Latte
f4d2dcb1d8
Add an opt-in streamable-HTTP transport alongside the default stdio, so familiar can be reached from a home lab over HTTPS behind a TLS reverse proxy. - config.http_settings(): env-driven transport/host/port/path/token settings. - serve.run(): dispatch stdio vs http; fail closed on a non-loopback bind without a bearer token (FAMILIAR_ALLOW_INSECURE_BIND escape hatch). - server.build_http_auth(): FastMCP StaticTokenVerifier bearer gate; add an unauthenticated /healthz route for container/proxy probes. - `familiar serve` CLI alias; clean exit on InsecureBind. - docker/Dockerfile (multi-stage, non-root) + hardened docker-compose.yml (read-only rootfs, cap_drop ALL, no-new-privileges, Traefik TLS labels), .dockerignore, .env.example. Token store mounts at /data; writes off by default. - .gitea/workflows/docker.yml: build + smoke-test, opt-in image publish. - docs/deployment.md + README/CLAUDE.md notes; tests for settings, fail-closed validation, and the bearer verifier.
69 lines
2.4 KiB
YAML
69 lines
2.4 KiB
YAML
services:
|
|
familiar:
|
|
build:
|
|
context: .
|
|
dockerfile: docker/Dockerfile
|
|
image: familiar:latest
|
|
container_name: familiar
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
environment:
|
|
FAMILIAR_TRANSPORT: http
|
|
FAMILIAR_HTTP_HOST: 0.0.0.0
|
|
FAMILIAR_HTTP_PORT: "8000"
|
|
FAMILIAR_HTTP_PATH: ${FAMILIAR_HTTP_PATH:-/mcp}
|
|
FAMILIAR_DATA_DIR: /data
|
|
# Bearer token that clients must send as `Authorization: Bearer <token>`.
|
|
# REQUIRED here — binding 0.0.0.0 without it makes the server refuse to start.
|
|
FAMILIAR_HTTP_AUTH_TOKEN: ${FAMILIAR_HTTP_AUTH_TOKEN:?set FAMILIAR_HTTP_AUTH_TOKEN in .env}
|
|
# Public instance: keep writes off unless you consciously opt in.
|
|
FAMILIAR_ENABLE_WRITES: ${FAMILIAR_ENABLE_WRITES:-false}
|
|
# The encrypted token store (token.enc + key), audit log, and write toggle
|
|
# live under /data. Run `familiar login` once on a machine with a browser,
|
|
# then point this at that data dir (or copy token.enc + key into ./data).
|
|
volumes:
|
|
- ${FAMILIAR_DATA_DIR_HOST:-./data}:/data
|
|
# Not published to the host — only reachable on the internal proxy network.
|
|
expose:
|
|
- "8000"
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
user: "1000:1000"
|
|
networks:
|
|
- proxy
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD",
|
|
"python",
|
|
"-c",
|
|
"import httpx; httpx.get('http://127.0.0.1:8000/healthz', timeout=5).raise_for_status()",
|
|
]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
labels:
|
|
# --- Traefik TLS termination (Let's Encrypt) -------------------------- #
|
|
# Enable if your reverse proxy is Traefik on the external `proxy` network.
|
|
# Set FAMILIAR_DOMAIN and TRAEFIK_CERTRESOLVER in .env.
|
|
traefik.enable: "true"
|
|
traefik.docker.network: proxy
|
|
traefik.http.routers.familiar.rule: Host(`${FAMILIAR_DOMAIN:-familiar.example.com}`)
|
|
traefik.http.routers.familiar.entrypoints: websecure
|
|
traefik.http.routers.familiar.tls: "true"
|
|
traefik.http.routers.familiar.tls.certresolver: ${TRAEFIK_CERTRESOLVER:-letsencrypt}
|
|
traefik.http.services.familiar.loadbalancer.server.port: "8000"
|
|
|
|
networks:
|
|
# Shared reverse-proxy network (Traefik/Caddy). Create once with:
|
|
# docker network create proxy
|
|
proxy:
|
|
external: true
|