# =============================================================================
# AnythingMCP — quickstart (no clone, no build)
# =============================================================================
# The one file you need to try AnythingMCP on your own machine. It pulls the
# published image instead of building from source, so it works on its own:
#
#   curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
#   printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
#   docker compose up -d
#
# Then open http://localhost:3000 and register — the first account becomes
# admin. Keep the generated .env: ENCRYPTION_KEY is what decrypts the
# credentials you store, and losing it means re-entering every one of them.
#
# Scope: this is a LOCAL evaluation stack. Both ports are bound to 127.0.0.1
# and nothing here terminates TLS. For an instance other people or an AI client
# in the cloud can reach, clone the repo and run ./setup.sh, which configures a
# domain, HTTPS via Caddy, MCP auth mode and SMTP — see docs/deployment.md.
# =============================================================================

name: ${COMPOSE_PROJECT_NAME:-amcp}

services:
  app:
    image: helpcodeai/anythingmcp:latest
    # The published image is amd64 only (arm64 is blocked upstream by a Prisma
    # bug — see .github/workflows/docker-publish.yml). Pinning the platform
    # makes this file work on Apple Silicon too, through Docker Desktop's
    # emulation. Measured at 24 s to a healthy API on an M-series laptop; older
    # hardware emulating amd64 will be slower.
    platform: linux/amd64
    container_name: ${COMPOSE_PROJECT_NAME:-amcp}-app
    # Loopback only, and deliberately not configurable here: the quickstart has
    # no TLS and no reverse proxy in front of it.
    ports:
      - "127.0.0.1:${FRONTEND_PORT:-3000}:3000"
      - "127.0.0.1:${BACKEND_PORT:-4000}:4000"
    environment:
      - NODE_ENV=production
      - PORT=4000
      - NEXT_PUBLIC_API_URL=http://localhost:${BACKEND_PORT:-4000}
      - DATABASE_URL=postgresql://amcp:${POSTGRES_PASSWORD:-amcp}@postgres:5432/anythingmcp
      # Required. The app refuses to boot on a placeholder value, by design.
      - JWT_SECRET=${JWT_SECRET:?set JWT_SECRET in .env - openssl rand -hex 32}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY:?set ENCRYPTION_KEY in .env - openssl rand -hex 32}
      - CORS_ORIGIN=http://localhost:${FRONTEND_PORT:-3000}
      - SERVER_URL=http://localhost:${BACKEND_PORT:-4000}
      - FRONTEND_URL=http://localhost:${FRONTEND_PORT:-3000}
      # Anyone who can reach the port still needs an MCP credential.
      - MCP_AUTH_MODE=legacy
      - MCP_ALLOW_ANONYMOUS=false
      # Invite-only after the first admin registers.
      - ALLOW_OPEN_REGISTRATION=false
      # Optional email (SMTP) for verification codes and invitations: add the
      # values to .env. Empty SMTP_HOST = no instance-wide mail.
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-}
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASS=${SMTP_PASS:-}
      - SMTP_FROM=${SMTP_FROM:-}
      - SMTP_FROM_NAME=${SMTP_FROM_NAME:-}
      - SMTP_REPLY_TO=${SMTP_REPLY_TO:-}
      - SMTP_SECURE=${SMTP_SECURE:-}
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:4000/health"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 20s
    restart: unless-stopped

  postgres:
    image: postgres:17-alpine
    container_name: ${COMPOSE_PROJECT_NAME:-amcp}-postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=amcp
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-amcp}
      - POSTGRES_DB=anythingmcp
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U amcp -d anythingmcp"]
      interval: 3s
      timeout: 3s
      retries: 10
    restart: unless-stopped

volumes:
  postgres_data: