# Gitea MCP Server — public connector for claude.ai and Claude Code
#
# Deploys the official Gitea MCP server (gitea.com/gitea/gitea-mcp)
# in HTTP mode with MCP OAuth (-oauth): every client authorizes against
# Gitea with its OWN account (PKCE, no client secret), and the server
# forwards that bearer token to Gitea per request. No shared static
# token is used any more (gitea-mcp-secrets is kept only for a rollback
# to the pre-2026-10-19 static-token mode).
#
# The server serves /.well-known/oauth-protected-resource naming Gitea
# as the authorization server, so BOTH origins must be public HTTPS:
#   -oauth-public-url  https://mcp.bikoret.ch   (gitea-mcp-ingress.yaml)
#   -H                 https://git.bikoret.ch   (gitea-ingress.yaml;
#                      Gitea ROOT_URL must be the same, gitea-public-patch.yaml)
# /mcp accepts only the Host from -oauth-public-url, and reverse proxies
# must pass Mcp-Protocol-Version, Mcp-Method and Mcp-Name through
# (ingress-nginx does).
#
# One-time in Gitea (Settings → Applications → Manage OAuth2 Applications):
#   name            Claude
#   redirect URIs   https://claude.ai/api/mcp/auth_callback
#                   http://127.0.0.1/callback        (Claude Code; any port)
#   confidential    UNCHECKED (PKCE)
# The client ID goes into the claude.ai connector's Advanced settings,
# with the connector URL https://mcp.bikoret.ch/mcp.
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea-mcp
  namespace: shorashim
  labels:
    app.kubernetes.io/name: gitea-mcp
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: gitea-mcp
  template:
    metadata:
      labels:
        app.kubernetes.io/name: gitea-mcp
    spec:
      containers:
        - name: gitea-mcp
          image: docker.io/gitea/gitea-mcp-server@sha256:5fad9c4a1148071fd58ed617f779115f65a13c517c20427a3b39f80cac43e600  # pinned 2026-10-06: a floating tag upgrades on any restart
          command: ["/app/gitea-mcp"]
          args:
            - "-t"
            - "http"
            - "-oauth"
            - "-oauth-public-url"
            - "https://mcp.bikoret.ch"
            - "--host"
            - "https://git.bikoret.ch"
            - "--port"
            - "8080"
          ports:
            - containerPort: 8080
              name: http
          resources:
            requests:
              memory: "64Mi"
              cpu: "50m"
            limits:
              memory: "256Mi"
              cpu: "250m"
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: gitea-mcp
  namespace: shorashim
  labels:
    app.kubernetes.io/name: gitea-mcp
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: gitea-mcp
  ports:
    - port: 8080
      targetPort: 8080
      protocol: TCP
      name: http