# ansible-role-mcp-servers

Cluster-internal MCP servers for the eom.dev LocalAI agent pool: Gitea, Grafana,
Nextcloud (calendar + notes) and Discourse, each a Deployment plus a ClusterIP
Service in namespace `mcp` on port 8000, path `/mcp` (streamable HTTP). There is
no ingress; only pods inside the cluster can reach them.

Agents reach them at `http://<name>.mcp.svc.cluster.local:8000/mcp`.

## Credentials

All servers act as the LDAP service user `localai`
(`cn=LocalAI,ou=LocalAI,ou=Services,dc=eom,dc=dev`) and are read-only:

| Secret (ns `mcp`) | What | Scope |
|---|---|---|
| `mcp-gitea` | `GITEA_ACCESS_TOKEN` for Gitea user `localai` | read:repository,issue,user,organization,misc; server runs `-read-only` with a small tool allowlist |
| `mcp-grafana` | `GRAFANA_URL`, `GRAFANA_SERVICE_ACCOUNT_TOKEN` for service account `localai` | Viewer; server runs `--disable-write` |
| `mcp-nextcloud` | `NEXTCLOUD_HOST`, `NEXTCLOUD_USERNAME`, `NEXTCLOUD_PASSWORD` (app password `agents-mcp`) | only what `localai` can see; the "Eric" calendar is shared read-only |
| `mcp-discourse` | `discourse-profile.json` with an API key for forum user `localai` | key scoped `global:read` (GET only), `allow_writes: false` |

The role never creates or reads these Secrets; create them with `kubectl` and
keep the values out of git.

## Usage

```bash
ansible-playbook -i inventories/eom.dev.yml mcp-servers.yaml
```

See `defaults/main.yml` for image pins and tool allowlists.