networks:
coolify:
external: true
services:
supabase-mcp:
image: silverstar3o7/supabase-mcp-http-stream-n8n:latest
container_name: supabase-mcp-server
restart: unless-stopped
networks:
- coolify
labels:
# Traefik configuration for Coolify
- traefik.enable=true
- traefik.http.routers.supabase-mcp.rule=Host(`${DOMAIN}`)
- traefik.http.routers.supabase-mcp.entrypoints=http,https
- traefik.http.routers.supabase-mcp.tls.certresolver=letsencrypt
- traefik.http.services.supabase-mcp.loadbalancer.server.port=3333
- coolify.managed=true
# No ports section needed - Traefik handles routing
environment:
# Required Supabase Configuration
- SUPABASE_ACCESS_TOKEN=${SUPABASE_ACCESS_TOKEN}
- SUPABASE_PROJECT_REF=${SUPABASE_PROJECT_REF}
# Optional: Feature groups to enable
- MCP_FEATURES=${MCP_FEATURES:-database,docs,development,functions}
# Optional: Read-only mode (true/false)
- MCP_READ_ONLY=${MCP_READ_ONLY:-true}
# Optional: Port for HTTP server
- MCP_PORT=${MCP_PORT:-3333}
# Optional: Node environment
- NODE_ENV=${NODE_ENV:-production}
# Security: API Keys for authentication (highly recommended)
- MCP_API_KEYS=${MCP_API_KEYS}
# Security: Stricter rate limiting to reduce bot traffic
- MCP_RATE_LIMIT_REQUESTS=${MCP_RATE_LIMIT_REQUESTS:-50}
- MCP_RATE_LIMIT_GENERAL=${MCP_RATE_LIMIT_GENERAL:-30}
# Security: CORS allowed origins (change from * to specific domains)
- MCP_ALLOWED_ORIGINS=${MCP_ALLOWED_ORIGINS:-*}
# Logging: Reduce verbose connection logs
- NODE_LOG_LEVEL=${NODE_LOG_LEVEL:-warn}
# Enable experimental webcrypto for SSE
- NODE_OPTIONS=--experimental-global-webcrypto
- EXPRESS_TRUST_PROXY=1
# Use HTTP server instead of STDIO - corrected to match Dockerfile
command: ["node", "mcp-http-server.js"]
healthcheck:
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3333/health", "||", "exit", "1"]
interval: 10s
timeout: 5s
retries: 2
start_period: 15s
# Resource limits to prevent abuse
deploy:
resources:
limits:
memory: 512M
cpus: '0.5'
reservations:
memory: 256M
cpus: '0.25'
# Security: Run as non-root user
user: "1001:1001"
# Logging configuration to reduce noise
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
