# Opt-in Streamable HTTP deployment: the MCP server behind nginx, on top of
# the base SearXNG stack. Run from the repo root:
#
#   docker compose -f docker-compose.yml -f docker-compose.http.yml up -d --build
#
# Endpoint: http://127.0.0.1:8443/mcp (Bearer token = $SEARXNG_AUTH_TOKEN).
# Loopback only — terminate TLS in front (Caddy/Traefik/cloud LB) for remote
# access and add the public hostname to SEARXNG_ALLOWED_HOSTS/_ORIGINS below.

services:
  mcp:
    build: .
    restart: unless-stopped
    # Inside the compose network the bind is non-localhost by necessity —
    # that is exactly the case the startup guard requires a token for.
    environment:
      - SEARXNG_URL=http://searxng:8080
      - SEARXNG_TRANSPORT=http
      - HOST=0.0.0.0
      - PORT=3000
      - SEARXNG_AUTH_TOKEN=${SEARXNG_AUTH_TOKEN:?set SEARXNG_AUTH_TOKEN in .env (openssl rand -hex 32)}
      # nginx forwards Host: mcp; the built-in localhost allowlist is not enough here.
      - SEARXNG_ALLOWED_HOSTS=mcp
    expose:
      - '3000'
    depends_on:
      - searxng

  proxy:
    image: docker.io/library/nginx:1.31-alpine
    restart: unless-stopped
    ports:
      - '127.0.0.1:8443:8443'
    volumes:
      - ./nginx/mcp-proxy.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      - mcp