Scott KarpandClaude Fable 5.1
53778f372e
The claude.ai connector ran the OAuth flow against a server in static-token mode, which has no OAuth endpoints: the login ended on a 404. The proper form is gitea-mcp's -oauth mode, where each user authorizes with their own Gitea account; it needs both origins public over HTTPS and Gitea's ROOT_URL to be that origin. - gitea-ingress.yaml: git.bikoret.ch → temple-council/gitea, TLS - gitea-public-patch.yaml: ROOT_URL/DOMAIN/SSH_DOMAIN = git.bikoret.ch (were a name that never resolved and a released NLB IP) - gitea-mcp-deployment.yaml: -oauth -oauth-public-url https://mcp.bikoret.ch -H https://git.bikoret.ch, no static token, probes on /healthz - gitea-mcp-ingress.yaml: host mcp.bikoret.ch (mcp.shorashim.ch retired) - gitea-public-apply.sh / gitea-public-verify.sh: the operator's DNS-gated apply and read-only verification (also in ~/.local/bin) - KOHEN.md, deploy/ARCHITECTURE.md: the new doors and the Gitea OAuth2 app ("Claude", PKCE, claude.ai + Claude Code redirect URIs) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
40 lines
1.1 KiB
YAML
40 lines
1.1 KiB
YAML
# Ingress for Gitea MCP Server — public HTTPS endpoint
|
|
# Routes mcp.bikoret.ch to the gitea-mcp service (moved from
|
|
# mcp.bikoret.ch on 2026-10-19 with the switch to MCP OAuth; the
|
|
# server only answers /mcp for the host in -oauth-public-url).
|
|
# TLS via cert-manager (Let's Encrypt)
|
|
#
|
|
# Prerequisites:
|
|
# 1. nginx-ingress controller installed
|
|
# 2. cert-manager installed
|
|
# 3. ClusterIssuer letsencrypt-prod applied
|
|
# 4. DNS: mcp.bikoret.ch → 185.19.28.170 (the one NLB; Infomaniak zone)
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: gitea-mcp
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: gitea-mcp
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- hosts:
|
|
- mcp.bikoret.ch
|
|
secretName: gitea-mcp-bikoret-tls
|
|
rules:
|
|
- host: mcp.bikoret.ch
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: gitea-mcp
|
|
port:
|
|
number: 8080
|