# AegisGitea MCP configuration. Copy to .env and fill in. All names are
# case-insensitive. Never commit a real .env.

# --- Gitea -------------------------------------------------------------------
# Base URL of your Gitea instance. A trailing /api/v1 is accepted and removed.
GITEA_URL=https://gitea.example.com
# Token used for stdio and for admin-token mode on HTTP. Create it in Gitea under
# Settings > Applications. Its scopes bound what this server can do.
GITEA_TOKEN=

# --- Transport ---------------------------------------------------------------
# stdio (default) or http
MCP_TRANSPORT=stdio
MCP_HOST=127.0.0.1
MCP_PORT=8080
MCP_PATH=/mcp
# Static bearer token for the HTTP endpoint (admin identity). At least 32
# characters. Generate with: openssl rand -hex 32
MCP_BEARER_TOKEN=
# Public base URL of this server behind a reverse proxy (https unless loopback).
PUBLIC_BASE_URL=
# Extra Host header values accepted behind a reverse proxy (comma separated).
ALLOWED_HOSTS=
# Proxy addresses whose X-Forwarded-For is trusted (comma separated IPs or
# networks). The default only trusts a proxy on this host. Behind a Docker proxy
# on another address list that address; use * only if the port is reachable
# solely from the proxy.
FORWARDED_ALLOW_IPS=127.0.0.1

# --- Per-user OAuth (HTTP only) -----------------------------------------------
OAUTH_ENABLED=false
GITEA_OAUTH_CLIENT_ID=
GITEA_OAUTH_CLIENT_SECRET=
# Encrypts stored user tokens. At least 32 characters. Generate with:
# openssl rand -hex 32
TOKEN_ENCRYPTION_KEY=
# Granular Gitea scopes only (read:/write: activitypub, admin, issue, misc,
# notification, organization, package, repository, user). Unknown values are rejected.
OAUTH_SCOPES=write:activitypub,write:admin,write:issue,write:misc,write:notification,write:organization,write:package,write:repository,write:user

# --- State --------------------------------------------------------------------
# Token store and audit log live here.
DATA_DIR=~/.local/state/aegis-gitea-mcp
# Defaults to DATA_DIR/audit.log
AUDIT_LOG_PATH=

# --- Tool exposure (everything is enabled by default) ---------------------------
# Expose only GET operations.
READ_ONLY=false
# Comma separated domains: admin, repo, issue, pull, release, wiki, org, team,
# user, actions, hook, package, notification, misc, or all.
TOOLSETS=all
# Comma separated tool names to hide, e.g. gitea_repo_delete
DISABLED_TOOLS=

# --- Limits and safety ----------------------------------------------------------
REQUEST_TIMEOUT_SECONDS=30
MAX_TOOL_RESPONSE_ITEMS=200
MAX_TOOL_RESPONSE_CHARS=60000
MAX_BINARY_BYTES=5242880
# off, mask or block
SECRET_DETECTION_MODE=mask
LOG_LEVEL=INFO
EXPOSE_ERROR_DETAILS=false
RATE_LIMIT_PER_MINUTE=120