docker-compose.yml

services:
  syncro-mcp:
    # Defaults to :latest so Watchtower (or equivalent) can auto-update the
    # running container as new releases are published. The release workflow
    # publishes both :v<version> and :latest pointing at the same digest, so
    # operators who want stricter supply-chain control can pin to a specific
    # tag (e.g. :v1.6.1) and update deliberately.
    image: ghcr.io/advenimus/syncromsp-mcp:latest
    # To build locally instead: comment out 'image' above and uncomment:
    # build: .
    container_name: syncromsp-mcp
    restart: unless-stopped
    # Bound to loopback only. The reverse proxy (Caddy/Traefik) on the host
    # forwards :443 → 127.0.0.1:8080. The container is NOT directly reachable
    # from the internet. If your reverse proxy is on a different host or
    # network, change the bind address accordingly AFTER reading the security
    # implications in SECURITY.md.
    ports:
      - "127.0.0.1:${MCP_PORT:-8080}:8080"
    environment:
      - SYNCRO_API_KEY=${SYNCRO_API_KEY}
      - SYNCRO_SUBDOMAIN=${SYNCRO_SUBDOMAIN}
      - MCP_TRANSPORT=http
      - MCP_PORT=8080
      - MCP_BASE_URL=${MCP_BASE_URL:-http://localhost:8080}
      - MCP_AUTH=${MCP_AUTH:-true}
      - MCP_AUTH_SECRET=${MCP_AUTH_SECRET}
      - MCP_TOOL_MODE=${MCP_TOOL_MODE:-flat}
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:size=10m,mode=1777
    # Optional but recommended if your platform supports it:
    # deploy:
    #   resources:
    #     limits:
    #       memory: 512M
    #       cpus: "0.5"