Deployment

Production Build

pnpm build
pnpm start

The build uses next build --webpack and generates Fumadocs source files before building. It also bundles the optional MCP companion to dist/mcp/corey-mcp.cjs.

Docker

Build the runner image:

docker build --target runner -t corey:local .

Run the image with backend environment variables:

docker run --rm -p 4000:4000 \
  -e DATABASE_URL="postgresql://corey:corey@host.docker.internal:5432/corey?schema=public" \
  -e S3_ENDPOINT="http://host.docker.internal:9000" \
  -e S3_REGION="ap-southeast-1" \
  -e S3_ACCESS_KEY="corey" \
  -e S3_SECRET_KEY="corey-secret" \
  -e S3_BUCKET="corey-models" \
  corey:local

For a local-first deployment without server model storage, provide DATABASE_URL only. /api/health will still return status: "ok" with modelStorageAvailable: false; the viewer continues to load local IFC files from the browser, while server-backed upload/download is disabled.

Docker Compose

For the app plus local Postgres and MinIO:

docker compose --env-file .env -f docker/docker-compose.deploy.yml up --build

The app healthcheck calls /api/health.

Optional MCP service

Set COREY_MCP_BRIDGE_URL, a shared 32+ character COREY_MCP_BRIDGE_SECRET, COREY_MCP_ALLOWED_ORIGINS, COREY_MCP_PUBLIC_URL, COREY_APP_PUBLIC_URL, and the administrator IDs in COREY_MCP_ADMIN_USERS. Then start the optional Compose profile:

docker compose --env-file .env -f docker/docker-compose.deploy.yml \
  --profile mcp up --build

The MCP endpoint is /mcp on port 4001; connected browser tabs use /bridge. After deployment, an administrator enables MCP and generates the show-once API key from the MCP dialog in COREY. Claude web/Desktop discovers the companion's OAuth endpoints automatically. Public deployments must route both through TLS and must not expose the internal COREY user header or COREY_MCP_INTERNAL_URL to untrusted clients.

When a reverse proxy adds X-Forwarded-For, set COREY_MCP_TRUST_PROXY to the exact number of proxy hops between the public client and the MCP service, or to the trusted proxy address/subnet. Leave it unset for direct local access.

Railway MCP image

The official Railway template provides the COREY app, PostgreSQL, and model storage. Add MCP as a separate Docker Image service named MCP, and pin both runtime services to the same release version:

COREY  ghcr.io/jhjhjhjh/corey:0.1.0
MCP    ghcr.io/jhjhjhjh/corey-mcp:0.1.0

Set the MCP service port to 4001, generate a public domain targeting that port, and configure /health as its healthcheck. Configure the COREY service with port 4000, healthcheck /api/health, and pre-deploy command npx prisma migrate deploy.

Create a shared, randomly generated COREY_MCP_BRIDGE_SECRET of at least 32 characters and expose it to both services. With the template service names COREY and MCP, configure the MCP service:

PORT=4001
COREY_MCP_PORT=4001
COREY_MCP_BIND=::
COREY_MCP_TRUST_PROXY=1
COREY_BASE_URL=http://${{COREY.RAILWAY_PRIVATE_DOMAIN}}:4000
COREY_MCP_BRIDGE_SECRET=${{shared.COREY_MCP_BRIDGE_SECRET}}
COREY_MCP_ALLOWED_ORIGINS=https://${{COREY.RAILWAY_PUBLIC_DOMAIN}}
COREY_MCP_PUBLIC_URL=https://${{MCP.RAILWAY_PUBLIC_DOMAIN}}/mcp
COREY_APP_PUBLIC_URL=https://${{COREY.RAILWAY_PUBLIC_DOMAIN}}
COREY_USER_HEADER=x-forwarded-user
COREY_MCP_INDEX_CACHE_ENTRIES=3

Then add these variables to the COREY service:

PORT=4000
HOSTNAME=::
COREY_MCP_BRIDGE_URL=wss://${{MCP.RAILWAY_PUBLIC_DOMAIN}}/bridge
COREY_MCP_BRIDGE_SECRET=${{shared.COREY_MCP_BRIDGE_SECRET}}
COREY_MCP_PUBLIC_URL=https://${{MCP.RAILWAY_PUBLIC_DOMAIN}}/mcp
COREY_APP_PUBLIC_URL=https://${{COREY.RAILWAY_PUBLIC_DOMAIN}}
COREY_MCP_INTERNAL_URL=http://${{MCP.RAILWAY_PRIVATE_DOMAIN}}:4001
COREY_MCP_ADMIN_USERS=local

After both services deploy, verify https://<mcp-domain>/health, open the MCP dialog in COREY, enable access, and generate the show-once API key. The public GHCR image contains no deployment credentials; keep all secrets in Railway variables.

Release Checklist

pnpm verify
pnpm mcp:test
docker compose --env-file .env -f docker/docker-compose.deploy.yml build app mcp

Version tags publish matching corey and corey-mcp GHCR images through the release workflow.