Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020
This commit is contained in:
Public Source Publisher committed
commit
cb5be898ea
663 files changed
+82674
No files matched your search
@@ -0,0 +1,528 @@
|
||||
name: itworx-mcp-hub
|
||||
|
||||
x-owned-service: &owned-service
|
||||
restart: unless-stopped
|
||||
read_only: true
|
||||
cap_drop: ["ALL"]
|
||||
security_opt: ["no-new-privileges:true"]
|
||||
tmpfs: ["/tmp:size=64m,mode=1777"]
|
||||
pids_limit: 128
|
||||
mem_limit: 512m
|
||||
cpus: 1.0
|
||||
logging:
|
||||
driver: json-file
|
||||
options: {max-size: "10m", max-file: "3"}
|
||||
healthcheck:
|
||||
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)"]
|
||||
interval: 60s
|
||||
timeout: 3s
|
||||
retries: 5
|
||||
start_period: 10s
|
||||
|
||||
x-third-party: &third-party
|
||||
restart: unless-stopped
|
||||
security_opt: ["no-new-privileges:true"]
|
||||
logging:
|
||||
driver: json-file
|
||||
options: {max-size: "10m", max-file: "3"}
|
||||
|
||||
services:
|
||||
postgres:
|
||||
<<: *third-party
|
||||
image: postgres:18.4@sha256:3a82e1f56c8f0f5616a11103ac3d47e632c3938698946a7ad26da0df1334744a
|
||||
entrypoint: ["sh", "/opt/itworx/postgres-entrypoint.sh"]
|
||||
command: ["postgres"]
|
||||
environment:
|
||||
POSTGRES_USER: postgres
|
||||
POSTGRES_PASSWORD_FILE: /run/secrets/postgres_superuser_password
|
||||
PGDATA: /var/lib/postgresql/data/pgdata
|
||||
SECRET_EXPECTED_UID: "${PUID:-1000}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-1000}"
|
||||
secrets: [postgres_superuser_password, hub_database_password, contextforge_database_password]
|
||||
volumes:
|
||||
- postgres-data:/var/lib/postgresql/data
|
||||
- ../postgres/init:/docker-entrypoint-initdb.d:ro
|
||||
- ../images/postgres/entrypoint.sh:/opt/itworx/postgres-entrypoint.sh:ro
|
||||
tmpfs: ["/run/itworx-secrets:size=1m,mode=0700"]
|
||||
networks: [hub-data]
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
|
||||
interval: 15s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
redis:
|
||||
<<: *third-party
|
||||
image: redis:8.10.0@sha256:c29e49ab2f85760a3827b53882e6dd9f5c6c3f0bb7d724e07bb31cbf275a5236
|
||||
entrypoint: ["sh", "/opt/itworx/redis-entrypoint.sh"]
|
||||
environment:
|
||||
REDIS_AUTH_ENABLED: "${REDIS_AUTH_ENABLED:-false}"
|
||||
SECRET_EXPECTED_UID: "${PUID:-1000}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-1000}"
|
||||
volumes:
|
||||
- ../images/redis/entrypoint.sh:/opt/itworx/redis-entrypoint.sh:ro
|
||||
- ../images/redis/healthcheck.sh:/opt/itworx/redis-healthcheck.sh:ro
|
||||
secrets: [redis_password]
|
||||
tmpfs: ["/run/itworx:size=1m,mode=0700"]
|
||||
networks: [hub-data]
|
||||
healthcheck:
|
||||
test: ["CMD", "sh", "/opt/itworx/redis-healthcheck.sh"]
|
||||
interval: 15s
|
||||
timeout: 3s
|
||||
retries: 5
|
||||
|
||||
contextforge:
|
||||
<<: *third-party
|
||||
image: ghcr.io/ibm/mcp-context-forge:v1.0.6@sha256:049b8e61fa1187f72773d94bcf91fc63338f4fea7808949a8a5daacbc89ef92e
|
||||
user: "${PUID:-1000}:${PGID:-1000}"
|
||||
entrypoint: ["sh", "/opt/itworx/contextforge-entrypoint.sh"]
|
||||
environment:
|
||||
HOST: 0.0.0.0
|
||||
PORT: 4444
|
||||
AUTH_REQUIRED: "true"
|
||||
MCPGATEWAY_UI_ENABLED: "false"
|
||||
MCPGATEWAY_ADMIN_API_ENABLED: "false"
|
||||
MCPGATEWAY_MCP_APPS_ENABLED: "true"
|
||||
ENABLE_HEADER_PASSTHROUGH: "true"
|
||||
API_ALLOW_BASIC_AUTH: "false"
|
||||
PLATFORM_ADMIN_EMAIL: "${CONTEXTFORGE_PLATFORM_ADMIN_EMAIL:-contextforge-admin@example.com}"
|
||||
SSRF_PROTECTION_ENABLED: "true"
|
||||
SSRF_ALLOW_PRIVATE_NETWORKS: "false"
|
||||
SSRF_DNS_FAIL_CLOSED: "true"
|
||||
SSRF_ALLOWED_NETWORKS: '["203.0.113.0/24"]'
|
||||
UAID_ALLOWED_DOMAINS: '["example.com"]'
|
||||
GUNICORN_WORKERS: "2"
|
||||
# ContextForge only receives authenticated internal Hub traffic. Its
|
||||
# generic limiter groups every caller behind the router's single IP and
|
||||
# can lock out all ChatGPT sessions at once. Admission control therefore
|
||||
# belongs to the public dataplane router below.
|
||||
RATE_LIMITING_ENABLED: "false"
|
||||
REDIS_AUTH_ENABLED: "${REDIS_AUTH_ENABLED:-false}"
|
||||
SECRET_EXPECTED_UID: "${PUID:-1000}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-1000}"
|
||||
volumes:
|
||||
- ../images/contextforge/entrypoint.sh:/opt/itworx/contextforge-entrypoint.sh:ro
|
||||
secrets: [contextforge_database_password, contextforge_auth_encryption_secret, contextforge_jwt_secret, contextforge_admin_credential, redis_password]
|
||||
depends_on:
|
||||
postgres: {condition: service_healthy}
|
||||
redis: {condition: service_healthy}
|
||||
networks:
|
||||
hub-control:
|
||||
aliases: [contextforge-control]
|
||||
hub-connectors: {}
|
||||
hub-data: {}
|
||||
hub-observe: {}
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:4444/health', timeout=3)\""]
|
||||
interval: 60s
|
||||
timeout: 10s
|
||||
retries: 5
|
||||
start_period: 120s
|
||||
|
||||
control-api:
|
||||
<<: *owned-service
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: control-api}}
|
||||
image: local/itworx-mcp-hub-control:dev
|
||||
environment:
|
||||
HUB_OIDC_ISSUER: "${HUB_OIDC_ISSUER:-https://auth.dev.invalid/application/o/itworx/}"
|
||||
HUB_OIDC_AUDIENCE: "${HUB_OIDC_AUDIENCE:-itworx-mcp-hub}"
|
||||
HUB_OIDC_CLIENT_ID: "${HUB_OIDC_CLIENT_ID:-itworx-mcp-hub-dev}"
|
||||
HUB_OIDC_REDIRECT_URI: "${HUB_OIDC_REDIRECT_URI:-https://hub.dev.invalid/auth/callback}"
|
||||
HUB_OIDC_CLIENT_SECRET_FILE: /run/secrets/authentik_oidc_client_secret
|
||||
HUB_OIDC_ROLE_GROUP_MAP: '${HUB_OIDC_ROLE_GROUP_MAP:-{"hub-admin":"admin"}}'
|
||||
HUB_SESSION_SIGNING_KEY_FILE: /run/secrets/hub_session_signing_key
|
||||
HUB_CONTEXTFORGE_URL: "${HUB_CONTEXTFORGE_URL:-http://contextforge-control:4444}"
|
||||
HUB_CONTEXTFORGE_TOKEN_FILE: /run/secrets/contextforge_api_token
|
||||
HUB_CONTEXTFORGE_AUTH_SCHEME: Bearer
|
||||
HUB_DATABASE_PASSWORD_FILE: /run/secrets/hub_database_password
|
||||
HUB_DATABASE_HOST: postgres
|
||||
HUB_DATABASE_NAME: itworx_mcp_hub
|
||||
HUB_DATABASE_USER: itworx_mcp_hub
|
||||
HUB_CATALOG_ROOT: /opt/hub/catalog
|
||||
INGESTION_CONNECTOR_ENABLED: "${INGESTION_CONNECTOR_ENABLED:-false}"
|
||||
HUB_PUBLIC_MCP_URL: "${HUB_PUBLIC_MCP_URL:-https://mcp.example.com}"
|
||||
HUB_BACKUP_STATUS_FILE: /var/lib/itworx/backup-status.json
|
||||
HUB_BACKUP_STALE_AFTER_HOURS: "${HUB_BACKUP_STALE_AFTER_HOURS:-26}"
|
||||
CONNECTOR_IDENTITY_KEY_FILE: /run/secrets/connector_identity_signing_key
|
||||
REQUIRED_SECRET_FILES: /run/secrets/authentik_oidc_client_secret,/run/secrets/hub_session_signing_key,/run/secrets/contextforge_api_token,/run/secrets/hub_database_password,/run/secrets/connector_identity_signing_key
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [authentik_oidc_client_secret, hub_session_signing_key, contextforge_api_token, hub_database_password, connector_identity_signing_key]
|
||||
volumes:
|
||||
- "${BACKUP_STATUS_FILE_HOST:-../../examples/backup-status.json}:/var/lib/itworx/backup-status.json:ro"
|
||||
- "../../catalog:/opt/hub/catalog:ro"
|
||||
depends_on:
|
||||
postgres: {condition: service_healthy}
|
||||
redis: {condition: service_healthy}
|
||||
contextforge: {condition: service_healthy}
|
||||
networks: [hub-control, hub-connectors, hub-data, hub-observe, hub-egress]
|
||||
|
||||
worker:
|
||||
<<: *owned-service
|
||||
user: "${PUID:-10001}:${PGID:-10001}"
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: worker}}
|
||||
image: local/itworx-mcp-hub-worker:dev
|
||||
environment:
|
||||
HUB_OIDC_ISSUER: "${HUB_OIDC_ISSUER:-https://auth.dev.invalid/application/o/itworx/}"
|
||||
HUB_CONTEXTFORGE_URL: "${HUB_CONTEXTFORGE_URL:-http://contextforge-control:4444}"
|
||||
HUB_CONTEXTFORGE_TOKEN_FILE: /run/secrets/contextforge_api_token
|
||||
HUB_CONTEXTFORGE_AUTH_SCHEME: Bearer
|
||||
HUB_DATABASE_PASSWORD_FILE: /run/secrets/hub_database_password
|
||||
HUB_DATABASE_HOST: postgres
|
||||
HUB_DATABASE_NAME: itworx_mcp_hub
|
||||
HUB_DATABASE_USER: itworx_mcp_hub
|
||||
HUB_CATALOG_ROOT: /opt/hub/catalog
|
||||
INGESTION_CONNECTOR_ENABLED: "${INGESTION_CONNECTOR_ENABLED:-false}"
|
||||
MCP_CLIENT_BINDINGS_JSON: '${MCP_CLIENT_BINDINGS_JSON:-[]}'
|
||||
REQUIRED_SECRET_FILES: /run/secrets/hub_database_password,/run/secrets/contextforge_api_token
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [hub_database_password, contextforge_api_token]
|
||||
volumes:
|
||||
- "../../catalog:/opt/hub/catalog:ro"
|
||||
- "../../services/runtime/state_sync.py:/opt/hub/services/runtime/state_sync.py:ro"
|
||||
depends_on:
|
||||
control-api: {condition: service_healthy}
|
||||
redis: {condition: service_healthy}
|
||||
connector-knowledge: {condition: service_healthy}
|
||||
connector-gitea: {condition: service_healthy}
|
||||
connector-unraid: {condition: service_healthy}
|
||||
connector-mobilityops: {condition: service_healthy}
|
||||
connector-projectbrain: {condition: service_healthy}
|
||||
connector-appops: {condition: service_healthy}
|
||||
connector-stitch: {condition: service_healthy}
|
||||
networks: [hub-control, hub-connectors, hub-data, hub-observe]
|
||||
healthcheck:
|
||||
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/ready', timeout=2)"]
|
||||
interval: 10s
|
||||
timeout: 3s
|
||||
retries: 18
|
||||
start_period: 10s
|
||||
|
||||
dataplane-router:
|
||||
<<: *owned-service
|
||||
# Docker bind-mounted secret files retain the Unraid PUID/PGID. Run the
|
||||
# router as that already unprivileged identity so its fail-closed secret
|
||||
# validation can read files that remain owner-only (0600).
|
||||
user: "${PUID:-10001}:${PGID:-10001}"
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: dataplane-router}}
|
||||
image: local/itworx-mcp-hub-dataplane:dev
|
||||
environment:
|
||||
HUB_OIDC_ISSUER: "${HUB_OIDC_ISSUER:-https://auth.dev.invalid/application/o/itworx/}"
|
||||
HUB_OIDC_AUDIENCE: "${HUB_OIDC_AUDIENCE:-itworx-mcp-hub}"
|
||||
HUB_OIDC_CLIENT_ID: "${HUB_OIDC_CLIENT_ID:-itworx-mcp-hub-dev}"
|
||||
HUB_OIDC_REDIRECT_URI: "${HUB_OIDC_REDIRECT_URI:-https://hub.dev.invalid/auth/callback}"
|
||||
HUB_MCP_ADDITIONAL_OIDC_ISSUER: "${HUB_MCP_ADDITIONAL_OIDC_ISSUER:-}"
|
||||
HUB_MCP_ADDITIONAL_OIDC_AUDIENCE: "${HUB_MCP_ADDITIONAL_OIDC_AUDIENCE:-}"
|
||||
HUB_MCP_ADDITIONAL_OIDC_CLIENT_ID: "${HUB_MCP_ADDITIONAL_OIDC_CLIENT_ID:-}"
|
||||
HUB_MCP_ADDITIONAL_OIDC_REDIRECT_URI: "${HUB_MCP_ADDITIONAL_OIDC_REDIRECT_URI:-}"
|
||||
HUB_PUBLIC_MCP_URL: "${HUB_PUBLIC_MCP_URL:-https://mcp.example.com}"
|
||||
HUB_CONTEXTFORGE_URL: "${HUB_CONTEXTFORGE_URL:-http://contextforge-control:4444}"
|
||||
HUB_CONTEXTFORGE_TOKEN_FILE: /run/secrets/contextforge_api_token
|
||||
HUB_CONTEXTFORGE_AUTH_SCHEME: Bearer
|
||||
HUB_DATABASE_PASSWORD_FILE: /run/secrets/hub_database_password
|
||||
HUB_DATABASE_HOST: postgres
|
||||
HUB_DATABASE_NAME: itworx_mcp_hub
|
||||
HUB_DATABASE_USER: itworx_mcp_hub
|
||||
HUB_CATALOG_ROOT: /opt/hub/catalog
|
||||
HUB_RATE_LIMIT_PER_MINUTE: "${HUB_RATE_LIMIT_PER_MINUTE:-600}"
|
||||
HUB_UPSTREAM_MAX_CONCURRENCY: "${HUB_UPSTREAM_MAX_CONCURRENCY:-24}"
|
||||
HUB_UPSTREAM_QUEUE_TIMEOUT_SECONDS: "${HUB_UPSTREAM_QUEUE_TIMEOUT_SECONDS:-5}"
|
||||
CONNECTOR_IDENTITY_KEY_FILE: /run/secrets/connector_identity_signing_key
|
||||
INGESTION_CONNECTOR_ENABLED: "${INGESTION_CONNECTOR_ENABLED:-false}"
|
||||
DEMO_TOKEN_KEY_FILE: /run/secrets/demo_token_signing_key
|
||||
DEMO_TOKEN_REVOCATIONS_FILE: /etc/itworx/demo-token-revocations.json
|
||||
DEMO_TOKEN_RATE_LIMIT_PER_MINUTE: "${DEMO_TOKEN_RATE_LIMIT_PER_MINUTE:-10}"
|
||||
REQUIRED_SECRET_FILES: /run/secrets/contextforge_api_token,/run/secrets/hub_database_password,/run/secrets/connector_identity_signing_key,/run/secrets/demo_token_signing_key
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [contextforge_api_token, hub_database_password, connector_identity_signing_key, demo_token_signing_key]
|
||||
volumes:
|
||||
- "../../catalog:/opt/hub/catalog:ro"
|
||||
- "../../services/runtime/dataplane.py:/opt/hub/services/runtime/dataplane.py:ro"
|
||||
# Never silently fall back to the repository example: that would make
|
||||
# the operator's early-revocation file ineffective.
|
||||
# Mount the containing directory: the operator verifier atomically replaces
|
||||
# the file and therefore needs a writable parent directory in its profile.
|
||||
- "${DEMO_TOKEN_REVOCATIONS_DIR_HOST:?Set the host-side demo-token revocations directory}:/etc/itworx:ro"
|
||||
depends_on: {postgres: {condition: service_healthy}, contextforge: {condition: service_healthy}}
|
||||
networks: [hub-edge, hub-control, hub-data, hub-observe, hub-egress]
|
||||
ports: ["${MCP_BIND_IP:-127.0.0.1}:${MCP_PORT:-18442}:8080"]
|
||||
|
||||
operator-tools:
|
||||
# Explicit one-shot profile for operator-only proofs. It receives no Docker
|
||||
# socket and does not start as part of the normal application topology.
|
||||
image: local/itworx-mcp-hub-dataplane:dev
|
||||
profiles: [operator-tools]
|
||||
user: "${PUID:-10001}:${PGID:-10001}"
|
||||
working_dir: /opt/hub
|
||||
entrypoint: ["python", "-m", "scripts.verify_demo_token_flow"]
|
||||
secrets: [demo_token_signing_key]
|
||||
volumes:
|
||||
- "${DEMO_TOKEN_REVOCATIONS_DIR_HOST:?Set the host-side demo-token revocations directory}:/etc/itworx:rw"
|
||||
networks: [hub-edge]
|
||||
|
||||
web:
|
||||
<<: *owned-service
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: web}}
|
||||
image: local/itworx-mcp-hub-web:dev
|
||||
environment:
|
||||
HUB_PUBLIC_MCP_URL: "${HUB_PUBLIC_MCP_URL:-https://mcp.example.com}"
|
||||
HUB_MCP_ADDITIONAL_OIDC_ISSUER: "${HUB_MCP_ADDITIONAL_OIDC_ISSUER:-https://auth.example-host.com/application/o/chatgpt-itworx-gitea/}"
|
||||
HUB_WORKER_URL: "http://worker:8080"
|
||||
volumes:
|
||||
- "../../services/runtime/web.py:/opt/hub/services/runtime/web.py:ro"
|
||||
depends_on:
|
||||
control-api: {condition: service_healthy}
|
||||
worker: {condition: service_healthy}
|
||||
networks: [hub-edge, hub-control, hub-observe]
|
||||
ports: ["${HUB_BIND_IP:-127.0.0.1}:${HUB_PORT:-1100}:8080"]
|
||||
|
||||
connector-knowledge:
|
||||
<<: *owned-service
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: connector-knowledge}}
|
||||
image: local/itworx-mcp-hub-connector-knowledge:dev
|
||||
volumes:
|
||||
- "${PROJECTS_READONLY_ROOT:-../../}:/sources:ro"
|
||||
environment:
|
||||
KNOWLEDGE_SOURCES_JSON: '${KNOWLEDGE_SOURCES_JSON:-[]}'
|
||||
CONNECTOR_IDENTITY_KEY_FILE: /run/secrets/connector_identity_signing_key
|
||||
REQUIRED_SECRET_FILES: /run/secrets/connector_identity_signing_key
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [connector_identity_signing_key]
|
||||
networks: [hub-connectors, hub-observe]
|
||||
|
||||
connector-ingestion:
|
||||
<<: *owned-service
|
||||
profiles: [knowledge-intake]
|
||||
# Keep /tmp writable to the non-root connector user; each intake job creates
|
||||
# its own 0700 directory and 0600 file inside this shared sticky tmpfs.
|
||||
tmpfs: ["/tmp:size=128m,mode=1777"]
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: connector-ingestion}}
|
||||
image: local/itworx-mcp-hub-connector-ingestion:dev
|
||||
environment:
|
||||
KNOWLEDGE_HUB_ENDPOINT: "${KNOWLEDGE_HUB_ENDPOINT:-https://knowledge-hub.invalid}"
|
||||
KNOWLEDGE_HUB_ALLOWED_PROJECT_IDS: "${KNOWLEDGE_HUB_ALLOWED_PROJECT_IDS:-}"
|
||||
KNOWLEDGE_HUB_WORKSPACE_READ_ENABLED: "${KNOWLEDGE_HUB_WORKSPACE_READ_ENABLED:-false}"
|
||||
KNOWLEDGE_HUB_INGESTION_TOKEN_FILE: /run/secrets/knowledge_hub_ingestion_token
|
||||
INGESTION_SCANNER_HOST: ingestion-clamd
|
||||
INGESTION_SCANNER_PORT: "3310"
|
||||
KNOWLEDGE_HUB_INGESTION_IDENTITY_KEY_FILE: /run/secrets/knowledge_hub_ingestion_identity_key
|
||||
REQUIRED_SECRET_FILES: /run/secrets/knowledge_hub_ingestion_token,/run/secrets/knowledge_hub_ingestion_identity_key
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [knowledge_hub_ingestion_token, knowledge_hub_ingestion_identity_key]
|
||||
depends_on: {ingestion-clamd: {condition: service_started}}
|
||||
networks: [hub-connectors, hub-observe, hub-egress]
|
||||
|
||||
ingestion-clamd:
|
||||
<<: *third-party
|
||||
profiles: [knowledge-intake]
|
||||
image: clamav/clamav:1.4.6@sha256:a5f03c12a79dbe9f6d8a527b6bb1ea053fa8dd061d3738a26897f055ee2d9303
|
||||
cap_drop: ["ALL"]
|
||||
# /init must chown its signature volume, prepare log files, and drop to clamav.
|
||||
cap_add: ["CHOWN", "DAC_OVERRIDE", "FOWNER", "SETUID", "SETGID"]
|
||||
mem_limit: 3g
|
||||
pids_limit: 128
|
||||
volumes: ["ingestion-clamav-db:/var/lib/clamav"]
|
||||
networks: [hub-connectors, hub-egress]
|
||||
|
||||
connector-gitea:
|
||||
<<: *owned-service
|
||||
tmpfs: ["/tmp:size=512m,mode=1777"]
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: connector-gitea}}
|
||||
image: local/itworx-mcp-hub-connector-gitea:dev
|
||||
environment:
|
||||
GITEA_CONNECTOR_BUILD_SHA: "${GITEA_COMMIT_SHA:-unknown}"
|
||||
GITEA_ENDPOINT: "${GITEA_ENDPOINT:-https://gitea.dev.invalid}"
|
||||
GITEA_TOKEN_FILE: /run/secrets/gitea_mcp_token
|
||||
GITEA_ENABLE_PR_WRITES: "${GITEA_ENABLE_PR_WRITES:-false}"
|
||||
GITEA_WRITE_TOKEN_FILE: /run/secrets/gitea_mcp_write_token
|
||||
GITEA_WRITE_OWNER: '${GITEA_WRITE_OWNER:-}'
|
||||
GITEA_REPOSITORIES_JSON: '${GITEA_REPOSITORIES_JSON:-[{"project":"dev","owner":"dev","name":"dev"}]}'
|
||||
GITEA_ADDITIONAL_PROJECTS: '${GITEA_ADDITIONAL_PROJECTS:-gitea-loop}'
|
||||
GITEA_AUTO_DISCOVER_PROJECT: '${GITEA_AUTO_DISCOVER_PROJECT:-}'
|
||||
CONNECTOR_IDENTITY_KEY_FILE: /run/secrets/connector_identity_signing_key
|
||||
REQUIRED_SECRET_FILES: /run/secrets/gitea_mcp_token,/run/secrets/gitea_mcp_write_token,/run/secrets/connector_identity_signing_key
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [gitea_mcp_token, gitea_mcp_write_token, connector_identity_signing_key]
|
||||
volumes:
|
||||
- "../../services/runtime/connector_gitea.py:/opt/hub/services/runtime/connector_gitea.py:ro"
|
||||
depends_on: {contextforge: {condition: service_healthy}}
|
||||
networks: [hub-connectors, hub-observe, hub-egress]
|
||||
|
||||
connector-mobilityops:
|
||||
<<: *owned-service
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: connector-mobilityops}}
|
||||
image: local/itworx-mcp-hub-connector-mobilityops:dev
|
||||
environment:
|
||||
MOBILITYOPS_ENDPOINT: "${MOBILITYOPS_ENDPOINT:-https://mobilityops.dev.invalid}"
|
||||
MOBILITYOPS_SERVICE_TOKEN_FILE: /run/secrets/mobilityops_service_token
|
||||
MOBILITYOPS_PROJECTS_JSON: '${MOBILITYOPS_PROJECTS_JSON:-["mobilityops"]}'
|
||||
CONNECTOR_IDENTITY_KEY_FILE: /run/secrets/connector_identity_signing_key
|
||||
REQUIRED_SECRET_FILES: /run/secrets/mobilityops_service_token,/run/secrets/connector_identity_signing_key
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [mobilityops_service_token, connector_identity_signing_key]
|
||||
depends_on: {contextforge: {condition: service_healthy}}
|
||||
networks: [hub-connectors, hub-observe, hub-egress]
|
||||
|
||||
connector-projectbrain:
|
||||
<<: *owned-service
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: connector-projectbrain}}
|
||||
image: local/itworx-mcp-hub-connector-projectbrain:dev
|
||||
environment:
|
||||
PROJECTBRAIN_ENDPOINT: "${PROJECTBRAIN_ENDPOINT:-https://projectbrain.dev.invalid}"
|
||||
PROJECTBRAIN_PROJECTS: "${PROJECTBRAIN_PROJECTS:-gitea-all},gitea-analysis,gitea-loop"
|
||||
PROJECTBRAIN_SERVICE_TOKEN_FILE: /run/secrets/projectbrain_hub_service_token
|
||||
CONNECTOR_IDENTITY_KEY_FILE: /run/secrets/connector_identity_signing_key
|
||||
REQUIRED_SECRET_FILES: /run/secrets/projectbrain_hub_service_token,/run/secrets/connector_identity_signing_key
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [projectbrain_hub_service_token, connector_identity_signing_key]
|
||||
depends_on: {contextforge: {condition: service_healthy}}
|
||||
networks: [hub-connectors, hub-observe, hub-egress]
|
||||
|
||||
connector-appops:
|
||||
<<: *owned-service
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: connector-appops}}
|
||||
image: local/itworx-mcp-hub-connector-appops:dev
|
||||
environment:
|
||||
APPOPS_ENDPOINT: "${APPOPS_ENDPOINT:-http://198.18.10.150:1216}"
|
||||
APPOPS_PROJECTS: "${APPOPS_PROJECTS:-server-ops}"
|
||||
APPOPS_SERVICE_TOKEN_FILE: /run/secrets/appops_hub_service_token
|
||||
CONNECTOR_IDENTITY_KEY_FILE: /run/secrets/connector_identity_signing_key
|
||||
REQUIRED_SECRET_FILES: /run/secrets/appops_hub_service_token,/run/secrets/connector_identity_signing_key
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [appops_hub_service_token, connector_identity_signing_key]
|
||||
depends_on: {contextforge: {condition: service_healthy}}
|
||||
networks: [hub-connectors, hub-observe, hub-egress]
|
||||
|
||||
connector-stitch:
|
||||
<<: *owned-service
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: connector-stitch}}
|
||||
image: local/itworx-mcp-hub-connector-stitch:dev
|
||||
environment:
|
||||
STITCH_ENDPOINT: "https://stitch.googleapis.com/mcp"
|
||||
STITCH_HUB_PROJECTS: "${STITCH_HUB_PROJECTS:-stitch-design}"
|
||||
STITCH_API_KEY_FILE: /run/secrets/stitch_api_key
|
||||
CONNECTOR_IDENTITY_KEY_FILE: /run/secrets/connector_identity_signing_key
|
||||
REQUIRED_SECRET_FILES: /run/secrets/stitch_api_key,/run/secrets/connector_identity_signing_key
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
secrets: [stitch_api_key, connector_identity_signing_key]
|
||||
depends_on: {contextforge: {condition: service_healthy}}
|
||||
networks: [hub-connectors, hub-observe, hub-egress]
|
||||
|
||||
docker-read-broker:
|
||||
<<: *owned-service
|
||||
build: {context: ../.., dockerfile: infrastructure/images/docker-read-broker/Dockerfile}
|
||||
image: local/itworx-mcp-hub-docker-read-broker:dev
|
||||
environment:
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: http://observability-collector:4318
|
||||
BROKER_TOKEN_FILE: /run/secrets/docker_broker_service_token
|
||||
BROKER_REGISTRATIONS_FILE: /etc/itworx/registered-targets.json
|
||||
SECRET_EXPECTED_UID: "${PUID:-10002}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10002}"
|
||||
secrets: [docker_broker_service_token]
|
||||
group_add: ["${DOCKER_SOCKET_GID:-10002}"]
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "${UNRAID_REGISTRATIONS_FILE:-../unraid/registered-targets.example.json}:/etc/itworx/registered-targets.json:ro"
|
||||
networks: [hub-broker, hub-observe]
|
||||
|
||||
connector-unraid:
|
||||
<<: *owned-service
|
||||
build: {context: ../.., dockerfile: infrastructure/images/python-service/Dockerfile, args: {SERVICE_NAME: connector-unraid}}
|
||||
image: local/itworx-mcp-hub-connector-unraid:dev
|
||||
environment:
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT: http://observability-collector:4318
|
||||
BROKER_URL: http://docker-read-broker:8080
|
||||
BROKER_TOKEN_FILE: /run/secrets/docker_broker_service_token
|
||||
SECRET_EXPECTED_UID: "${PUID:-10001}"
|
||||
SECRET_EXPECTED_GID: "${PGID:-10001}"
|
||||
UNRAID_REGISTRATIONS_FILE: /etc/itworx/registered-targets.json
|
||||
CONNECTOR_IDENTITY_KEY_FILE: /run/secrets/connector_identity_signing_key
|
||||
REQUIRED_SECRET_FILES: /run/secrets/docker_broker_service_token,/run/secrets/connector_identity_signing_key
|
||||
secrets: [docker_broker_service_token, connector_identity_signing_key]
|
||||
volumes:
|
||||
- "${UNRAID_REGISTRATIONS_FILE:-../unraid/registered-targets.example.json}:/etc/itworx/registered-targets.json:ro"
|
||||
depends_on: {docker-read-broker: {condition: service_healthy}}
|
||||
networks: [hub-connectors, hub-broker, hub-observe]
|
||||
|
||||
observability-collector:
|
||||
image: local/itworx-mcp-hub-observability:dev
|
||||
build: {context: ../.., dockerfile: infrastructure/images/observability/Dockerfile}
|
||||
profiles: [observability]
|
||||
networks: [hub-observe]
|
||||
healthcheck:
|
||||
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:4318/healthz', timeout=2)"]
|
||||
interval: 60s
|
||||
timeout: 3s
|
||||
retries: 5
|
||||
|
||||
inspector:
|
||||
<<: *third-party
|
||||
image: ghcr.io/modelcontextprotocol/inspector:2.0.0-rc.1@sha256:700500bbce937754d2ac0dd95797c3e057c8ebe2f4faf80f994652b0958a7478
|
||||
profiles: [inspector]
|
||||
networks: [hub-edge]
|
||||
ports: ["${INSPECTOR_BIND_IP:?Set an explicit LAN-only Inspector bind address}:${INSPECTOR_PORT:-18443}:6274"]
|
||||
|
||||
networks:
|
||||
hub-edge:
|
||||
name: itworx-mcp-hub-edge
|
||||
ipam: {config: [{subnet: 203.0.113.0/24}]}
|
||||
hub-egress:
|
||||
name: itworx-mcp-hub-egress
|
||||
ipam: {config: [{subnet: 203.0.113.0/24}]}
|
||||
hub-control:
|
||||
name: itworx-mcp-hub-control
|
||||
internal: true
|
||||
ipam: {config: [{subnet: 203.0.113.0/24}]}
|
||||
hub-connectors:
|
||||
name: itworx-mcp-hub-connectors
|
||||
internal: true
|
||||
ipam:
|
||||
config: [{subnet: 203.0.113.0/24}]
|
||||
hub-broker:
|
||||
name: itworx-mcp-hub-broker
|
||||
internal: true
|
||||
ipam: {config: [{subnet: 203.0.113.0/24}]}
|
||||
hub-data:
|
||||
name: itworx-mcp-hub-data
|
||||
internal: true
|
||||
ipam: {config: [{subnet: 203.0.113.0/24}]}
|
||||
hub-observe:
|
||||
name: itworx-mcp-hub-observe
|
||||
internal: true
|
||||
ipam: {config: [{subnet: 203.0.113.0/24}]}
|
||||
|
||||
volumes:
|
||||
postgres-data: {name: itworx-mcp-hub-postgres}
|
||||
ingestion-clamav-db: {name: itworx-mcp-hub-ingestion-clamav-db}
|
||||
|
||||
secrets:
|
||||
postgres_superuser_password: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/postgres_superuser_password"}
|
||||
hub_database_password: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/hub_database_password"}
|
||||
contextforge_database_password: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/contextforge_database_password"}
|
||||
contextforge_auth_encryption_secret: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/contextforge_auth_encryption_secret"}
|
||||
contextforge_jwt_secret: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/contextforge_jwt_secret"}
|
||||
contextforge_admin_credential: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/contextforge_admin_credential"}
|
||||
contextforge_api_token: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/contextforge_api_token"}
|
||||
docker_broker_service_token: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/docker_broker_service_token"}
|
||||
connector_identity_signing_key: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/connector_identity_signing_key"}
|
||||
demo_token_signing_key: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/demo_token_signing_key"}
|
||||
authentik_oidc_client_secret: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/authentik_oidc_client_secret"}
|
||||
hub_session_signing_key: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/hub_session_signing_key"}
|
||||
gitea_mcp_token: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/gitea_mcp_token"}
|
||||
gitea_mcp_write_token: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/gitea_mcp_write_token"}
|
||||
mobilityops_service_token: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/mobilityops_service_token"}
|
||||
projectbrain_hub_service_token: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/projectbrain_hub_service_token"}
|
||||
appops_hub_service_token: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/appops_hub_service_token"}
|
||||
stitch_api_key: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/stitch_api_key"}
|
||||
knowledge_hub_ingestion_token: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/knowledge_hub_ingestion_token"}
|
||||
knowledge_hub_ingestion_identity_key: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/knowledge_hub_ingestion_identity_key"}
|
||||
redis_password: {file: "${SECRETS_DIR:?Set a secret directory outside Git}/redis_password"}
|
||||
Reference in new issue
Block a user