ryan
91b7f312aa
- Introduced a new `compose.yaml` file to define the Docker service for the OAuth server. - Created `oauth.py` to implement a single-user OAuth authorization server with PKCE, SQLite persistence, and token management. - Added necessary database schema for OAuth clients, flows, codes, tokens, and login failures. - Implemented login routes with CSRF protection and error handling. - Updated `requirements.txt` to include dependencies for the OAuth server.
50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
services:
|
|
dav-mcp:
|
|
build: .
|
|
restart: unless-stopped
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
ports:
|
|
- "${MCP_BIND_ADDRESS:-127.0.0.1}:${MCP_HOST_PORT:-8000}:8000"
|
|
environment:
|
|
WEBDAV_URL: ${WEBDAV_URL:-https://dav.ryankegel.com}
|
|
WEBDAV_ROOT: ${WEBDAV_ROOT:-/Notes/Personal}
|
|
WEBDAV_USERNAME: ${WEBDAV_USERNAME:?Set WEBDAV_USERNAME in .env}
|
|
WEBDAV_PASSWORD_FILE: /run/secrets/webdav_password
|
|
MCP_PUBLIC_URL: ${MCP_PUBLIC_URL:?Set MCP_PUBLIC_URL in .env}
|
|
MCP_ALLOWED_HOSTS: ${MCP_ALLOWED_HOSTS:?Set MCP_ALLOWED_HOSTS in .env}
|
|
MCP_ALLOWED_ORIGINS: ${MCP_ALLOWED_ORIGINS:-}
|
|
MCP_AUTH_USERNAME: ${MCP_AUTH_USERNAME:?Set MCP_AUTH_USERNAME in .env}
|
|
MCP_AUTH_PASSWORD_FILE: /run/secrets/mcp_auth_password
|
|
MCP_READ_ONLY: ${MCP_READ_ONLY:-true}
|
|
OAUTH_DATABASE_PATH: /data/oauth.sqlite3
|
|
secrets:
|
|
- webdav_password
|
|
- mcp_auth_password
|
|
volumes:
|
|
- oauth-data:/data
|
|
healthcheck:
|
|
test:
|
|
- CMD
|
|
- python
|
|
- -c
|
|
- "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=2).read()"
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 20s
|
|
|
|
secrets:
|
|
webdav_password:
|
|
file: ./secrets/webdav_password
|
|
mcp_auth_password:
|
|
file: ./secrets/mcp_auth_password
|
|
|
|
volumes:
|
|
oauth-data:
|