claudeandClaude Opus 5.5
7bf9f6022c
Gitea, Grafana, Nextcloud and Discourse MCP servers as ClusterIP-only Deployments in namespace mcp, read-only, acting as LDAP user localai. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ansible-role-mcp-servers
Cluster-internal MCP servers for the eom.dev LocalAI agent pool: Gitea, Grafana,
Nextcloud (calendar + notes) and Discourse, each a Deployment plus a ClusterIP
Service in namespace mcp on port 8000, path /mcp (streamable HTTP). There is
no ingress; only pods inside the cluster can reach them.
Agents reach them at http://<name>.mcp.svc.cluster.local:8000/mcp.
Credentials
All servers act as the LDAP service user localai
(cn=LocalAI,ou=LocalAI,ou=Services,dc=eom,dc=dev) and are read-only:
Secret (ns mcp) |
What | Scope |
|---|---|---|
mcp-gitea |
GITEA_ACCESS_TOKEN for Gitea user localai |
read:repository,issue,user,organization,misc; server runs -read-only with a small tool allowlist |
mcp-grafana |
GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN for service account localai |
Viewer; server runs --disable-write |
mcp-nextcloud |
NEXTCLOUD_HOST, NEXTCLOUD_USERNAME, NEXTCLOUD_PASSWORD (app password agents-mcp) |
only what localai can see; the "Eric" calendar is shared read-only |
mcp-discourse |
discourse-profile.json with an API key for forum user localai |
key scoped global:read (GET only), allow_writes: false |
The role never creates or reads these Secrets; create them with kubectl and
keep the values out of git.
Usage
ansible-playbook -i inventories/eom.dev.yml mcp-servers.yaml
See defaults/main.yml for image pins and tool allowlists.