Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

2026-10-01 01:36:21 +02:00
commit cb5be898ea
@@ -0,0 +1,114 @@
+# SAFE TEMPLATE ONLY. Copy outside Git and replace every REPLACE_* value.
+# This file contains references and ordinary configuration, never credentials.
+
+# Operator-provided host paths and identity
+UNRAID_HOST=REPLACE_WITH_UNRAID_LAN_HOST_OR_IP
+APPDATA_ROOT=/srv/example/appdata/itworx-mcp-hub
+SECRETS_DIR=/srv/example/appdata/itworx-mcp-hub/secrets
+PROJECTS_READONLY_ROOT=/srv/example/appdata/itworx-mcp-hub/sources
+KNOWLEDGE_SOURCES_JSON=[{"project":"REPLACE_PROJECT","sourceRef":"repository","path":"REPLACE_RELATIVE_SOURCE_PATH","sourceType":"documentation","revision":"REPLACE_WITH_IMMUTABLE_COMMIT"}]
+BACKUP_ROOT=/srv/example/appdata/itworx-mcp-hub/backups
+PUID=REPLACE_WITH_NUMERIC_UID
+PGID=REPLACE_WITH_NUMERIC_GID
+DOCKER_SOCKET_GID=REPLACE_WITH_DOCKER_SOCKET_NUMERIC_GID
+
+# Operator-provided bind addresses and generated Compose ports
+HUB_BIND_IP=REPLACE_WITH_UNRAID_LAN_IP
+MCP_BIND_IP=REPLACE_WITH_UNRAID_LAN_IP
+HUB_PORT=1100
+MCP_PORT=18442
+INSPECTOR_BIND_IP=REPLACE_ONLY_IF_INSPECTOR_IS_ENABLED
+INSPECTOR_PORT=18443
+
+# Registry references. REGISTRY_CREDENTIAL_REF names an external credential
+# helper/login context; it is not a password.
+REGISTRY_HOST=REPLACE_WITH_REGISTRY_HOST
+REGISTRY_NAMESPACE=REPLACE_WITH_REGISTRY_NAMESPACE
+REGISTRY_CREDENTIAL_REF=REPLACE_WITH_OPERATOR_CREDENTIAL_REFERENCE
+
+# Immutable owned images: registry/path:tag@sha256:<64 lowercase hex>.
+HUB_CONTROL_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+HUB_WORKER_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+HUB_DATAPLANE_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+HUB_WEB_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+CONNECTOR_KNOWLEDGE_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+CONNECTOR_GITEA_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+CONNECTOR_UNRAID_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+CONNECTOR_PROJECTBRAIN_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+CONNECTOR_APPOPS_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+CONNECTOR_STITCH_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+DOCKER_READ_BROKER_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+OBSERVABILITY_COLLECTOR_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
+
+# Authentik/OIDC ordinary configuration. Secret values live only in
+# $SECRETS_DIR/authentik_oidc_client_secret and hub_session_signing_key.
+HUB_OIDC_ISSUER=https://REPLACE_WITH_AUTHENTIK_HOST/application/o/itworx/
+HUB_OIDC_AUDIENCE=itworx-mcp-hub
+HUB_OIDC_CLIENT_ID=REPLACE_WITH_AUTHENTIK_CLIENT_ID
+HUB_OIDC_REDIRECT_URI=https://REPLACE_WITH_MCP_HOST/auth/callback
+HUB_OIDC_ROLE_GROUP_MAP={"REPLACE_WITH_ADMIN_GROUP":"admin","REPLACE_WITH_OPERATOR_GROUP":"operator"}
+HUB_MCP_ADDITIONAL_OIDC_ISSUER=https://REPLACE_WITH_AUTHENTIK_HOST/application/o/chatgpt-itworx-gitea/
+HUB_MCP_ADDITIONAL_OIDC_AUDIENCE=chatgpt-itworx-gitea
+HUB_MCP_ADDITIONAL_OIDC_CLIENT_ID=chatgpt-itworx-gitea
+HUB_MCP_ADDITIONAL_OIDC_REDIRECT_URI=https://chatgpt.com/connector/oauth/REPLACE_WITH_CONNECTOR_ID
+HUB_PUBLIC_MCP_URL=https://REPLACE_WITH_MCP_HOST
+HUB_RATE_LIMIT_PER_MINUTE=600
+HUB_UPSTREAM_MAX_CONCURRENCY=24
+HUB_UPSTREAM_QUEUE_TIMEOUT_SECONDS=5
+AUTHENTIK_PROVIDER_ID=REPLACE_WITH_PROVIDER_ID
+AUTHENTIK_HUB_APPLICATION_ID=REPLACE_WITH_APPLICATION_ID
+AUTHENTIK_SCOPES=openid,profile,email,groups,offline_access
+AUTHENTIK_ALLOWED_GROUPS=REPLACE_WITH_COMMA_SEPARATED_GROUPS
+AUTHENTIK_SERVICE_ACCOUNTS=["REPLACE_WITH_SCOPED_SERVICE_ACCOUNT"]
+MCP_CLIENT_BINDINGS_JSON=[{"clientId":"REPLACE_WITH_UUID","subject":"REPLACE_WITH_OIDC_SUBJECT","project":"REPLACE_PROJECT","environment":"prod","enabled":true}]
+
+# ContextForge internal endpoint/configuration. Credentials and key material
+# live in the named files under SECRETS_DIR.
+HUB_CONTEXTFORGE_URL=http://contextforge-control:4444
+CONTEXTFORGE_DB_HOST=postgres
+CONTEXTFORGE_DB_NAME=contextforge
+CONTEXTFORGE_DB_USER=contextforge
+REDIS_AUTH_ENABLED=true
+
+# Existing Gitea; this deploys only the connector, never another Gitea server.
+GITEA_ENDPOINT=https://REPLACE_WITH_GITEA_HOST
+GITEA_REPOSITORIES_JSON=[{"project":"REPLACE_PROJECT","owner":"REPLACE_OWNER","name":"REPLACE_REPOSITORY"}]
+GITEA_ADDITIONAL_PROJECTS=gitea-loop
+GITEA_AUTO_DISCOVER_PROJECT=
+GITEA_WRITE_OWNER=
+GITEA_TOKEN_SCOPE=read:repository
+GITEA_WRITE_TOKEN_SCOPE=write:repository,write:issue
+GITEA_ENABLE_PR_WRITES=true
+
+# Existing ProjectBrain; the Hub uses a dedicated server-to-server secret file.
+PROJECTBRAIN_ENDPOINT=https://projectbrain.example.com
+PROJECTBRAIN_PROJECTS=gitea-all
+
+# Existing private AppOps MCP; the Hub reuses its dedicated MCP service token.
+APPOPS_ENDPOINT=http://198.18.10.150:1216
+APPOPS_PROJECTS=server-ops
+
+# Google Stitch remote MCP. The API key lives only in $SECRETS_DIR/stitch_api_key.
+STITCH_HUB_PROJECTS=stitch-design
+
+# Existing NPM and DNS inputs. NETWORK_TARGETS_JSON is checked only with the
+# explicit --verify-network-targets flag.
+#
+# Production uses a single public hostname (see
+# infrastructure/nginx-proxy-manager/ROUTING.md): one NPM proxy host and one
+# DNS record for REPLACE_WITH_MCP_HOST, routed by path (default location ->
+# web:8080, "/mcp" custom location -> dataplane-router:8080). The *_HUB_*
+# variables below are the management-surface half of that single-host
+# routing config, not a second host -- set them to the exact same hostname
+# value as the *_MCP_* variables. Never set a distinct hub.example.com value.
+NPM_NETWORK_NAME=REPLACE_WITH_EXISTING_NPM_NETWORK
+NPM_HUB_PROXY_HOST=REPLACE_WITH_MCP_HOST
+NPM_MCP_PROXY_HOST=REPLACE_WITH_MCP_HOST
+NPM_CERTIFICATE_REF=REPLACE_WITH_CERTIFICATE_REFERENCE
+DNS_HUB_HOSTNAME=REPLACE_WITH_MCP_HOST
+DNS_MCP_HOSTNAME=REPLACE_WITH_MCP_HOST
+DNS_EXPECTED_ADDRESSES_JSON={"REPLACE_WITH_MCP_HOST":["REPLACE_WITH_INGRESS_IP"]}
+NETWORK_TARGETS_JSON={"registry":"REPLACE_WITH_REGISTRY_HOST:443","gitea":"REPLACE_WITH_GITEA_HOST:443"}
+
+# Generated during deployment; do not hand-edit into credentials.
+UNRAID_REGISTRATIONS_FILE=/srv/example/appdata/itworx-mcp-hub/config/registered-targets.json