latte
eeaad748a6
Implements comprehensive Bearer token authentication to ensure only authorized ChatGPT workspaces can access the MCP server. Core Features: - API key validation with constant-time comparison - Multi-key support for rotation grace periods - Rate limiting (5 failures per IP per 5 min) - Comprehensive audit logging of all auth attempts - IP-based failed attempt tracking Key Management: - generate_api_key.py: Create secure 64-char keys - rotate_api_key.py: Guided key rotation with backup - check_key_age.py: Automated expiration monitoring Infrastructure: - Traefik labels for HTTPS and rate limiting - Security headers (HSTS, CSP, X-Frame-Options) - Environment-based configuration - Docker secrets support Documentation: - AUTH_SETUP.md: Complete authentication setup guide - CHATGPT_SETUP.md: ChatGPT Business integration guide - KEY_ROTATION.md: Key rotation procedures and automation Security: - Read-only operations enforced - No write access to Gitea possible - All auth attempts logged with correlation IDs - Failed attempts trigger IP rate limits - Keys never logged in full (only hints) Breaking Changes: - AUTH_ENABLED defaults to true - MCP_API_KEYS environment variable now required - Minimum key length: 32 characters (64 recommended) Migration: 1. Generate API key: make generate-key 2. Add to .env: MCP_API_KEYS=<generated-key> 3. Restart: docker-compose restart aegis-mcp 4. Configure ChatGPT with Authorization header Closes requirements for ChatGPT Business exclusive access.
30 lines
842 B
Plaintext
30 lines
842 B
Plaintext
# Gitea Configuration
|
|
GITEA_URL=https://gitea.example.com
|
|
GITEA_TOKEN=your-bot-user-token-here
|
|
|
|
# MCP Server Configuration
|
|
MCP_HOST=0.0.0.0
|
|
MCP_PORT=8080
|
|
MCP_DOMAIN=mcp.yourdomain.com # Domain for Traefik (if using)
|
|
|
|
# Authentication Configuration (REQUIRED)
|
|
# Generate key with: python scripts/generate_api_key.py
|
|
AUTH_ENABLED=true
|
|
MCP_API_KEYS=your-generated-api-key-here
|
|
|
|
# Multiple keys (comma-separated for grace period during rotation):
|
|
# MCP_API_KEYS=key1,key2,key3
|
|
|
|
# Authentication limits
|
|
MAX_AUTH_FAILURES=5 # Max failures before rate limiting
|
|
AUTH_FAILURE_WINDOW=300 # Time window in seconds (5 min)
|
|
|
|
# Logging Configuration
|
|
LOG_LEVEL=INFO
|
|
AUDIT_LOG_PATH=/var/log/aegis-mcp/audit.log
|
|
|
|
# Security Configuration (optional)
|
|
# MAX_FILE_SIZE_BYTES=1048576 # 1MB
|
|
# REQUEST_TIMEOUT_SECONDS=30
|
|
# RATE_LIMIT_PER_MINUTE=60
|