Latte
1a039e32ab
Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.
60 lines
1.7 KiB
YAML
60 lines
1.7 KiB
YAML
# Production deployment of the HTTP transport.
|
|
#
|
|
# cp .env.example .env # set GITEA_URL, MCP_BEARER_TOKEN and/or OAuth settings
|
|
# docker compose up -d
|
|
#
|
|
# The container binds 0.0.0.0 internally; the server refuses to start unless
|
|
# authentication is configured, and the port is published on loopback only.
|
|
# Put a TLS reverse proxy in front of 127.0.0.1:8080 (and set PUBLIC_BASE_URL).
|
|
services:
|
|
aegis-mcp:
|
|
image: git.hiddenden.cafe/hiddenden/aegisgitea-mcp:${AEGIS_MCP_TAG:-latest}
|
|
# To build locally instead of pulling the published image:
|
|
# build:
|
|
# context: .
|
|
# dockerfile: docker/Dockerfile
|
|
container_name: aegis-gitea-mcp
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
# Fixed by the image layout; do not override from .env.
|
|
MCP_TRANSPORT: http
|
|
MCP_HOST: 0.0.0.0
|
|
MCP_PORT: "8080"
|
|
DATA_DIR: /var/lib/aegis-mcp
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|
|
volumes:
|
|
- aegis-mcp-data:/var/lib/aegis-mcp
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
user: "1000:1000"
|
|
healthcheck:
|
|
test:
|
|
- CMD
|
|
- python
|
|
- -c
|
|
- "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=5)"
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 15s
|
|
# Optional: join an external reverse proxy network instead of publishing a
|
|
# port. Uncomment this and the `networks:` block at the bottom, and drop
|
|
# the `ports:` entry above.
|
|
# networks:
|
|
# - proxy
|
|
|
|
volumes:
|
|
aegis-mcp-data:
|
|
|
|
# networks:
|
|
# proxy:
|
|
# external: true
|