# Overlay for the dedicated VM. Use it on top of the base file:
#
#   docker compose --env-file .env -f mcp-stack.compose.yml -f mcp-stack.vm.compose.yml up -d --build
#
# The base file alone stays what it is: a stack bound to loopback on somebody's machine.
name: secure-mcp-stack

services:
  mcp-gateway:
    ports:
      # 80 and 443 on the VM's own address. Both, because automatic certificates need them: the
      # HTTP-01 challenge is answered on 80 and TLS-ALPN-01 on 443, and Caddy picks whichever the
      # CA offers. 80 also carries the redirect to HTTPS for anyone who types the bare host name.
      - "${MCP_BIND_ADDRESS:-0.0.0.0}:80:80"
      - "${MCP_BIND_ADDRESS:-0.0.0.0}:443:443"
      #
      # Nothing else is added: the base file's ports stay on loopback, which is where the same
      # servers without TLS in front of them belong.