latte
eeaad748a6
Implements comprehensive Bearer token authentication to ensure only authorized ChatGPT workspaces can access the MCP server. Core Features: - API key validation with constant-time comparison - Multi-key support for rotation grace periods - Rate limiting (5 failures per IP per 5 min) - Comprehensive audit logging of all auth attempts - IP-based failed attempt tracking Key Management: - generate_api_key.py: Create secure 64-char keys - rotate_api_key.py: Guided key rotation with backup - check_key_age.py: Automated expiration monitoring Infrastructure: - Traefik labels for HTTPS and rate limiting - Security headers (HSTS, CSP, X-Frame-Options) - Environment-based configuration - Docker secrets support Documentation: - AUTH_SETUP.md: Complete authentication setup guide - CHATGPT_SETUP.md: ChatGPT Business integration guide - KEY_ROTATION.md: Key rotation procedures and automation Security: - Read-only operations enforced - No write access to Gitea possible - All auth attempts logged with correlation IDs - Failed attempts trigger IP rate limits - Keys never logged in full (only hints) Breaking Changes: - AUTH_ENABLED defaults to true - MCP_API_KEYS environment variable now required - Minimum key length: 32 characters (64 recommended) Migration: 1. Generate API key: make generate-key 2. Add to .env: MCP_API_KEYS=<generated-key> 3. Restart: docker-compose restart aegis-mcp 4. Configure ChatGPT with Authorization header Closes requirements for ChatGPT Business exclusive access.
85 lines
2.1 KiB
Makefile
85 lines
2.1 KiB
Makefile
.PHONY: help install install-dev test lint format clean build run docker-build docker-up docker-down docker-logs generate-key rotate-key check-key-age
|
|
|
|
help:
|
|
@echo "AegisGitea MCP - Available Commands"
|
|
@echo ""
|
|
@echo "Development:"
|
|
@echo " make install Install production dependencies"
|
|
@echo " make install-dev Install development dependencies"
|
|
@echo " make test Run tests with coverage"
|
|
@echo " make lint Run linters (ruff, mypy)"
|
|
@echo " make format Format code with black"
|
|
@echo " make clean Remove build artifacts"
|
|
@echo ""
|
|
@echo "API Key Management:"
|
|
@echo " make generate-key Generate new API key"
|
|
@echo " make rotate-key Rotate existing API key"
|
|
@echo " make check-key-age Check API key age and expiration"
|
|
@echo ""
|
|
@echo "Local Execution:"
|
|
@echo " make run Run server locally (requires .env)"
|
|
@echo ""
|
|
@echo "Docker:"
|
|
@echo " make docker-build Build Docker image"
|
|
@echo " make docker-up Start containers"
|
|
@echo " make docker-down Stop containers"
|
|
@echo " make docker-logs View container logs"
|
|
@echo " make docker-restart Restart MCP container"
|
|
@echo ""
|
|
|
|
install:
|
|
pip install -r requirements.txt
|
|
|
|
install-dev:
|
|
pip install -r requirements-dev.txt
|
|
pre-commit install
|
|
|
|
test:
|
|
pytest tests/ -v --cov=aegis_gitea_mcp --cov-report=html --cov-report=term
|
|
|
|
lint:
|
|
ruff check src/ tests/
|
|
mypy src/
|
|
|
|
format:
|
|
black src/ tests/
|
|
ruff check --fix src/ tests/
|
|
|
|
clean:
|
|
rm -rf build/ dist/ *.egg-info .pytest_cache/ .coverage htmlcov/
|
|
find . -type d -name __pycache__ -exec rm -rf {} +
|
|
find . -type f -name "*.pyc" -delete
|
|
|
|
build:
|
|
python -m build
|
|
|
|
run:
|
|
python -m aegis_gitea_mcp.server
|
|
|
|
docker-build:
|
|
docker-compose build
|
|
|
|
docker-up:
|
|
docker-compose up -d
|
|
|
|
docker-down:
|
|
docker-compose down
|
|
|
|
docker-logs:
|
|
docker-compose logs -f aegis-mcp
|
|
|
|
docker-restart:
|
|
docker-compose restart aegis-mcp
|
|
|
|
docker-shell:
|
|
docker-compose exec aegis-mcp /bin/bash
|
|
|
|
generate-key:
|
|
python3 scripts/generate_api_key.py
|
|
|
|
rotate-key:
|
|
python3 scripts/rotate_api_key.py
|
|
|
|
check-key-age:
|
|
python3 scripts/check_key_age.py
|