# Production deployment of the HTTP transport.
#
#   cp .env.example .env   # set GITEA_URL, MCP_BEARER_TOKEN and/or OAuth settings
#   docker compose up -d
#
# The container binds 0.0.0.0 internally; the server refuses to start unless
# authentication is configured, and the port is published on loopback only.
# Put a TLS reverse proxy in front of 127.0.0.1:8080 (and set PUBLIC_BASE_URL).
services:
  aegis-mcp:
    image: git.hiddenden.cafe/hiddenden/aegisgitea-mcp:${AEGIS_MCP_TAG:-latest}
    # To build locally instead of pulling the published image:
    # build:
    #   context: .
    #   dockerfile: docker/Dockerfile
    container_name: aegis-gitea-mcp
    restart: unless-stopped
    env_file:
      - .env
    environment:
      # Fixed by the image layout; do not override from .env.
      MCP_TRANSPORT: http
      MCP_HOST: 0.0.0.0
      MCP_PORT: "8080"
      DATA_DIR: /var/lib/aegis-mcp
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - aegis-mcp-data:/var/lib/aegis-mcp
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    user: "1000:1000"
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=5)"
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    # Optional: join an external reverse proxy network instead of publishing a
    # port. Uncomment this and the `networks:` block at the bottom, and drop
    # the `ports:` entry above.
    # networks:
    #   - proxy

volumes:
  aegis-mcp-data:

# networks:
#   proxy:
#     external: true