Latte
f4d2dcb1d8
Add an opt-in streamable-HTTP transport alongside the default stdio, so familiar can be reached from a home lab over HTTPS behind a TLS reverse proxy. - config.http_settings(): env-driven transport/host/port/path/token settings. - serve.run(): dispatch stdio vs http; fail closed on a non-loopback bind without a bearer token (FAMILIAR_ALLOW_INSECURE_BIND escape hatch). - server.build_http_auth(): FastMCP StaticTokenVerifier bearer gate; add an unauthenticated /healthz route for container/proxy probes. - `familiar serve` CLI alias; clean exit on InsecureBind. - docker/Dockerfile (multi-stage, non-root) + hardened docker-compose.yml (read-only rootfs, cap_drop ALL, no-new-privileges, Traefik TLS labels), .dockerignore, .env.example. Token store mounts at /data; writes off by default. - .gitea/workflows/docker.yml: build + smoke-test, opt-in image publish. - docs/deployment.md + README/CLAUDE.md notes; tests for settings, fail-closed validation, and the bearer verifier.
34 lines
1.4 KiB
Bash
34 lines
1.4 KiB
Bash
# familiar — HTTP / Docker deployment settings.
|
|
# Copy to .env and fill in. `.env` is gitignored; never commit real secrets.
|
|
|
|
# --- Transport ------------------------------------------------------------- #
|
|
# stdio (default, local) or http (Docker / public). The image sets http.
|
|
FAMILIAR_TRANSPORT=http
|
|
|
|
# Bind + path. In Docker the container binds 0.0.0.0 internally; the reverse
|
|
# proxy is the only thing that reaches it. Leave HTTP_HOST unset locally to keep
|
|
# the safe 127.0.0.1 default.
|
|
# FAMILIAR_HTTP_HOST=0.0.0.0
|
|
FAMILIAR_HTTP_PORT=8000
|
|
FAMILIAR_HTTP_PATH=/mcp
|
|
|
|
# --- Auth (REQUIRED for any non-loopback bind) ----------------------------- #
|
|
# Bearer token clients must send as `Authorization: Bearer <token>`.
|
|
# Generate a strong one, e.g.: python -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
FAMILIAR_HTTP_AUTH_TOKEN=
|
|
|
|
# Escape hatch to bind a public interface WITHOUT a token. Leave false.
|
|
# FAMILIAR_ALLOW_INSECURE_BIND=false
|
|
|
|
# --- Data / writes --------------------------------------------------------- #
|
|
# Host path holding the encrypted token store (token.enc + key), audit log, and
|
|
# write toggle. Produced by `familiar login` on a machine with a browser.
|
|
FAMILIAR_DATA_DIR_HOST=./data
|
|
|
|
# Writes off by default on a public instance. Set true to allow guarded writes.
|
|
FAMILIAR_ENABLE_WRITES=false
|
|
|
|
# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
|
|
FAMILIAR_DOMAIN=familiar.example.com
|
|
TRAEFIK_CERTRESOLVER=letsencrypt
|