Latte
6b9c550d10
CI / lint (pull_request) Successful in 51s
CI / test (pull_request) Successful in 58s
docker / lint (pull_request) Successful in 49s
CI / publish (pull_request) Has been skipped
docker / test (pull_request) Successful in 59s
docker / docker (pull_request) Successful in 1m10s
familiar is issuer-agnostic (resource server only), so Gitea can back oauth mode with config alone: RS256 JWTs, JWKS at /login/oauth/keys, and OIDC discovery. Add a deployment.md section covering the env config, the aud=client-ID audience pitfall, and the no-DCR caveat; add a Gitea block to .env.example; and note in claude-web.md that Gitea can't back the claude.ai web connector (which requires DCR).
57 lines
3.1 KiB
Bash
57 lines
3.1 KiB
Bash
# familiar — remote HTTP / Docker deployment settings.
|
|
# Copy to .env and fill in. .env is gitignored; never commit real secrets.
|
|
|
|
# --- Image (published to Gitea by .gitea/workflows/docker.yml) -------------- #
|
|
# Prod channel: :latest or :main. Dev channel: :dev. Or pin :sha-<12>.
|
|
FAMILIAR_IMAGE=git.hiddenden.cafe/hiddenden/familiar:latest
|
|
|
|
# --- Bind + path ----------------------------------------------------------- #
|
|
# The image binds 0.0.0.0:8080 internally; only the reverse proxy reaches it.
|
|
# FAMILIAR_HTTP_PATH must match your proxy's location block.
|
|
FAMILIAR_HTTP_PATH=/mcp
|
|
|
|
# --- Auth mode ------------------------------------------------------------- #
|
|
# bearer (default) — a single static token (below). Works with every client.
|
|
# oauth — validate external-issuer JWTs; needed only for the Claude web
|
|
# connector (requires an external IdP with DCR). See doc/clients/claude-web.md.
|
|
FAMILIAR_AUTH_MODE=bearer
|
|
|
|
# --- Bearer auth (REQUIRED when FAMILIAR_AUTH_MODE=bearer) ------------------ #
|
|
# Token clients send as `Authorization: Bearer <token>`. Generate a strong one:
|
|
# openssl rand -hex 32
|
|
FAMILIAR_HTTP_TOKEN=
|
|
|
|
# Escape hatch: allow a public (0.0.0.0) bind with NO token. Leave false unless
|
|
# authentication is handled entirely upstream.
|
|
# FAMILIAR_ALLOW_INSECURE_BIND=false
|
|
|
|
# --- OAuth 2.1 resource server (only when FAMILIAR_AUTH_MODE=oauth) --------- #
|
|
# familiar only validates JWTs; the login/DCR side lives in an external IdP.
|
|
# FAMILIAR_OAUTH_ISSUER=https://idp.example.com/application/o/familiar/
|
|
# FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com # this server's public URL
|
|
# FAMILIAR_OAUTH_AUDIENCE=https://familiar.example.com # defaults to RESOURCE
|
|
# FAMILIAR_OAUTH_JWKS_URI= # optional; else discovered from issuer
|
|
#
|
|
# Using Gitea as the issuer (RS256 JWTs + JWKS + OIDC discovery — config only,
|
|
# see doc/deployment.md). Register an OAuth2 app in Gitea first; Gitea puts the
|
|
# app's CLIENT ID in the token `aud`, so set AUDIENCE to that, not the resource.
|
|
# NOTE: Gitea has no Dynamic Client Registration — works for clients with a
|
|
# pre-registered client ID/secret, but NOT the claude.ai web connector (needs DCR).
|
|
# FAMILIAR_OAUTH_ISSUER=https://gitea.example.com # no trailing /login/oauth
|
|
# FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com
|
|
# FAMILIAR_OAUTH_AUDIENCE=<gitea-oauth-app-client-id>
|
|
|
|
# --- Data / writes --------------------------------------------------------- #
|
|
# Host path holding the encrypted token store (token.enc + key), audit log, and
|
|
# write toggle. Produced by `familiar login` on a machine with a browser (or
|
|
# `familiar login --no-browser` on the host).
|
|
FAMILIAR_DATA_DIR_HOST=./data
|
|
|
|
# Writes off by default on a public instance. Set true to allow guarded writes.
|
|
FAMILIAR_ENABLE_WRITES=false
|
|
|
|
# --- Reverse proxy --------------------------------------------------------- #
|
|
# The container joins the external `proxy` network and exposes :8080; the proxy
|
|
# (Pangolin, or nginx/Caddy — see doc/deployment.md) terminates TLS and forwards
|
|
# to it. The public hostname and certs are configured in the proxy, not here.
|