# Coolify deployment

The repository runs as one Node.js process:

- static mm-skills registry at `/`;
- Streamable HTTP MCP at `/mcp`;
- liveness at `/healthz`;
- readiness at `/readyz`.

## Recommended Coolify application

Use the root `Dockerfile` build pack for deterministic production builds.

- Base directory: `/`
- Dockerfile location: `/Dockerfile`
- Port exposes: `3000`
- Health check path: `/healthz`
- Health check method: `GET`
- Expected status: `200`
- Force HTTPS: enabled
- Auto deploy: enabled only after branch protection and build checks are established

Nixpacks is also supported through `nixpacks.toml`, but the Dockerfile is the reference production path.

## Required variables

```text
NODE_ENV=production
PORT=3000
MM_SKILLS_PUBLIC_URL=https://<public-mm-skills-domain>
COOLIFY_BASE_URL=https://panel.meyermedia.eu/api/v1
COOLIFY_API_TOKEN=<team-scoped read token>
MCP_ACCESS_TOKEN=<independent random client token>
MCP_REQUIRE_AUTH=true
MCP_ALLOWED_HOSTS=<public-mm-skills-domain>
```

Set secrets as Coolify runtime environment variables, not build arguments and not repository files. Expose only `MM_SKILLS_PUBLIC_URL` to the build because the static registry embeds its canonical origin.

## Optional variables

```text
COOLIFY_OPENAPI_URL=https://raw.githubusercontent.com/coollabsio/coolify/v4.x/openapi.json
COOLIFY_MCP_TOOL_MODE=expanded
COOLIFY_SENSITIVE_TOKEN=<separate read plus read:sensitive token>
COOLIFY_MCP_ALLOW_SENSITIVE_READS=false
COOLIFY_MCP_FULL_READ=false
COOLIFY_MCP_ALLOW_DEPLOY=false
COOLIFY_MCP_ALLOW_WRITES=false
COOLIFY_MCP_ALLOW_DESTRUCTIVE=false
COOLIFY_MCP_ALLOW_ROOT=false
```

## Post-deployment verification

1. `GET /healthz` returns 200.
2. `GET /readyz` reports the OpenAPI operation count and upstream token presence.
3. An unauthenticated `POST /mcp` returns 401.
4. An authenticated MCP initialize request succeeds.
5. `coolify_api_status` shows the expected panel URL.
6. `coolify_infrastructure_snapshot` returns team resources with secret fields redacted.
7. All non-read gates remain false unless a reviewed use case requires otherwise.


## Capacity controls

The server limits MCP requests and concurrent upstream API calls by default:

```text
MCP_RATE_LIMIT_PER_MINUTE=120
COOLIFY_MAX_CONCURRENCY=8
```

Increase these only after checking the Coolify API rate limit and host capacity.