mathiasandClaude Opus 4.8
240c3ec081
Additive: gitea-mcp now validates JWTs from a LIST of issuers — the existing Authentik issuer (DEX_ISSUER_URL) AND, when K8S_ISSUER_URL is set, the in-cluster k8s OIDC issuer for audience-bound ServiceAccount tokens. Lets in-cluster pods authenticate with kubelet-rotated projected SA tokens instead of a static bearer. - config: K8S_ISSUER_URL + K8S_MCP_AUDIENCE. - cmd/gitea-mcp/k8soidc.go: HTTP client that fetches the k8s OIDC discovery/JWKS with the cluster CA + this pod's SA bearer (k3s requires an authed fetch; anonymous is 401). - main.go: build the issuer list; switch NewJWTValidator -> NewMultiJWTValidator. The k8s issuer is best-effort — if its client can't be built (not in a pod) or its discovery is unreachable at startup, it is DROPPED and we fall back so Authentik/static auth is never taken down. Smoke-tested: off-pod it logs the skip and starts static-only; static-bearer /mcp returns 400 (auth passed), not 401. - bump mcp-chassis v0.3.0 -> v0.5.0 (multi-issuer + per-issuer HTTPClient). Refs infra ADR-0011; enables retiring the in-cluster static bearer. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gitea-mcp
Streamable HTTP MCP service exposing Gitea repo operations to Claude apps.
See ~/dev/AI/infra/docs/superpowers/specs/2026-05-04-gitea-mcp-gitops-workflow-design.md.
Quickstart
task setup:hooks # installs .githooks/pre-push — runs task check before every push
task check # context sync + lint + test + vet
task build # produces bin/gitea-mcp
This repo uses Trunk-Based Development. Commit directly to main. The pre-push
hook enforces the quality gate locally; CI re-runs task check on every push.