blueprint

Architecture

Self-hosted MCP server hosting on Docker Swarm, fronted by your edge Traefik. TLS terminates at the edge; the embedded Traefik speaks HTTP only inside the stack.

← Back to the user guide
SWARM INGRESS CUSTOMER NETWORK ROUNDHOUSE · DOCKER SWARM STACK (stack: roundhouse) overlay network: roundhouse_roundhouse-network MCP Clients & Browsers https://roundhouse… Upstream Traefik Reverse proxy TLS termination :443 → :80 Traefik v3.6 (embedded) entrypoint web :80 swarm + file providers routes by Host / path platform-api FastAPI control plane + SPA :8000 builds & runs MCP servers PostgreSQL 16 platform metadata vol: pgdata docker-socket-proxy traefik · read-only discovery only docker-socket-proxy api · scoped POST + BUILD Docker Engine Swarm manager node /var/run/docker.sock MCP server · github Swarm service (FastMCP) /s/github/mcp MCP server · jira Swarm service (FastMCP) /s/jira/mcp MCP server · … spawned on demand /s/{name}/mcp Swarm secrets mcp_app_key · mcp_admin_* · mcp_postgres_password Volumes pgdata · server-data HTTPS HTTP :80 shared public overlay net Host() && !/s/ → :8000 /s/{name}/mcp → MCP services discovers route labels Docker API: build / create / scale schedules & runs server tasks SQL
Request / data-plane traffic Control-plane (Docker API, service discovery) Database (SQL) request entry / app boundary

1Client → your edge

A browser or MCP client hits https://roundhouse.example.com. Your upstream Traefik terminates TLS at :443.

2Edge → embedded Traefik

Your edge forwards plain HTTP to the stack's embedded Traefik :80 across the shared public overlay network. No TLS inside the stack.

3UI / API routing

Embedded Traefik routes Host(…) && !PathPrefix(/s/) to platform-api:8000 — the SPA and control API.

4MCP traffic routing

Requests under /s/{name}/mcp route straight to the matching MCP server service, bypassing platform-api.

5Provisioning (control plane)

platform-api builds images and creates/scales MCP services through the scoped socket-proxy (POST+BUILD), never touching the raw socket.

6Discovery & state

Embedded Traefik discovers each MCP server via the read-only socket-proxy from its Traefik service labels; platform-api stores metadata in Postgres.