flowchart TD
    subgraph Clients ["AI Clients & Agents"]
        Agent["Antigravity IDE / Cursor / Claude Desktop"]
    end

    subgraph Tunnel ["Cloudflare Zero Trust Ingress (mcp.thargy.com)"]
        T_Admin["https://mcp.thargy.com/gateway/mcp → Port :4000"]
        T_GH["https://mcp.thargy.com/gh/mcp → Port :4001"]
        T_CF["https://mcp.thargy.com/cf/mcp → Port :4002"]
        T_Dyn["https://mcp.thargy.com/<key>/mcp → Port :4007+"]
    end

    subgraph Host ["Docker Host @ 192.168.64.250"]
        subgraph Gateway ["mcp-gateway (Port Block 4000-4099)"]
            Admin["Port :4000: Management Plane (Bearer GATEWAY_ADMIN_TOKEN)<br/>• provision_mcp, update_mcp, deprovision_mcp<br/>• list_mcps, get_mcp_diagnostics<br/>• Plugin Tools (env, docker, cloudflare)"]
            S_GH["Port :4001: github-mcp-server (Wrapped Proxy)"]
            S_CF["Port :4002: cloudflare-mcp (Wrapped Proxy)"]
            S_Docker["Port :4003: docker-mcp (Tier-1 Passthrough)"]
            S_HA["Port :4004: homeassistant-mcp (Tier-1 Passthrough)"]
            S_Prox["Port :4005: proxmox-mcp (Tier-1 Passthrough)"]
            S_UniFi["Port :4006: unifi-mcp (Tier-1 Passthrough)"]
            S_Dyn["Port :4007+: Dynamic Provisioned Tool Listeners"]
        end
    end

    Agent --> Tunnel
    T_Admin --> Admin
    T_GH --> S_GH
    T_CF --> S_CF
    T_Dyn --> S_Dyn

gateway:
  adminPort: 4000
  adminToken: "${GATEWAY_ADMIN_TOKEN}"
  portRange:
    start: 4000
    end: 4099

  plugins:
    # 1. Environment & Parameterized Secret Generator Plugin
    env:
      enabled: true
      defaultGenerator: "crypto-256"
      envFile: ".env"

    # 2. Docker Container Orchestrator Plugin
    docker:
      enabled: true
      socketPath: "/var/run/docker.sock"
      defaultNetwork: "mcp-network"

    # 3. Cloudflare Zero Trust Ingress & Portal Plugin
    cloudflare:
      enabled: true
      accountId: "${CLOUDFLARE_ACCOUNT_ID}"
      apiToken: "${CLOUDFLARE_API_TOKEN}"
      tunnel:
        id: "${CLOUDFLARE_TUNNEL_ID}"
        hostname: "${CLOUDFLARE_TUNNEL_HOSTNAME}"
        originBaseUrl: "${GATEWAY_ORIGIN_BASE_URL}"
      portal:
        portalId: "${CLOUDFLARE_PORTAL_ID}"

servers:
  # Infrastructure Fleet (Centralized Ports 4001 - 4006)
  gh:
    type: http
    name: "github-mcp-server"
    port: 4001
    targetUrl: "http://github-mcp-backend:8082"
    wrappers:
      "${GH_MCP_TOKEN}":
        headers:
          Authorization: "Bearer ${GITHUB_PERSONAL_ACCESS_TOKEN}"

  cf:
    type: http
    name: "cloudflare-mcp"
    port: 4002
    targetUrl: "https://mcp.cloudflare.com/mcp"
    wrappers:
      "${CF_MCP_TOKEN}":
        headers:
          Authorization: "Bearer ${CLOUDFLARE_API_TOKEN}"
          X-Auth-Account-Id: "${CLOUDFLARE_ACCOUNT_ID}"

  docker:
    type: http
    name: "docker-mcp"
    port: 4003
    targetUrl: "http://docker-mcp-backend:3008"

  ha:
    type: http
    name: "homeassistant-mcp"
    port: 4004
    targetUrl: "http://homeassistant-mcp-backend:3000"

  proxmox:
    type: http
    name: "proxmox-mcp"
    port: 4005
    targetUrl: "http://proxmox-mcp-backend:3006"

  unifi:
    type: http
    name: "unifi-mcp"
    port: 4006
    targetUrl: "http://unifi-mcp-backend:3005"