# mcp-proxy — base (QA-posture) compose.
#   docker compose up --build        (make run)
# Runs the image with QA-posture env defaults (QA Auth0, QA apollo-mcp
# upstream, qa-mcp-proxy origin, AWS VPC resolver) — the image itself bakes in
# none of these; the ECS task definition supplies real values in every
# deployed environment. On a laptop these defaults can't fully work (no AWS
# resolver, wrong origin) — use docker-compose.local.yaml on top: make run-local.
services:
  mcp-proxy:
    build:
      context: .
      target: deploy
      args:
        - VERSION=local-dev
    ports:
      - "8080:8080"
    environment:
      AUTH0_DOMAIN: qa-orchard.auth0.com
      # Pins logins to the Sony-branded `sme` org
      # (auth0-hosted-pages/src/organizations/sme.json, org_5mm4hzk2PiTe4yc8 in
      # qa-orchard) instead of Orchard's default tenant branding — must be the
      # org_id (org_...), not its `name`, since qa-orchard doesn't have "Allow
      # Organization Names in Authentication API" enabled. Auth0 rejects a
      # malformed/missing value loudly ("organization must be an organization
      # id") rather than silently dropping the org context — verified locally.
      AUTH0_ORGANIZATION: org_HeC7B7QmKZq2mZoE
      MCP_UPSTREAM_HOST: qa-apollo-mcp.theorchard.io
      # MCP_UPSTREAM_SCHEME isn't set here — entrypoint.sh defaults it to
      # https, which is correct for every real upstream. Set it to http here
      # (or in docker-compose.local.yaml) only to front a plaintext
      # apollo-mcp container locally.
      # What the PRM / AS metadata / 401 challenge advertise — must be the
      # origin clients connect to.
      PROXY_ORIGIN: https://qa-mcp-proxy.theorchard.io
      # The public apollo-mcp-login client (no secret).
      APOLLO_MCP_CLIENT_ID: axdhcX5MLHiK2qgQPKwRiw44fwXTTYpa
      # Claude Desktop's native connector's own loopback path — a client-side
      # address (Desktop always runs on the user's own machine), so it's the
      # same regardless of which mcp-proxy backend it's pointed at. Distinct
      # from Claude Code/mcp-remote's localhost:8511/callback — see both
      # registered callbacks in
      # auth0-hosted-pages/src/clients/apollo-mcp-login.json.
      CLIENT_REDIRECT_URI: http://localhost:8511/oauth/callback
      # The AWS VPC DNS (Fargate/awsvpc); overridden for laptops in
      # docker-compose.local.yaml.
      RESOLVER: 169.254.169.253