mathias
7ba01abdbe
Both services are now proxied from koala and reachable: tailscale serve 8445 -> 127.0.0.1:31877 (cad) and 8446 -> 127.0.0.1:30340 (gitea-mcp). Both answer 401 unauthenticated, so the path is right and auth is enforced. They stay out of mcpServers because neither token resolves on this host. The static tokens live in the 1Password AgentSecrets vault; koala's op identity sees HomeLab only: op vault list -> HomeLab, and nothing else op://HomeLab/CAD_STATIC_TOKEN -> could not find item op://HomeLab/gitea-mcp-shared-token -> could not find item That is infra#224, not the OAuth-discovery bug #32 and #33 both flagged as the likely blocker. A live entry that cannot authenticate would fail on every session start, so the wiring is recorded rather than enabled. The item names come from the ExternalSecrets, read by reference only — no secret value was retrieved, printed, or transformed at any point. Refs #32, #33 Bump-Type: patch
34 lines
2.0 KiB
JSON
34 lines
2.0 KiB
JSON
{
|
|
"_comment": "Tailscale Serve on koala, not the public d-ma.be hostnames. The public path exits to Cloudflare and NPM to reach a k3s service on the same machine most sessions run on, which imposes rate limits and message-size caps on tool results. Serve terminates TLS with a real Tailscale cert and proxies to the NodePort over loopback, so traffic reaches the service from koala itself and satisfies the default-deny-ingress NetworkPolicy with no cluster change. Clients need 'tailscale set --accept-dns=true' for the MagicDNS name to resolve; see mathias/skills#24.",
|
|
"mcpServers": {
|
|
"brain": {
|
|
"type": "http",
|
|
"url": "https://koala.tail30472e.ts.net:8443/mcp",
|
|
"headers": {
|
|
"Authorization": "Bearer ${BRAIN_MCP_TOKEN}"
|
|
}
|
|
},
|
|
"infra": {
|
|
"type": "http",
|
|
"url": "https://koala.tail30472e.ts.net:8444/mcp"
|
|
}
|
|
},
|
|
"_parked": {
|
|
"_reason": "cad and gitea-mcp are proxied and reachable (tailscale serve 8445 -> 127.0.0.1:31877, 8446 -> 127.0.0.1:30340; both answer 401 unauthenticated, so auth is enforced and the path is right). They stay parked because their static tokens live in the 1Password AgentSecrets vault, and this host's op identity sees only HomeLab -- 'op vault list' returns HomeLab alone, and resolving op://HomeLab/gitea-mcp-shared-token/password or op://HomeLab/CAD_STATIC_TOKEN/password fails with 'could not find item'. That is infra#224 (AgentSecrets not visible to koala's service account), NOT the OAuth-discovery bug both issues warned about. Enabling is: make the vault visible, add the two op:// references to ~/.op-env, move these entries into mcpServers. See mathias/skills#32 and #33.",
|
|
"cad": {
|
|
"type": "http",
|
|
"url": "https://koala.tail30472e.ts.net:8445/mcp",
|
|
"headers": {
|
|
"Authorization": "Bearer ${CAD_MCP_TOKEN}"
|
|
}
|
|
},
|
|
"gitea": {
|
|
"type": "http",
|
|
"url": "https://koala.tail30472e.ts.net:8446/mcp",
|
|
"headers": {
|
|
"Authorization": "Bearer ${GITEA_MCP_STATIC_TOKEN}"
|
|
}
|
|
}
|
|
}
|
|
}
|