Add cluster-internal MCP servers for the LocalAI agent pool

Gitea, Grafana, Nextcloud and Discourse MCP servers as ClusterIP-only
Deployments in namespace mcp, read-only, acting as LDAP user localai.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,31 @@
+# ansible-role-mcp-servers
+
+Cluster-internal MCP servers for the eom.dev LocalAI agent pool: Gitea, Grafana,
+Nextcloud (calendar + notes) and Discourse, each a Deployment plus a ClusterIP
+Service in namespace `mcp` on port 8000, path `/mcp` (streamable HTTP). There is
+no ingress; only pods inside the cluster can reach them.
+
+Agents reach them at `http://<name>.mcp.svc.cluster.local:8000/mcp`.
+
+## Credentials
+
+All servers act as the LDAP service user `localai`
+(`cn=LocalAI,ou=LocalAI,ou=Services,dc=eom,dc=dev`) and are read-only:
+
+| Secret (ns `mcp`) | What | Scope |
+|---|---|---|
+| `mcp-gitea` | `GITEA_ACCESS_TOKEN` for Gitea user `localai` | read:repository,issue,user,organization,misc; server runs `-read-only` with a small tool allowlist |
+| `mcp-grafana` | `GRAFANA_URL`, `GRAFANA_SERVICE_ACCOUNT_TOKEN` for service account `localai` | Viewer; server runs `--disable-write` |
+| `mcp-nextcloud` | `NEXTCLOUD_HOST`, `NEXTCLOUD_USERNAME`, `NEXTCLOUD_PASSWORD` (app password `agents-mcp`) | only what `localai` can see; the "Eric" calendar is shared read-only |
+| `mcp-discourse` | `discourse-profile.json` with an API key for forum user `localai` | key scoped `global:read` (GET only), `allow_writes: false` |
+
+The role never creates or reads these Secrets; create them with `kubectl` and
+keep the values out of git.
+
+## Usage
+
+```bash
+ansible-playbook -i inventories/eom.dev.yml mcp-servers.yaml
+```
+
+See `defaults/main.yml` for image pins and tool allowlists.