Latte
b8217dce8a
docker / test (pull_request) Successful in 24s
lint / lint (pull_request) Successful in 37s
lint / lint (push) Successful in 1m26s
test / test (push) Successful in 1m40s
test / test (pull_request) Successful in 34s
docker / lint (pull_request) Successful in 1m59s
docker / docker-test (pull_request) Successful in 14s
docker / docker-publish (pull_request) Has been skipped
- Enforce 32-char minimum on OAUTH_STATE_SECRET at startup (config.py) - Write DCR client registry with owner-only (0o600) permissions before atomic replace - Flip policy.yaml default write action from allow → deny - Add CLAUDE.md with architecture, commands, and AGENTS.md contract summary - Add .pre-commit-config.yaml mirroring `make lint` checks - Update .gitignore: add .venv, .claude, .mypy_cache, .ruff_cache, .coverage.* - Extend docs: audit log rotation guidance, OAUTH_STATE_SECRET and DCR_STORAGE_PATH notes - Tests: short-secret rejection, 32-char acceptance, POSIX permission check for DCR store Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
68 lines
1.9 KiB
Bash
68 lines
1.9 KiB
Bash
# Runtime environment
|
|
ENVIRONMENT=production
|
|
|
|
# Gitea OAuth/OIDC resource server
|
|
GITEA_URL=https://git.hiddenden.cafe
|
|
|
|
# OAuth mode (recommended and required for per-user repository isolation)
|
|
OAUTH_MODE=true
|
|
GITEA_OAUTH_CLIENT_ID=your-gitea-oauth-client-id
|
|
GITEA_OAUTH_CLIENT_SECRET=your-gitea-oauth-client-secret
|
|
# Server secret used to HMAC-sign the OAuth proxy state parameter.
|
|
# Required when OAUTH_MODE=true; must be at least 32 characters.
|
|
# Generate with: openssl rand -hex 32
|
|
OAUTH_STATE_SECRET=
|
|
# Optional explicit audience override; defaults to GITEA_OAUTH_CLIENT_ID
|
|
OAUTH_EXPECTED_AUDIENCE=
|
|
# OIDC discovery and JWKS cache TTL
|
|
OAUTH_CACHE_TTL_SECONDS=300
|
|
|
|
# MCP server configuration
|
|
MCP_HOST=127.0.0.1
|
|
MCP_PORT=8080
|
|
# Optional external URL used in OAuth metadata and callback URLs when running behind a
|
|
# reverse proxy. When unset, the server derives these from the incoming request.
|
|
# Example: PUBLIC_BASE_URL=https://gitea-mcp.hiddenden.cafe
|
|
PUBLIC_BASE_URL=
|
|
ALLOW_INSECURE_BIND=false
|
|
|
|
# Logging / observability
|
|
LOG_LEVEL=INFO
|
|
AUDIT_LOG_PATH=/var/log/aegis-mcp/audit.log
|
|
METRICS_ENABLED=true
|
|
EXPOSE_ERROR_DETAILS=false
|
|
STARTUP_VALIDATE_GITEA=true
|
|
|
|
# Authentication failure controls
|
|
MAX_AUTH_FAILURES=5
|
|
AUTH_FAILURE_WINDOW=300
|
|
|
|
# Request rate limiting
|
|
RATE_LIMIT_PER_MINUTE=60
|
|
TOKEN_RATE_LIMIT_PER_MINUTE=120
|
|
|
|
# Tool output limits
|
|
MAX_FILE_SIZE_BYTES=1048576
|
|
MAX_TOOL_RESPONSE_ITEMS=200
|
|
MAX_TOOL_RESPONSE_CHARS=20000
|
|
REQUEST_TIMEOUT_SECONDS=30
|
|
|
|
# Security controls
|
|
SECRET_DETECTION_MODE=mask # off|mask|block
|
|
POLICY_FILE_PATH=policy.yaml
|
|
|
|
# Write mode (disabled by default)
|
|
WRITE_MODE=false
|
|
WRITE_REPOSITORY_WHITELIST=
|
|
WRITE_ALLOW_ALL_TOKEN_REPOS=false
|
|
|
|
# Automation mode (disabled by default)
|
|
AUTOMATION_ENABLED=false
|
|
AUTOMATION_SCHEDULER_ENABLED=false
|
|
AUTOMATION_STALE_DAYS=30
|
|
|
|
# Legacy compatibility (not used for OAuth-protected MCP tool execution)
|
|
# GITEA_TOKEN=
|
|
# MCP_API_KEYS=
|
|
# AUTH_ENABLED=true
|