Scott KarpandClaude Fable 5.1
53778f372e
The claude.ai connector ran the OAuth flow against a server in static-token mode, which has no OAuth endpoints: the login ended on a 404. The proper form is gitea-mcp's -oauth mode, where each user authorizes with their own Gitea account; it needs both origins public over HTTPS and Gitea's ROOT_URL to be that origin. - gitea-ingress.yaml: git.bikoret.ch → temple-council/gitea, TLS - gitea-public-patch.yaml: ROOT_URL/DOMAIN/SSH_DOMAIN = git.bikoret.ch (were a name that never resolved and a released NLB IP) - gitea-mcp-deployment.yaml: -oauth -oauth-public-url https://mcp.bikoret.ch -H https://git.bikoret.ch, no static token, probes on /healthz - gitea-mcp-ingress.yaml: host mcp.bikoret.ch (mcp.shorashim.ch retired) - gitea-public-apply.sh / gitea-public-verify.sh: the operator's DNS-gated apply and read-only verification (also in ~/.local/bin) - KOHEN.md, deploy/ARCHITECTURE.md: the new doors and the Gitea OAuth2 app ("Claude", PKCE, claude.ai + Claude Code redirect URIs) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
41 lines
2.0 KiB
Bash
Executable File
41 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Move Gitea and its MCP server to public HTTPS on bikoret.ch and switch
|
|
# the MCP server to MCP OAuth (2026-10-19). Run by the transmitter:
|
|
# ! bash ~/.local/bin/gitea-public-apply
|
|
# Idempotent. Needs DNS first: git.bikoret.ch and mcp.bikoret.ch → 185.19.28.170.
|
|
#
|
|
# Rollback (static-token mode on mcp.shorashim.ch, as before 2026-10-19):
|
|
# kubectl -n temple-council set env deploy/gitea \
|
|
# GITEA__server__ROOT_URL=http://gitea.temple-council.ch/ \
|
|
# GITEA__server__DOMAIN=gitea.temple-council.ch GITEA__server__SSH_DOMAIN-
|
|
# then restore deploy/k8s/gitea-mcp-*.yaml from commit 861cd4e6 and apply them.
|
|
set -euo pipefail
|
|
REPO="${REPO:-$HOME/bikoret}"
|
|
cd "$REPO"
|
|
NLB=185.19.28.170
|
|
for h in git.bikoret.ch mcp.bikoret.ch; do
|
|
ip=$(dig +short "$h" | tail -1 || true)
|
|
if [ "$ip" != "$NLB" ]; then
|
|
echo "DNS: $h → '${ip:-nothing}' (need $NLB). Add the A record at Infomaniak first." >&2
|
|
exit 2
|
|
fi
|
|
done
|
|
echo "== 1/4 ingresses (certificates issue once DNS resolves)"
|
|
kubectl apply -f deploy/k8s/gitea-ingress.yaml
|
|
kubectl apply -f deploy/k8s/gitea-mcp-ingress.yaml
|
|
echo "== 2/4 Gitea ROOT_URL → https://git.bikoret.ch/ (one restart)"
|
|
kubectl -n temple-council patch deploy gitea --patch-file deploy/k8s/gitea-public-patch.yaml
|
|
kubectl -n temple-council rollout status deploy/gitea --timeout=180s
|
|
echo "== 3/4 gitea-mcp in OAuth mode at https://mcp.bikoret.ch"
|
|
kubectl apply -f deploy/k8s/gitea-mcp-deployment.yaml
|
|
kubectl -n shorashim rollout status deploy/gitea-mcp --timeout=120s
|
|
echo "== 4/4 certificates"
|
|
for i in $(seq 1 24); do
|
|
ready=$(kubectl get certificate -A -o jsonpath='{range .items[?(@.metadata.name=="gitea-bikoret-tls")]}{.status.conditions[?(@.type=="Ready")].status}{end}{range .items[?(@.metadata.name=="gitea-mcp-bikoret-tls")]}{.status.conditions[?(@.type=="Ready")].status}{end}' 2>/dev/null || true)
|
|
[ "$ready" = "TrueTrue" ] && break
|
|
sleep 5
|
|
done
|
|
kubectl get certificate -A | grep -E "NAME|bikoret"
|
|
echo "== verify"
|
|
bash "$REPO/deploy/k8s/gitea-public-verify.sh"
|