Hiddenden/familiar
5
0 Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

HTTP transport + hardened Docker image, published to Gitea (dev + main) #62

Closed
Latte wants to merge 2 commits from feat/http-docker into dev
pull from: feat/http-docker
merge into: Hiddenden:dev
Conversation 1 Commits 2 Files Changed 13
+800 -4
2 Commits
Author SHA1 Message Date
Latte 904e96a559 ci(docker): publish image to Gitea registry (dev + main), mirror AegisGitea-MCP
docker / lint (push) Successful in 50s
Details
docker / test (push) Successful in 58s
Details
CI / lint (pull_request) Successful in 50s
Details
CI / test (pull_request) Successful in 1m1s
Details
CI / publish (pull_request) Has been skipped
Details
docker / lint (pull_request) Successful in 52s
Details
docker / docker (push) Successful in 43s
Details
docker / test (pull_request) Successful in 59s
Details
docker / docker (pull_request) Successful in 37s
Details 
Replace the opt-in docker workflow with the AegisGitea-MCP-style pipeline:
lint -> test -> build -> smoke-test -> push to git.hiddenden.cafe.

- Image git.hiddenden.cafe/hiddenden/familiar; main -> :latest + :main, dev ->
  :dev, every build also tagged :sha-<12>. Push gated to main/dev push events,
  authenticated with the REGISTRY_TOKEN secret; scoped cleanup after each run.
- docker-compose.yml pulls the published image (FAMILIAR_IMAGE, default :latest)
  with local build as a fallback; .env.example + docs/deployment.md document the
  channels and the pull-based deploy.
 2026-07-03 20:17:44 +02:00
Latte f4d2dcb1d8 feat(serve): HTTP transport + hardened Docker image for secure public serving 
Add an opt-in streamable-HTTP transport alongside the default stdio, so
familiar can be reached from a home lab over HTTPS behind a TLS reverse proxy.

- config.http_settings(): env-driven transport/host/port/path/token settings.
- serve.run(): dispatch stdio vs http; fail closed on a non-loopback bind
  without a bearer token (FAMILIAR_ALLOW_INSECURE_BIND escape hatch).
- server.build_http_auth(): FastMCP StaticTokenVerifier bearer gate; add an
  unauthenticated /healthz route for container/proxy probes.
- `familiar serve` CLI alias; clean exit on InsecureBind.
- docker/Dockerfile (multi-stage, non-root) + hardened docker-compose.yml
  (read-only rootfs, cap_drop ALL, no-new-privileges, Traefik TLS labels),
  .dockerignore, .env.example. Token store mounts at /data; writes off by default.
- .gitea/workflows/docker.yml: build + smoke-test, opt-in image publish.
- docs/deployment.md + README/CLAUDE.md notes; tests for settings, fail-closed
  validation, and the bearer verifier.
 2026-07-03 19:55:20 +02:00