claudeandClaude Opus 5.5
7bf9f6022c
Gitea, Grafana, Nextcloud and Discourse MCP servers as ClusterIP-only Deployments in namespace mcp, read-only, acting as LDAP user localai. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
1.4 KiB
Markdown
32 lines
1.4 KiB
Markdown
# ansible-role-mcp-servers
|
|
|
|
Cluster-internal MCP servers for the eom.dev LocalAI agent pool: Gitea, Grafana,
|
|
Nextcloud (calendar + notes) and Discourse, each a Deployment plus a ClusterIP
|
|
Service in namespace `mcp` on port 8000, path `/mcp` (streamable HTTP). There is
|
|
no ingress; only pods inside the cluster can reach them.
|
|
|
|
Agents reach them at `http://<name>.mcp.svc.cluster.local:8000/mcp`.
|
|
|
|
## Credentials
|
|
|
|
All servers act as the LDAP service user `localai`
|
|
(`cn=LocalAI,ou=LocalAI,ou=Services,dc=eom,dc=dev`) and are read-only:
|
|
|
|
| Secret (ns `mcp`) | What | Scope |
|
|
|---|---|---|
|
|
| `mcp-gitea` | `GITEA_ACCESS_TOKEN` for Gitea user `localai` | read:repository,issue,user,organization,misc; server runs `-read-only` with a small tool allowlist |
|
|
| `mcp-grafana` | `GRAFANA_URL`, `GRAFANA_SERVICE_ACCOUNT_TOKEN` for service account `localai` | Viewer; server runs `--disable-write` |
|
|
| `mcp-nextcloud` | `NEXTCLOUD_HOST`, `NEXTCLOUD_USERNAME`, `NEXTCLOUD_PASSWORD` (app password `agents-mcp`) | only what `localai` can see; the "Eric" calendar is shared read-only |
|
|
| `mcp-discourse` | `discourse-profile.json` with an API key for forum user `localai` | key scoped `global:read` (GET only), `allow_writes: false` |
|
|
|
|
The role never creates or reads these Secrets; create them with `kubectl` and
|
|
keep the values out of git.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
ansible-playbook -i inventories/eom.dev.yml mcp-servers.yaml
|
|
```
|
|
|
|
See `defaults/main.yml` for image pins and tool allowlists.
|