Voice Agent Platform — Production Readiness Briefing

Decisions Needed

6 Strategic Decisions

Each decision unblocks a specific engineering track. Recommendations are provided — confirm or override via the input form.

1

Domain Name for Platform

Recommended: voice.noboxai.com — zero cost, immediate DNS, brand-consistent

Unblocks: Caddy reverse proxy, automatic TLS, professional demo URL

2

First Client Vertical

Recommended: Home services (HVAC, plumbing, electrical) — high call volume, simple routing, low compliance

Unblocks: Demo prompt template, marketing focus, first revenue

3

TTS Scaling Strategy

Recommended: Multi-container CPU — 3-4 Kokoro containers across CPU cores. 9–12 concurrent streams at $0 cost

Unblocks: Handling >3 simultaneous calls (current bottleneck)

4

Multi-Tenant Timing

Recommended: After first client — validate single-tenant works, build multi-tenant at 5+ clients

Avoids premature abstraction. Per-client env vars work for clients 1–5

5

Streaming STT Investment

Recommended: Defer until post-launch — 100-200ms improvement doesn’t change user experience categorically

Current 0.7–1.2s is competitive for bare-metal. Revisit with call data

6

HIPAA Timeline

Recommended: Only when healthcare prospect appears — significant investment (2–4 weeks + ongoing maintenance)

HIPAA is an add-on for healthcare clients, not the default platform posture

How Decisions Unlock Engineering

Loading diagram...

Act Now

3 Current Priorities

Zero external dependencies. Can execute immediately.

30m

Think-Tag Strip

Regex in agent.py

15m

Redis Password

requirepass + config update

1hr

Partial Firewall

UFW restrict inference ports

CP1: Think-Tag Stripping

⏱ 30 minutes 📁 agent/agent.py

Qwen3 emits empty <think>\n\n</think> tags even with /no_think. TTS ignores them but they appear in logs.

Add regex filter: re.sub(r'<think>.*?</think>', '', text, re.DOTALL)
Apply before text reaches TTS plugin
Test with short and long responses
Verify no impact on function calling output

CP2: Redis Password

⏱ 15 minutes 📁 docker-compose.yaml, .env, sip-config.yaml

Redis on port 6379 has no authentication. Exposed to internet via port forwarding.

Add REDIS_PASSWORD to .env
Update redis service: redis-server --requirepass $REDIS_PASSWORD
Update LiveKit Server env: add password to LIVEKIT_REDIS_ADDRESS
Update sip-config.yaml redis block
Test: inbound call still connects after change

CP3: Partial Firewall (UFW)

⏱ 1 hour ⚠️ Test SSH access before enabling

10 ports exposed to WAN that should be LAN-only. UFW can block them immediately — no domain or TLS needed.

Default deny incoming, allow outgoing
Allow SSH (22), SIP (5060), RTP (10000-20000), LiveKit (7880-7882)
Allow LAN (192.168.1.0/24) access to inference ports
Enable UFW and test immediately
Verify: SIP bridge on host network can still reach localhost services

Path to Production

Three Gates to Revenue

Gate 1 unlocks client demos. Gate 2 unlocks onboarding. Gate 3 unlocks multi-client scale.

Implementation Timeline

Loading diagram...

Gate 1

Demo-Ready

Security + domain + vertical prompt

Gate 2

Production-Ready

TTS scaling + full firewall

Gate 3

Scale-Ready

Multi-tenant + latency optimization

Phase Transition Gates

Gate Checklists

Each gate must clear before the next phase activates. Items map to Current Priorities (CP), Client Input (CI), and Deferred (D) items.

1

Demo-Ready

Unblocks first client pitch

CP1 Think-tags stripped from LLM output
CP2 Redis secured with password
CP3 UFW active, inference ports blocked from WAN
CI1 Domain name chosen
CI2 Target vertical chosen, demo prompt written
D1 Caddy + TLS live at chosen domain

2

Production-Ready

Unblocks client onboarding

Gate 1 All Gate 1 items cleared
CI3 TTS scaling strategy decided + implemented
D2 Full firewall with Twilio IP whitelist
First client signed and configured

3

Scale-Ready

Unblocks multi-client growth

Gate 2 All Gate 2 items cleared
CI4 Multi-tenant decision → D5 build
CI5 Streaming STT decision → D7 if yes
Sub-800ms latency target achieved

Deferred Priorities

8 Items Waiting on Gates

Each activates when its blocking dependency resolves. No premature engineering.

Item	Description	Blocked By	Activation Gate
D1	Caddy Reverse Proxy + TLS Automatic HTTPS via Let’s Encrypt. 2–4 hours.	CI1 Domain name	Domain purchased + DNS pointing to server
D2	Full Firewall Lockdown Twilio IP whitelist for SIP/RTP. 1–2 hours.	D1 Caddy running	Caddy proxies LiveKit WS, can restrict 7880-7882
D3	Inference Endpoint Auth API keys on vLLM, Whisper, TTS. Defense-in-depth.	CP3 Partial firewall	Firewall blocks WAN; auth adds second layer
D4	Rate Limiting Caddy `rate_limit` directive. DoS protection.	D1 Caddy	Caddy config deployed
D5	Multi-Tenant Architecture Number → config lookup via Redis/DB. 1–2 weeks.	CI4 Timing decision	5+ clients on single-tenant becomes painful
D6	HIPAA Compliance BAA, encrypted recording, audit logs. 2–4 weeks.	CI6 + D2	Healthcare prospect in pipeline + security hardened
D7	Streaming STT Partial transcripts. 100–200ms savings.	CI5 Investment decision	Post-launch call data shows STT is the bottleneck
D8	Sub-800ms Latency Target Competitive parity with Vapi (~465ms).	D7 Streaming STT	Streaming STT + TTS optimization combined

Reference

Architecture Quick Reference

Target Security Architecture (Post Gate 1)

Loading diagram...

VRAM Allocation — Default Voice Mode

Loading diagram...

Port Exposure — Current vs Target

Port	Service	Current	After Gate 1	After Gate 2
`22`	SSH	WAN	WAN	WAN
`443`	Caddy	—	WAN	WAN
`5060`	SIP	WAN	WAN	Twilio IPs
`7880-7882`	LiveKit	WAN	WAN	LAN only
`8000-8002`	vLLM	WAN	LAN only	LAN only
`8014-8015`	STT/TTS	WAN	LAN only	LAN only
`4000`	LiteLLM	WAN	LAN only	LAN only
`6379`	Redis	WAN	LAN only	LAN only
`10000-20000`	RTP	WAN	WAN	Twilio IPs

Performance Snapshot

0.7s

Best Case Latency

Short response, warm pipeline

1.2s

Typical Latency

30-word response

<800ms

Target

Requires streaming STT

465ms

Industry (Vapi)

Cloud GPUs + AssemblyAI

Twilio / LiveKit Resource IDs

Resource	ID
Twilio Account SID	`AC393a01f53432abcbd92641f0ae2ee333`
Twilio Trunk SID	`TK9106b20a407834aa9395b2b2a4d76d42`
Phone Number	+1 (833) 635-0426
LiveKit SIP Trunk	`ST_omB2qeoJoogX`
LiveKit Dispatch Rule	`SDR_D3n8UmoR4iQM`
Server LAN	192.168.1.76
Server WAN	75.27.237.219