Latte
ef1567b071
CI / lint (pull_request) Successful in 53s
docker / lint (pull_request) Successful in 53s
CI / test (pull_request) Successful in 1m3s
CI / publish (pull_request) Has been skipped
docker / test (pull_request) Successful in 57s
docker / docker (pull_request) Failing after 1m7s
The compose service already joins the external `proxy` network and exposes :8080; the reverse proxy owns TLS and routing. Remove the Traefik router labels (and the now-unused FAMILIAR_DOMAIN / TRAEFIK_CERTRESOLVER env vars) and document Pangolin — which discovers the service on the shared network — as the proxy instead. nginx/Caddy guidance is unchanged.
47 lines
2.4 KiB
Bash
47 lines
2.4 KiB
Bash
# familiar — remote HTTP / Docker deployment settings.
|
|
# Copy to .env and fill in. .env is gitignored; never commit real secrets.
|
|
|
|
# --- Image (published to Gitea by .gitea/workflows/docker.yml) -------------- #
|
|
# Prod channel: :latest or :main. Dev channel: :dev. Or pin :sha-<12>.
|
|
FAMILIAR_IMAGE=git.hiddenden.cafe/hiddenden/familiar:latest
|
|
|
|
# --- Bind + path ----------------------------------------------------------- #
|
|
# The image binds 0.0.0.0:8080 internally; only the reverse proxy reaches it.
|
|
# FAMILIAR_HTTP_PATH must match your proxy's location block.
|
|
FAMILIAR_HTTP_PATH=/mcp
|
|
|
|
# --- Auth mode ------------------------------------------------------------- #
|
|
# bearer (default) — a single static token (below). Works with every client.
|
|
# oauth — validate external-issuer JWTs; needed only for the Claude web
|
|
# connector (requires an external IdP with DCR). See doc/clients/claude-web.md.
|
|
FAMILIAR_AUTH_MODE=bearer
|
|
|
|
# --- Bearer auth (REQUIRED when FAMILIAR_AUTH_MODE=bearer) ------------------ #
|
|
# Token clients send as `Authorization: Bearer <token>`. Generate a strong one:
|
|
# openssl rand -hex 32
|
|
FAMILIAR_HTTP_TOKEN=
|
|
|
|
# Escape hatch: allow a public (0.0.0.0) bind with NO token. Leave false unless
|
|
# authentication is handled entirely upstream.
|
|
# FAMILIAR_ALLOW_INSECURE_BIND=false
|
|
|
|
# --- OAuth 2.1 resource server (only when FAMILIAR_AUTH_MODE=oauth) --------- #
|
|
# FAMILIAR_OAUTH_ISSUER=https://idp.example.com/application/o/familiar/
|
|
# FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com # this server's public URL
|
|
# FAMILIAR_OAUTH_AUDIENCE=https://familiar.example.com # defaults to RESOURCE
|
|
# FAMILIAR_OAUTH_JWKS_URI= # optional; else discovered from issuer
|
|
|
|
# --- Data / writes --------------------------------------------------------- #
|
|
# Host path holding the encrypted token store (token.enc + key), audit log, and
|
|
# write toggle. Produced by `familiar login` on a machine with a browser (or
|
|
# `familiar login --no-browser` on the host).
|
|
FAMILIAR_DATA_DIR_HOST=./data
|
|
|
|
# Writes off by default on a public instance. Set true to allow guarded writes.
|
|
FAMILIAR_ENABLE_WRITES=false
|
|
|
|
# --- Reverse proxy --------------------------------------------------------- #
|
|
# The container joins the external `proxy` network and exposes :8080; the proxy
|
|
# (Pangolin, or nginx/Caddy — see doc/deployment.md) terminates TLS and forwards
|
|
# to it. The public hostname and certs are configured in the proxy, not here.
|