Add Remote LAN Deployment - Parameterize Networking with .env vars to avoid hard coded hosts and ports

.env.example

@@ -27,15 +27,60 @@ SUPABASE_SERVICE_KEY=
 LOGFIRE_TOKEN=
 LOG_LEVEL=INFO
 
+
+
+###################################################################
+###################################################################
+###  LocalHost deployment
+###################################################################
+###################################################################
+# Phase 1 Parameterization Variables
+# HOST: Service host for service discovery in local development (default: localhost)
+HOST=localhost
+
+# BIND_IP: IP address to bind Docker ports to (empty = all interfaces, 127.0.0.1 = localhost only)
+# Leave empty for LAN access, set to 127.0.0.1 to restrict to localhost only
+BIND_IP=
+
+# CORS_ORIGINS: Comma-separated list of allowed CORS origins (default: http://localhost:3737)
+# Example for LAN: CORS_ORIGINS=http://localhost:3737,http://192.168.1.100:3737
+CORS_ORIGINS=http://localhost:3737
+
+# API_BASE_URL: Base URL for API service (default: http://localhost:8181)
+# Example for LAN: API_BASE_URL=http://192.168.1.100:8181
+API_BASE_URL=http://localhost:8181
+###################################################################
+###################################################################
+###  HomeLab/Lan deployment
+###################################################################
+###################################################################
+# Network binding - bind to all interfaces for LAN access
+#BIND_IP=0.0.0.0
+
+# Domain configuration for yourdomain.com   
+#HOST=archon.yourdomain.com
+
+# CORS - allow access from the domain
+#CORS_ORIGINS=https://archon.yourdomain.com
+
+# API base URL for internal service communication
+#API_BASE_URL=https://archon.yourdomain.com/api
+
 # Service Ports Configuration
 # These ports are used for external access to the services
-HOST=localhost
 ARCHON_SERVER_PORT=8181
 ARCHON_MCP_PORT=8051
 ARCHON_AGENTS_PORT=8052
 ARCHON_UI_PORT=3737
 ARCHON_DOCS_PORT=3838
 
+# MCP Configuration for local development
+# These are used by the frontend to connect to the MCP server
+VITE_MCP_HOST=localhost
+VITE_MCP_PROTOCOL=http
+VITE_MCP_USE_PROXY=false
+VITE_MCP_PORT=8051
+
 # Frontend Configuration
 # VITE_ALLOWED_HOSTS: Comma-separated list of additional hosts allowed for Vite dev server
 # Example: VITE_ALLOWED_HOSTS=192.168.1.100,myhost.local,example.com

.env.unified.lan

@@ -0,0 +1,64 @@
+# LAN/Production Configuration
+# Copy to .env for LAN deployment
+
+# ========================================
+# REQUIRED: Database Connection
+# ========================================
+SUPABASE_URL=your database link
+SUPABASE_SERVICE_KEY=Your Key 
+
+# ========================================
+# Deployment Mode: LAN/PRODUCTION
+# ========================================
+DEPLOYMENT_MODE=lan
+BUILD_TARGET=production
+NODE_ENV=production
+
+# ========================================
+# Network Configuration - UPDATE YOUR DOMAIN
+# ========================================
+HOST=archon.YourDomainName.com
+BIND_IP=0.0.0.0
+CORS_ORIGINS=https://archon.yourdomain.com
+API_BASE_URL=https://archon.yourdomain.com/api
+VITE_API_URL=https://archon.yourdomain.com
+
+# ========================================
+# MCP Configuration for LAN
+# ========================================
+VITE_MCP_HOST=archon.yourdomainname.com
+VITE_MCP_PROTOCOL=https
+VITE_MCP_USE_PROXY=true
+VITE_MCP_PORT=8051
+
+# ========================================
+# Service Ports (internal)
+# ========================================
+ARCHON_SERVER_PORT=8181
+ARCHON_MCP_PORT=8051
+ARCHON_AGENTS_PORT=8052
+ARCHON_UI_PORT=3737
+VITE_ARCHON_SERVER_PORT=
+
+# ========================================
+# Production Settings
+# ========================================
+DOCKER_SOCKET=/var/run/docker.sock
+PROD=true
+# Use prod profile for production without volume mounts
+COMPOSE_PROFILES=prod
+
+# ========================================
+# Network Configuration (LAN/Traefik)
+# ========================================
+# Use external Traefik proxy network
+PROXY_EXTERNAL=true
+PROXY_NETWORK=proxy
+
+# ========================================
+# Optional Features
+# ========================================
+AGENTS_ENABLED=false
+OPENAI_API_KEY=
+LOGFIRE_TOKEN=
+LOG_LEVEL=INFO

.env.unified.local

@@ -0,0 +1,92 @@
+# Local Development Configuration
+# Copy to .env for local development
+
+# ========================================
+# REQUIRED: Database Connection
+# ========================================
+# Get your SUPABASE_URL from the Data API section of your Supabase project settings -
+# https://supabase.com/dashboard/project/<your project ID>/settings/api
+#LOCAL
+#SUPABASE_URL=http://10.11.9.234:54321
+#WWW
+#SUPABASE_URL=https://supabase.com/dashboard/project/ywqhytytvsugasmbpdfa/settings/api
+#SUPABASE_URL=https://supabase.com/dashboard/project/ywqhytytvsugasmbpdfa/settings/api
+#http://127.0.0.1:54321
+#http://127.0.0.1:54321
+SUPABASE_URL=supabaseLink
+
+# ⚠️ CRITICAL: You MUST use the SERVICE ROLE key, NOT the Anon key! ⚠️
+# 
+# COMMON MISTAKE: Using the anon (public) key will cause ALL saves to fail with "permission denied"!
+#
+# How to get the CORRECT key:
+# 1. Go to: https://supabase.com/dashboard/project/<your project ID>/settings/api
+# 2. In the Settings menu, click on "API keys" 
+# 3. Find "Project API keys" section
+# 4. You will see TWO keys - choose carefully:
+#    ❌ anon (public): WRONG - This is shorter, starts with "eyJhbGc..." and contains "anon" in the JWT
+#    ✅ service_role (secret): CORRECT - This is longer and contains "service_role" in the JWT
+#
+# The service_role key is typically much longer than the anon key.
+# If you see errors like "Failed to save" or "Permission denied", you're using the wrong key!
+#
+# On the Supabase dashboard, it's labeled as "service_role" under "Project API keys"
+
+#www
+SUPABASE_SERVICE_KEY=supabaseKey
+
+
+# ========================================
+# Deployment Mode: LOCAL
+# ========================================
+DEPLOYMENT_MODE=local
+BUILD_TARGET=development
+NODE_ENV=development
+
+# ========================================
+# Network Configuration
+# ========================================
+HOST=localhost
+BIND_IP=127.0.0.1
+CORS_ORIGINS=http://localhost:3737
+API_BASE_URL=http://localhost:8181
+VITE_API_URL=http://localhost:8181
+
+# ========================================
+# MCP Configuration
+# ========================================
+VITE_MCP_HOST=localhost
+VITE_MCP_PROTOCOL=http
+VITE_MCP_USE_PROXY=false
+VITE_MCP_PORT=8051
+
+# ========================================
+# Service Ports
+# ========================================
+ARCHON_SERVER_PORT=8181
+ARCHON_MCP_PORT=8051
+ARCHON_AGENTS_PORT=8052
+ARCHON_UI_PORT=3737
+
+# ========================================
+# Development Features
+# ========================================
+DOCKER_SOCKET=/var/run/docker.sock
+PROD=false
+# Use dev profile for development with volume mounts
+COMPOSE_PROFILES=dev
+
+# ========================================
+# Network Configuration (Local)
+# ========================================
+# No external proxy network needed for local development
+PROXY_EXTERNAL=false
+PROXY_NETWORK=proxy-internal
+
+# ========================================
+# Optional Features
+# ========================================
+AGENTS_ENABLED=false
+OPENAI_API_KEY=
+LOGFIRE_TOKEN=
+LOG_LEVEL=INFO

.gitignore

@@ -5,6 +5,8 @@ __pycache__
 PRPs/local
 PRPs/completed/
 /logs/
+.bmad-core
+lan-migration-docs/
 .zed
 tmp/
 temp/

CLAUDE.md

@@ -294,7 +294,20 @@ async def handle_not_found(request, exc):
     )
 ```
 
+<<<<<<< HEAD
+### Important: Environment vs Database Settings
+
+**Critical**: The following settings MUST come from environment variables, NOT the database:
+- `HOST` - Server hostname/domain
+- `PORT` - Server port bindings
+- `BIND_IP` - Network binding interface
+
+These are deployment-specific and should never be loaded from the database settings table. The credential service has been updated to exclude these from database loading to prevent override issues in different deployment environments.
+
+## File Organization
+=======
 ## Polling Architecture
+>>>>>>> 192c45df1197600ef746a77903877a4172f393f2
 
 ### HTTP Polling (replaced Socket.IO)
 

README-LAN.md

@@ -0,0 +1,120 @@
+# Archon LAN Deployment
+
+Quick setup guide for deploying Archon on your LAN with Traefik proxy integration.
+
+## Quick Start
+
+### Prerequisites
+- Docker & Docker Compose installed on LAN server
+- Traefik proxy running with `proxy` network
+- DNS: `archon.yourDomain.com` → LAN server IP
+
+### Deploy
+```bash
+# Clone repository
+git clone <repo-url>
+cd Archon
+
+# Configure environment
+cp .env.unified.lan .env
+# Edit .env with your Supabase credentials
+
+# Deploy with unified configuration
+docker-compose -f docker-compose.unified.yml up -d
+
+# Access at: https://archon.yourDomain.com
+```
+
+## What This Gives You
+
+### 🌐 Production-Ready LAN Access
+- **HTTPS with SSL**: Automatic Let's Encrypt certificates via Traefik
+- **Domain Access**: `https://archon.yourDomain.com`
+- **Path Routing**: 
+  - Frontend at `/`
+  - API at `/api/*`
+  - MCP server at port 8051 (for AI IDE connections)
+- **Flexible Security**: Services exposed through configurable bind IPs
+
+### 🔒 Modern Architecture  
+- **Service Exposure**: All core services accessible:
+  - Frontend (3737)
+  - API Server (8181)
+  - MCP Server (8051) - For Claude, Cursor, Windsurf connections
+  - Agents Service (8052) - Optional, when enabled
+- **SSL Termination**: All external traffic encrypted via Traefik
+- **Service Discovery**: Containers communicate via internal Docker network
+- **Access Control**: Traefik handles routing and SSL certificates
+
+### 🚀 Unified Configuration
+- **Shared Environment Variables**: Both dev and LAN use same `.env` variables
+- **Default Localhost**: Development defaults to `BIND_IP=127.0.0.1` (localhost only)
+- **Easy LAN Access**: Set `BIND_IP=0.0.0.0` to expose services on LAN
+- **Same Configuration**: Unified approach across development and production
+
+## Architecture
+
+```
+Internet → Traefik Proxy → Docker Networks
+                        ├── archon-frontend:3737 (/)
+                        ├── archon-server:8181 (/api/*)  
+                        ├── archon-mcp:8051 (exposed for AI IDEs)
+                        └── archon-agents:8052 (optional, when enabled)
+```
+
+**Key Changes from Legacy Architecture:**
+- **MCP Server (8051) now exposed** for direct AI IDE connections (Claude, Cursor, Windsurf)
+- **All services accessible** through configurable `BIND_IP` setting
+- **Flexible deployment** supports both localhost-only and LAN-wide access
+
+## Files Overview
+
+| File | Purpose |
+|------|---------|
+| `docker-compose.yml` | Developer localhost deployment |
+| `docker-compose.unified.yml` | Unified deployment for LAN/production |  
+| `.env.unified.lan` | LAN environment configuration |
+| `.env.unified.local` | Local development configuration |
+| `traefik/` | Traefik reverse proxy configuration |
+
+## Key Differences: Dev vs LAN
+
+| Aspect | Developer | LAN Server |
+|--------|-----------|------------|
+| **Access** | `http://localhost:3737` | `https://archon.yourDomain.com` |
+| **Security** | HTTP, localhost only | HTTPS, LAN-wide access |  
+| **Network** | Local ports (127.0.0.1) | LAN-accessible ports (0.0.0.0) |
+| **SSL** | None | Let's Encrypt via Traefik |
+| **MCP Access** | `localhost:8051` | `yourDomain.com:8051` (for AI IDEs) |
+| **Command** | `docker-compose up` | `docker-compose -f docker-compose.unified.yml up -d` |
+
+## Configuration Notes
+
+### Environment Variables
+- **BIND_IP**: Controls service exposure
+  - `127.0.0.1` = localhost only (default)
+  - `0.0.0.0` = LAN-wide access
+  - Empty = all interfaces
+- **HOST**: Domain name for your deployment
+- **CORS_ORIGINS**: Frontend access permissions
+
+### MCP Server Access
+The MCP server (port 8051) is now exposed for AI IDE connections:
+- **Local**: `http://localhost:8051/mcp`
+- **LAN**: `http://your-server-ip:8051/mcp`
+- **Domain**: `https://archon.yourDomain.com:8051/mcp` (if SSL configured)
+
+## Next Steps
+
+1. **Environment Setup**: Copy and configure `.env.unified.lan`
+2. **Traefik Setup**: Configure reverse proxy using `traefik/` directory
+3. **DNS Configuration**: Point your domain to the server IP
+4. **Deploy**: Run `docker-compose -f docker-compose.unified.yml up -d`
+
+## Support
+
+For issues or questions:
+- Review Docker Compose logs: `docker-compose -f docker-compose.unified.yml logs -f`
+- Check service health: `docker-compose -f docker-compose.unified.yml ps`
+- Verify port accessibility and DNS resolution
+- Ensure Traefik proxy network exists