Kairos Codex MCP Server

version: '3.8' services: kairos-codex-mcp: build: . env_file: - .env restart: unless-stopped networks: - frontend # Internet access for bible.helloao.org API + public Traefik routing - bible-mcp labels: - "traefik.enable=true" - "traefik.http.services.bible-mcp.loadbalancer.server.port=8000" - "traefik.http.routers.bible-mcp.service=bible-mcp" - "traefik.http.routers.bible-mcp.rule=Host(`bible-mcp.jbatson.dev`)" - "traefik.http.routers.bible-mcp.tls=true" - "traefik.http.routers.bible-mcp.tls.certresolver=letsencrypt" - "traefik.http.routers.bible-mcp.entrypoints=websecure" - "traefik.docker.network=bible-mcp" # Required for proper routing networks: # ═══════════════════════════════════════════════════════════════════════════════════ # PUBLIC INTERNET-FACING SERVICE PATTERN # ═══════════════════════════════════════════════════════════════════════════════════ # # frontend: Public service accessible without mTLS (for external web apps) # - Allows internet access for bible.helloao.org API calls # - Provides public HTTPS access for Vercel/external applications # - Uses token-based authentication instead of mTLS # # ⚠️ SECURITY: This service is publicly accessible - relies on token auth # # ═══════════════════════════════════════════════════════════════════════════════════ frontend: external: true # Pre-created internet-facing network # internal: false (default) - ALLOWS INTERNET ACCESS bible-mcp: external: true internal: true