Scott KarpandClaude Fable 5.1
53778f372e
The claude.ai connector ran the OAuth flow against a server in static-token mode, which has no OAuth endpoints: the login ended on a 404. The proper form is gitea-mcp's -oauth mode, where each user authorizes with their own Gitea account; it needs both origins public over HTTPS and Gitea's ROOT_URL to be that origin. - gitea-ingress.yaml: git.bikoret.ch → temple-council/gitea, TLS - gitea-public-patch.yaml: ROOT_URL/DOMAIN/SSH_DOMAIN = git.bikoret.ch (were a name that never resolved and a released NLB IP) - gitea-mcp-deployment.yaml: -oauth -oauth-public-url https://mcp.bikoret.ch -H https://git.bikoret.ch, no static token, probes on /healthz - gitea-mcp-ingress.yaml: host mcp.bikoret.ch (mcp.shorashim.ch retired) - gitea-public-apply.sh / gitea-public-verify.sh: the operator's DNS-gated apply and read-only verification (also in ~/.local/bin) - KOHEN.md, deploy/ARCHITECTURE.md: the new doors and the Gitea OAuth2 app ("Claude", PKCE, claude.ai + Claude Code redirect URIs) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
29 lines
1.3 KiB
YAML
29 lines
1.3 KiB
YAML
# Strategic-merge patch for the Gitea Deployment (namespace temple-council,
|
|
# which is NOT otherwise managed from this repo): make Gitea's own URL the
|
|
# public HTTPS host, so its OAuth2 authorize/token endpoints and the
|
|
# issuer in /.well-known/openid-configuration are reachable by claude.ai.
|
|
#
|
|
# kubectl -n temple-council patch deploy gitea --patch-file deploy/k8s/gitea-public-patch.yaml
|
|
#
|
|
# The Gitea image rewrites app.ini from GITEA__section__KEY at start, so
|
|
# this replaces ROOT_URL/DOMAIN (were http://gitea.temple-council.ch, a
|
|
# name that never resolved) and SSH_DOMAIN (was 185.19.29.94, an NLB IP
|
|
# released on 2026-10-06). Clone URLs shown by Gitea become
|
|
# https://git.bikoret.ch/... and git@git.bikoret.ch:...; the old
|
|
# http://185.19.28.170:3000 remote keeps working for push/pull.
|
|
# Side effect: with an https ROOT_URL Gitea marks its session cookie
|
|
# Secure, so the WEB UI must be used at https://git.bikoret.ch, not on
|
|
# the plain-HTTP :3000 door (git over :3000 is unaffected).
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: gitea
|
|
env:
|
|
- name: GITEA__server__ROOT_URL
|
|
value: "https://git.bikoret.ch/"
|
|
- name: GITEA__server__DOMAIN
|
|
value: "git.bikoret.ch"
|
|
- name: GITEA__server__SSH_DOMAIN
|
|
value: "git.bikoret.ch"
|