51 lines
2.6 KiB
Plaintext
51 lines
2.6 KiB
Plaintext
# Generate each token independently, for example: openssl rand -hex 32
|
|
CODING_AGENT_MCP_API_KEYS=agent=replace-with-at-least-32-random-characters
|
|
DEV_SERVER_MCP_API_KEYS=agent=replace-with-a-different-32-char-token
|
|
BROWSER_MCP_API_KEYS=agent=replace-with-a-third-32-char-token
|
|
DEV_SERVER_WORKER_TOKEN=replace-with-a-private-worker-token-32-chars
|
|
|
|
# Use a dedicated project directory, never a home directory or filesystem root.
|
|
MCP_WORKSPACE_HOST_PATH=/absolute/path/to/project
|
|
# Whoever owns the workspace directory on the host. This file is read literally - no shell runs
|
|
# over it - so write the numbers that 'id -u' and 'id -g' print, not the commands themselves.
|
|
MCP_UID=10001
|
|
MCP_GID=10001
|
|
|
|
# Copy services.example.json and edit the copy. It is mounted read-only.
|
|
DEV_SERVER_SERVICES_CONFIG=./dev-server-mcp/services.example.json
|
|
|
|
# What a caller may run, which is narrower than what the image carries on purpose. npx is left out
|
|
# because it fetches and runs an arbitrary package by name.
|
|
DEV_SERVER_ALLOWED_COMMANDS=node,npm,python3,./mvnw
|
|
|
|
# One instance per execution, each on its own port. Size the range and the cap by memory: two
|
|
# frontend builds saturate the worker's 2 GB, and a Spring project's .m2 is 300 MB of disk apiece.
|
|
DEV_SERVER_PORT_RANGE=5200-5219
|
|
DEV_SERVER_MAX_INSTANCES=4
|
|
|
|
# Every port an execution can be given has to be reachable by the browser, and the allowlist is by
|
|
# exact origin - so the range is spelled out here. Keep it aligned with DEV_SERVER_PORT_RANGE.
|
|
BROWSER_MCP_ALLOWED_ORIGINS=http://dev-server-worker:5173,http://dev-server-worker:5200-5219
|
|
|
|
CODING_AGENT_MCP_PORT=3101
|
|
DEV_SERVER_MCP_PORT=3102
|
|
BROWSER_MCP_PORT=3103
|
|
|
|
# The gateway publishes every server under one host by path, which is what the catalog expects.
|
|
MCP_GATEWAY_PORT=3100
|
|
|
|
### Dedicated VM ###
|
|
# Used with the overlay:
|
|
# docker compose --env-file .env -f mcp-stack.compose.yml -f mcp-stack.vm.compose.yml up -d --build
|
|
#
|
|
# Caddy obtains the certificate itself, from Let's Encrypt, as long as the host answers on 80 or
|
|
# 443 from the internet. Worth knowing when the name is chosen: CAA is evaluated on the canonical
|
|
# name, so a name that is a CNAME into a zone authorising Let's Encrypt is issued without trouble -
|
|
# the way the institute's existing hosts are - while a name resolving straight to an address under
|
|
# isti.cnr.it would be refused, since that zone authorises digicert and sectigo for plain names.
|
|
# Either way Caddy's log says which happened, and the manual fallback is in mcp-stack.vm.Caddyfile.
|
|
MCP_GATEWAY_CADDYFILE=./mcp-stack.vm.Caddyfile
|
|
MCP_SITE_ADDRESS=mcp-stack.isti.cnr.it
|
|
MCP_TLS_CONTACT=lucio.lelii@isti.cnr.it
|
|
MCP_BIND_ADDRESS=0.0.0.0
|