Latte
904e96a559
docker / lint (push) Successful in 50s
docker / test (push) Successful in 58s
CI / lint (pull_request) Successful in 50s
CI / test (pull_request) Successful in 1m1s
CI / publish (pull_request) Has been skipped
docker / lint (pull_request) Successful in 52s
docker / docker (push) Successful in 43s
docker / test (pull_request) Successful in 59s
docker / docker (pull_request) Successful in 37s
Replace the opt-in docker workflow with the AegisGitea-MCP-style pipeline: lint -> test -> build -> smoke-test -> push to git.hiddenden.cafe. - Image git.hiddenden.cafe/hiddenden/familiar; main -> :latest + :main, dev -> :dev, every build also tagged :sha-<12>. Push gated to main/dev push events, authenticated with the REGISTRY_TOKEN secret; scoped cleanup after each run. - docker-compose.yml pulls the published image (FAMILIAR_IMAGE, default :latest) with local build as a fallback; .env.example + docs/deployment.md document the channels and the pull-based deploy.
38 lines
1.7 KiB
Bash
38 lines
1.7 KiB
Bash
# familiar — HTTP / Docker deployment settings.
|
|
# Copy to .env and fill in. `.env` is gitignored; never commit real secrets.
|
|
|
|
# --- Transport ------------------------------------------------------------- #
|
|
# stdio (default, local) or http (Docker / public). The image sets http.
|
|
FAMILIAR_TRANSPORT=http
|
|
|
|
# Bind + path. In Docker the container binds 0.0.0.0 internally; the reverse
|
|
# proxy is the only thing that reaches it. Leave HTTP_HOST unset locally to keep
|
|
# the safe 127.0.0.1 default.
|
|
# FAMILIAR_HTTP_HOST=0.0.0.0
|
|
FAMILIAR_HTTP_PORT=8000
|
|
FAMILIAR_HTTP_PATH=/mcp
|
|
|
|
# --- Auth (REQUIRED for any non-loopback bind) ----------------------------- #
|
|
# Bearer token clients must send as `Authorization: Bearer <token>`.
|
|
# Generate a strong one, e.g.: python -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
FAMILIAR_HTTP_AUTH_TOKEN=
|
|
|
|
# Escape hatch to bind a public interface WITHOUT a token. Leave false.
|
|
# FAMILIAR_ALLOW_INSECURE_BIND=false
|
|
|
|
# --- Data / writes --------------------------------------------------------- #
|
|
# Host path holding the encrypted token store (token.enc + key), audit log, and
|
|
# write toggle. Produced by `familiar login` on a machine with a browser.
|
|
FAMILIAR_DATA_DIR_HOST=./data
|
|
|
|
# Writes off by default on a public instance. Set true to allow guarded writes.
|
|
FAMILIAR_ENABLE_WRITES=false
|
|
|
|
# --- Image (published to Gitea by .gitea/workflows/docker.yml) -------------- #
|
|
# Prod channel: :latest or :main. Dev channel: :dev. Or pin a :sha-xxxxxxxx tag.
|
|
FAMILIAR_IMAGE=git.hiddenden.cafe/hiddenden/familiar:latest
|
|
|
|
# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
|
|
FAMILIAR_DOMAIN=familiar.example.com
|
|
TRAEFIK_CERTRESOLVER=letsencrypt
|