Scott KarpandClaude Fable 5.1
e17436c4ca
Three NLBs became one (185.19.28.170, ingress-nginx). Shorashim: `shorashim-external` (NLB 185.19.29.180, NodePort 30923) is replaced by an Ingress — a host-less catch-all (works by IP, no DNS) plus a `shorashim.ch` rule ready for the A record; TLS deliberately not requested until the name resolves. Sanhedrin-length proxy timeouts. The watch behind the ingress (completes tablet 46): the TCP peer is now the ingress controller, so Mishmar.peer/1 takes the caller from X-Real-IP — only when the peer is inside TRUSTED_PROXIES (the pod network, configmap); from anyone else the header is the caller's own claim and is ignored. The ingress Service was already externalTrafficPolicy: Local with its health-check port open, so the caller's address arrives without the security-group change the direct route needed. Verified live: the 11th knock is 429, a forged X-Real-IP is still 429, and in the same minute the old route (pod sees the node) was a different subject. Gitea: no name of its resolves, so it rides the controller's TCP passthrough on the same NLB — :3000 → gitea:80, :22 → gitea:22 (ingress-tcp-services.yaml), on the two NodePorts the security group already allowed. gitea-mcp now reaches Gitea over the cluster network instead of out through an NLB and back. Tamid §1.1 note, KOHEN.md, AGENTS.md. Doorpost e4e3d56d… → a2ec3842…. Elixir 539/0 (L3 on and off). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
85 lines
2.2 KiB
YAML
85 lines
2.2 KiB
YAML
# Gitea MCP Server — public connector for claude.ai
|
|
#
|
|
# Deploys the official Gitea MCP server (gitea.com/gitea/gitea-mcp)
|
|
# in HTTP mode, exposing /mcp endpoint for Streamable HTTP transport.
|
|
#
|
|
# The MCP server connects to the Gitea backend over the cluster network
|
|
# (gitea.temple-council.svc.cluster.local) using a Personal Access Token
|
|
# stored in gitea-mcp-secrets. Until 2026-10-06 it went out to Gitea's
|
|
# own NLB (185.19.29.94) and back in; that NLB is gone — Gitea is behind
|
|
# the shared ingress now (ingress-tcp-services.yaml).
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea-mcp
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: gitea-mcp
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitea-mcp
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: gitea-mcp
|
|
spec:
|
|
containers:
|
|
- name: gitea-mcp
|
|
image: gitea/gitea-mcp-server:latest
|
|
command: ["/app/gitea-mcp"]
|
|
args:
|
|
- "-t"
|
|
- "http"
|
|
- "--host"
|
|
- "http://gitea.temple-council.svc.cluster.local"
|
|
- "--port"
|
|
- "8080"
|
|
env:
|
|
- name: GITEA_ACCESS_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: gitea-mcp-secrets
|
|
key: GITEA_TOKEN
|
|
- name: GITEA_HOST
|
|
value: "http://gitea.temple-council.svc.cluster.local"
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
resources:
|
|
requests:
|
|
memory: "64Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "256Mi"
|
|
cpu: "250m"
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 8080
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 8080
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-mcp
|
|
namespace: shorashim
|
|
labels:
|
|
app.kubernetes.io/name: gitea-mcp
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: gitea-mcp
|
|
ports:
|
|
- port: 8080
|
|
targetPort: 8080
|
|
protocol: TCP
|
|
name: http
|