115 lines
5.6 KiB
Bash
115 lines
5.6 KiB
Bash
# SAFE TEMPLATE ONLY. Copy outside Git and replace every REPLACE_* value.
|
|
# This file contains references and ordinary configuration, never credentials.
|
|
|
|
# Operator-provided host paths and identity
|
|
UNRAID_HOST=REPLACE_WITH_UNRAID_LAN_HOST_OR_IP
|
|
APPDATA_ROOT=/srv/example/appdata/itworx-mcp-hub
|
|
SECRETS_DIR=/srv/example/appdata/itworx-mcp-hub/secrets
|
|
PROJECTS_READONLY_ROOT=/srv/example/appdata/itworx-mcp-hub/sources
|
|
KNOWLEDGE_SOURCES_JSON=[{"project":"REPLACE_PROJECT","sourceRef":"repository","path":"REPLACE_RELATIVE_SOURCE_PATH","sourceType":"documentation","revision":"REPLACE_WITH_IMMUTABLE_COMMIT"}]
|
|
BACKUP_ROOT=/srv/example/appdata/itworx-mcp-hub/backups
|
|
PUID=REPLACE_WITH_NUMERIC_UID
|
|
PGID=REPLACE_WITH_NUMERIC_GID
|
|
DOCKER_SOCKET_GID=REPLACE_WITH_DOCKER_SOCKET_NUMERIC_GID
|
|
|
|
# Operator-provided bind addresses and generated Compose ports
|
|
HUB_BIND_IP=REPLACE_WITH_UNRAID_LAN_IP
|
|
MCP_BIND_IP=REPLACE_WITH_UNRAID_LAN_IP
|
|
HUB_PORT=1100
|
|
MCP_PORT=18442
|
|
INSPECTOR_BIND_IP=REPLACE_ONLY_IF_INSPECTOR_IS_ENABLED
|
|
INSPECTOR_PORT=18443
|
|
|
|
# Registry references. REGISTRY_CREDENTIAL_REF names an external credential
|
|
# helper/login context; it is not a password.
|
|
REGISTRY_HOST=REPLACE_WITH_REGISTRY_HOST
|
|
REGISTRY_NAMESPACE=REPLACE_WITH_REGISTRY_NAMESPACE
|
|
REGISTRY_CREDENTIAL_REF=REPLACE_WITH_OPERATOR_CREDENTIAL_REFERENCE
|
|
|
|
# Immutable owned images: registry/path:tag@sha256:<64 lowercase hex>.
|
|
HUB_CONTROL_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
HUB_WORKER_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
HUB_DATAPLANE_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
HUB_WEB_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
CONNECTOR_KNOWLEDGE_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
CONNECTOR_GITEA_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
CONNECTOR_UNRAID_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
CONNECTOR_PROJECTBRAIN_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
CONNECTOR_APPOPS_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
CONNECTOR_STITCH_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
DOCKER_READ_BROKER_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
OBSERVABILITY_COLLECTOR_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
|
|
|
|
# Authentik/OIDC ordinary configuration. Secret values live only in
|
|
# $SECRETS_DIR/authentik_oidc_client_secret and hub_session_signing_key.
|
|
HUB_OIDC_ISSUER=https://REPLACE_WITH_AUTHENTIK_HOST/application/o/itworx/
|
|
HUB_OIDC_AUDIENCE=itworx-mcp-hub
|
|
HUB_OIDC_CLIENT_ID=REPLACE_WITH_AUTHENTIK_CLIENT_ID
|
|
HUB_OIDC_REDIRECT_URI=https://REPLACE_WITH_MCP_HOST/auth/callback
|
|
HUB_OIDC_ROLE_GROUP_MAP={"REPLACE_WITH_ADMIN_GROUP":"admin","REPLACE_WITH_OPERATOR_GROUP":"operator"}
|
|
HUB_MCP_ADDITIONAL_OIDC_ISSUER=https://REPLACE_WITH_AUTHENTIK_HOST/application/o/chatgpt-itworx-gitea/
|
|
HUB_MCP_ADDITIONAL_OIDC_AUDIENCE=chatgpt-itworx-gitea
|
|
HUB_MCP_ADDITIONAL_OIDC_CLIENT_ID=chatgpt-itworx-gitea
|
|
HUB_MCP_ADDITIONAL_OIDC_REDIRECT_URI=https://chatgpt.com/connector/oauth/REPLACE_WITH_CONNECTOR_ID
|
|
HUB_PUBLIC_MCP_URL=https://REPLACE_WITH_MCP_HOST
|
|
HUB_RATE_LIMIT_PER_MINUTE=600
|
|
HUB_UPSTREAM_MAX_CONCURRENCY=24
|
|
HUB_UPSTREAM_QUEUE_TIMEOUT_SECONDS=5
|
|
AUTHENTIK_PROVIDER_ID=REPLACE_WITH_PROVIDER_ID
|
|
AUTHENTIK_HUB_APPLICATION_ID=REPLACE_WITH_APPLICATION_ID
|
|
AUTHENTIK_SCOPES=openid,profile,email,groups,offline_access
|
|
AUTHENTIK_ALLOWED_GROUPS=REPLACE_WITH_COMMA_SEPARATED_GROUPS
|
|
AUTHENTIK_SERVICE_ACCOUNTS=["REPLACE_WITH_SCOPED_SERVICE_ACCOUNT"]
|
|
MCP_CLIENT_BINDINGS_JSON=[{"clientId":"REPLACE_WITH_UUID","subject":"REPLACE_WITH_OIDC_SUBJECT","project":"REPLACE_PROJECT","environment":"prod","enabled":true}]
|
|
|
|
# ContextForge internal endpoint/configuration. Credentials and key material
|
|
# live in the named files under SECRETS_DIR.
|
|
HUB_CONTEXTFORGE_URL=http://contextforge-control:4444
|
|
CONTEXTFORGE_DB_HOST=postgres
|
|
CONTEXTFORGE_DB_NAME=contextforge
|
|
CONTEXTFORGE_DB_USER=contextforge
|
|
REDIS_AUTH_ENABLED=true
|
|
|
|
# Existing Gitea; this deploys only the connector, never another Gitea server.
|
|
GITEA_ENDPOINT=https://REPLACE_WITH_GITEA_HOST
|
|
GITEA_REPOSITORIES_JSON=[{"project":"REPLACE_PROJECT","owner":"REPLACE_OWNER","name":"REPLACE_REPOSITORY"}]
|
|
GITEA_ADDITIONAL_PROJECTS=gitea-loop
|
|
GITEA_AUTO_DISCOVER_PROJECT=
|
|
GITEA_WRITE_OWNER=
|
|
GITEA_TOKEN_SCOPE=read:repository
|
|
GITEA_WRITE_TOKEN_SCOPE=write:repository,write:issue
|
|
GITEA_ENABLE_PR_WRITES=true
|
|
|
|
# Existing ProjectBrain; the Hub uses a dedicated server-to-server secret file.
|
|
PROJECTBRAIN_ENDPOINT=https://projectbrain.example.com
|
|
PROJECTBRAIN_PROJECTS=gitea-all
|
|
|
|
# Existing private AppOps MCP; the Hub reuses its dedicated MCP service token.
|
|
APPOPS_ENDPOINT=http://198.18.10.150:1216
|
|
APPOPS_PROJECTS=server-ops
|
|
|
|
# Google Stitch remote MCP. The API key lives only in $SECRETS_DIR/stitch_api_key.
|
|
STITCH_HUB_PROJECTS=stitch-design
|
|
|
|
# Existing NPM and DNS inputs. NETWORK_TARGETS_JSON is checked only with the
|
|
# explicit --verify-network-targets flag.
|
|
#
|
|
# Production uses a single public hostname (see
|
|
# infrastructure/nginx-proxy-manager/ROUTING.md): one NPM proxy host and one
|
|
# DNS record for REPLACE_WITH_MCP_HOST, routed by path (default location ->
|
|
# web:8080, "/mcp" custom location -> dataplane-router:8080). The *_HUB_*
|
|
# variables below are the management-surface half of that single-host
|
|
# routing config, not a second host -- set them to the exact same hostname
|
|
# value as the *_MCP_* variables. Never set a distinct hub.example.com value.
|
|
NPM_NETWORK_NAME=REPLACE_WITH_EXISTING_NPM_NETWORK
|
|
NPM_HUB_PROXY_HOST=REPLACE_WITH_MCP_HOST
|
|
NPM_MCP_PROXY_HOST=REPLACE_WITH_MCP_HOST
|
|
NPM_CERTIFICATE_REF=REPLACE_WITH_CERTIFICATE_REFERENCE
|
|
DNS_HUB_HOSTNAME=REPLACE_WITH_MCP_HOST
|
|
DNS_MCP_HOSTNAME=REPLACE_WITH_MCP_HOST
|
|
DNS_EXPECTED_ADDRESSES_JSON={"REPLACE_WITH_MCP_HOST":["REPLACE_WITH_INGRESS_IP"]}
|
|
NETWORK_TARGETS_JSON={"registry":"REPLACE_WITH_REGISTRY_HOST:443","gitea":"REPLACE_WITH_GITEA_HOST:443"}
|
|
|
|
# Generated during deployment; do not hand-edit into credentials.
|
|
UNRAID_REGISTRATIONS_FILE=/srv/example/appdata/itworx-mcp-hub/config/registered-targets.json
|