Latte
f4d2dcb1d8
Add an opt-in streamable-HTTP transport alongside the default stdio, so familiar can be reached from a home lab over HTTPS behind a TLS reverse proxy. - config.http_settings(): env-driven transport/host/port/path/token settings. - serve.run(): dispatch stdio vs http; fail closed on a non-loopback bind without a bearer token (FAMILIAR_ALLOW_INSECURE_BIND escape hatch). - server.build_http_auth(): FastMCP StaticTokenVerifier bearer gate; add an unauthenticated /healthz route for container/proxy probes. - `familiar serve` CLI alias; clean exit on InsecureBind. - docker/Dockerfile (multi-stage, non-root) + hardened docker-compose.yml (read-only rootfs, cap_drop ALL, no-new-privileges, Traefik TLS labels), .dockerignore, .env.example. Token store mounts at /data; writes off by default. - .gitea/workflows/docker.yml: build + smoke-test, opt-in image publish. - docs/deployment.md + README/CLAUDE.md notes; tests for settings, fail-closed validation, and the bearer verifier.
37 lines
461 B
Plaintext
37 lines
461 B
Plaintext
# Keep the build context small and free of secrets / local state.
|
|
.git
|
|
.gitea
|
|
.venv
|
|
venv
|
|
env
|
|
ENV
|
|
__pycache__
|
|
*.py[cod]
|
|
*.egg-info
|
|
build
|
|
dist
|
|
downloads
|
|
wheels
|
|
.pytest_cache
|
|
.ruff_cache
|
|
.mypy_cache
|
|
htmlcov
|
|
.coverage
|
|
.coverage.*
|
|
coverage.xml
|
|
.cache
|
|
|
|
# Secrets / local config — never bake into an image.
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# Local docs site / editor cruft
|
|
site
|
|
.idea
|
|
.vscode
|
|
|
|
# Never ship the encrypted token store or audit log into the image.
|
|
data
|
|
*.enc
|