESS_KEY=${s3_secret_key}
      AWS_DEFAULT_REGION=${s3_region}
      AWS_ENDPOINT_URL_S3=${s3_endpoint}
      INPUT_BUCKET=${input_bucket}
      OUTPUT_BUCKET=${output_bucket}
      WEBHOOK_URL=${webhook_url}
      ENABLE_TRANSCRIPTION=${enable_transcription}
      POLL_INTERVAL=${poll_interval_seconds}
      TARGET_LUFS=${target_lufs}
  - path: /usr/local/bin/audio-worker.sh
    owner: root:root
    permissions: "0755"
    content: |
      #!/bin/bash
      set -euo pipefail
      source /etc/audio-worker.env
      WORK_DIR=/var/lib/audio-worker
      PROCESSED="$WORK_DIR/processed.keys"
      mkdir -p "$WORK_DIR"
      touch "$PROCESSED"
      while true; do
        mapfile -t keys < <(aws s3 ls "s3://$INPUT_BUCKET/" --recursive | awk '{print $4}' | grep -E '\.(wav|flac|mp3|m4a|aac|ogg)$' || true)
        for key in "$${keys[@]}"; do
          [ -z "$key" ] && continue
          grep -Fxq "$key" "$PROCESSED" && continue
          base=$(basename "$key")
          stem="$${base%.*}"
          infile="$WORK_DIR/in-$base"
          outfile="$WORK_DIR/out-$base"
          aws s3 cp "s3://$INPUT_BUCKET/$key" "$infile"
          ffmpeg -hide_banner -loglevel error -i "$infile" \
            -af "loudnorm=I=$TARGET_LUFS:TP=-1.5:LRA=11,afftdn=nf=-25" \
            -c:a libmp3lame -q:a 2 "$outfile"
          aws s3 cp "$outfile" "s3://$OUTPUT_BUCKET/$${stem}-master.mp3"
          if [ "$ENABLE_TRANSCRIPTION" = "true" ]; then
            whisper "$infile" --model tiny --output_format srt --output_dir "$WORK_DIR"
            aws s3 cp "$WORK_DIR/$${stem}.srt" "s3://$OUTPUT_BUCKET/$${stem}.srt" || true
          fi
          if [ -n "$WEBHOOK_URL" ]; then
            curl -fsS -X POST -H 'Content-Type: application/json' \
              -d "{\"source\":\"$key\",\"output\":\"$${stem}-master.mp3\"}" "$WEBHOOK_URL" || true
          fi
          echo "$key" >> "$PROCESSED"
          rm -f "$infile" "$outfile"
        done
        sleep "$POLL_INTERVAL"
      done
  - path: /etc/systemd/system/audio-worker.service
    owner: root:root
    permissions: "0644"
    content: |
      [Unit]
      Description=Audio post-production worker
      After=network-online.target
      Wants=network-online.target

      [Service]
      Type=simple
      EnvironmentFile=/etc/audio-worker.env
      ExecStart=/usr/local/bin/audio-worker.sh
      Restart=always
      RestartSec=10

      [Install]
      WantedBy=multi-user.target
runcmd:
  - |
    set -e
    export DEBIAN_FRONTEND=noninteractive
    apt-get update
    apt-get install -y ffmpeg curl python3-pip
    pip3 install --break-system-packages awscli
    if [ "${enable_transcription}" = "true" ]; then
      apt-get install -y whisper || pip3 install --break-system-packages openai-whisper
    fi
    systemctl daemon-reload
    systemctl enable audio-worker.service
    systemctl start audio-worker.service

# Audio post-production worker

CPU-only Compute worker that polls an Object Storage input bucket, loudness-normalizes audio with FFmpeg, writes mastered files to an output bucket, and optionally emits a webhook or whisper.cpp transcripts.


**Network class:** production — `external_network` defaults to `PublicStatic` for persisted floating IPs and multi-tier stacks; override with `PublicEphemeral` for ephemeral demos.

## Prerequisites

- OpenTofu >= 1.6.0 or Terraform >= 1.6.0
- Quake AI OpenStack credentials (`source openrc.sh`)
- EC2-compatible Object Storage credentials. See [Credential bootstrap](#credential-bootstrap)

## Honesty note

This template runs customer-owned scripts on a VM. Quake AI does not provide managed media processing or event delivery. The polling loop is a simple Object Storage list/copy pattern, not a managed queue service. No GPU is allocated.

## Credential bootstrap

Export EC2-compat credentials before `tofu plan`:

```bash
openstack ec2 credentials create
export AWS_ACCESS_KEY_ID=<access>
export AWS_SECRET_ACCESS_KEY=<secret>
export AWS_ENDPOINT_URL_S3=https://object.us-east-1.rumble.cloud
```

Pass the same access and secret values as `s3_access_key` and `s3_secret_key` in `terraform.tfvars` so cloud-init can configure the worker.

## Usage

1. Copy this directory
2. Copy `terraform.tfvars.example` to `terraform.tfvars` and fill in bucket names and credentials
3. `tofu init`
4. `tofu plan`
5. `tofu apply`

## Variables

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `key_name` | string | yes | n/a | Existing SSH keypair name in the project for compute instances |
| `s3_access_key` | string | yes | n/a | EC2-compat access key (sensitive) |
| `s3_secret_key` | string | yes | n/a | EC2-compat secret key (sensitive) |
| `input_bucket_name` | string | yes | n/a | Raw audio bucket |
| `output_bucket_name` | string | yes | n/a | Mastered output bucket |
| `worker_flavor` | string | no | `c2a.large` | CPU flavor for FFmpeg |
| `webhook_url` | string | no | `""` | Optional completion webhook |
| `enable_transcription` | bool | no | `false` | Optional whisper.cpp pass |
| `poll_interval_seconds` | number | no | `60` | Poll interval |
| `target_lufs` | number | no | `-14` | Loudness target |

## Floating IPs

This template allocates **0** floating IPs by default. The worker reaches Object Storage over egress through the private network router.

## Documentation

Full reference: [Audio worker template](/docs/automation/templates/audio-worker)

Tutorial: [Deploy the audio worker template](/resources/tutorials/deploy-audio-worker-template) (companion tutorial prompt `20260603-212111-tutorial-audio-worker`)