0c4848c656
The MCP SDK's transport-security DNS-rebinding protection only accepts a localhost Host header by default and returns 421 behind Traefik (Host = fleetmcp.*). It targets browser attacks on localhost-bound servers and does not apply to a public, TLS-terminated, Bearer-authenticated service. Off by default now; re-enableable via MCP_DNS_REBINDING_PROTECTION=1 + MCP_ALLOWED_HOSTS. Also: deploy.sh health echo uses python (slim image has no curl). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
77 lines
4.7 KiB
Bash
Executable file
77 lines
4.7 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# deploy.sh — manual host deploy for the read-only Fleet Analytics MCP server.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Use this if you are NOT letting Coolify build the Dockerfile (see README §Deploy
|
|
# for the Coolify-managed path, which is the recommended default). This script
|
|
# builds the image from this repo ON THE HOST and runs it as a standalone
|
|
# Traefik-labelled bridge — the same proven pattern as the dashboard_api bridges:
|
|
# it joins the network that can reach timescale_db, derives a READ-ONLY DATABASE_URL
|
|
# for the analytics_ro role, and exposes the MCP over HTTPS with Bearer auth.
|
|
#
|
|
# Prereqs ON THE HOST:
|
|
# * the analytics_ro role exists -> scripts/bootstrap_analytics_ro.sh (writes ~/.analytics_ro.pw)
|
|
# * this repo is checked out (e.g. ~/fleetanalytics_mcp) — run this script from inside it
|
|
#
|
|
# Run:
|
|
# cd ~/fleetanalytics_mcp && git pull
|
|
# MCP_AUTH_TOKENS="alice:$(openssl rand -hex 16)" bash deploy.sh
|
|
#
|
|
# A token/env change needs a container RECREATE — this script does that. Record
|
|
# each analyst's token securely; it is only shown once (when you generate it).
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
set -euo pipefail
|
|
|
|
NAME=analytics_mcp
|
|
PORT=8892
|
|
HOST_DOMAIN="${HOST_DOMAIN:-fleetmcp.fivetitude.com}" # prod: fleetmcp.rahamafresh.com
|
|
IMAGE="fleetanalytics-mcp:latest"
|
|
ENV_FILE="$(pwd)/.deploy.env"
|
|
: "${MCP_AUTH_TOKENS:?set MCP_AUTH_TOKENS=name:token[,name:token...] before running (per-analyst Bearer tokens)}"
|
|
|
|
# Resolve the network + DB DSN from the running webhook_receiver (it sits on the
|
|
# same internal network as timescale_db and holds a DATABASE_URL we can reuse the
|
|
# host:port/dbname from). This avoids hardcoding the internal DB hostname.
|
|
WH=$(docker ps --filter name=webhook_receiver --format "{{.Names}}" | head -1)
|
|
[ -n "$WH" ] || { echo "ERROR: webhook_receiver container not found (need the tracksolid stack running)"; exit 1; }
|
|
APPNET=$(docker inspect "$WH" --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}}{{end}}')
|
|
SRC_DB_URL=$(docker inspect "$WH" --format '{{range .Config.Env}}{{println .}}{{end}}' | sed -n 's/^DATABASE_URL=//p' | head -1)
|
|
[ -n "$SRC_DB_URL" ] || { echo "ERROR: DATABASE_URL not found in $WH env"; exit 1; }
|
|
echo "Reusing network $APPNET (from $WH)"
|
|
|
|
# Build a READ-ONLY DATABASE_URL: app DB host:port/dbname + analytics_ro creds.
|
|
RO_PW=$(cat "${ANALYTICS_RO_PW_FILE:-$HOME/.analytics_ro.pw}" 2>/dev/null || true)
|
|
[ -n "$RO_PW" ] || { echo "ERROR: ~/.analytics_ro.pw missing — run scripts/bootstrap_analytics_ro.sh first"; exit 1; }
|
|
HOSTPART="${SRC_DB_URL#*@}" # host:port/dbname[?params]
|
|
RO_DB_URL="postgresql://analytics_ro:${RO_PW}@${HOSTPART}"
|
|
|
|
# Build the image from this repo.
|
|
echo "Building $IMAGE ..."
|
|
docker build -t "$IMAGE" .
|
|
|
|
# Minimal env (read-only DSN + auth only — no Tracksolid ingestion secrets).
|
|
{ echo "DATABASE_URL=${RO_DB_URL}"; echo "MCP_AUTH_TOKENS=${MCP_AUTH_TOKENS}"; } > "$ENV_FILE"
|
|
chmod 600 "$ENV_FILE"
|
|
|
|
docker rm -f "$NAME" 2>/dev/null || true
|
|
docker run -d --name "$NAME" --restart unless-stopped \
|
|
--network "$APPNET" \
|
|
--env-file "$ENV_FILE" \
|
|
--label 'traefik.enable=true' \
|
|
--label 'traefik.docker.network=coolify' \
|
|
--label 'traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https' \
|
|
--label "traefik.http.routers.http-0-fleetmcp.entryPoints=http" \
|
|
--label "traefik.http.routers.http-0-fleetmcp.middlewares=redirect-to-https" \
|
|
--label "traefik.http.routers.http-0-fleetmcp.rule=Host(\`${HOST_DOMAIN}\`)" \
|
|
--label "traefik.http.routers.https-0-fleetmcp.entryPoints=https" \
|
|
--label "traefik.http.routers.https-0-fleetmcp.rule=Host(\`${HOST_DOMAIN}\`)" \
|
|
--label "traefik.http.routers.https-0-fleetmcp.tls=true" \
|
|
--label "traefik.http.routers.https-0-fleetmcp.tls.certresolver=letsencrypt" \
|
|
--label "traefik.http.services.fleetmcp.loadbalancer.server.port=${PORT}" \
|
|
"$IMAGE"
|
|
|
|
docker network connect coolify "$NAME" 2>/dev/null || true
|
|
rm -f "$ENV_FILE"
|
|
sleep 5
|
|
echo "== container =="; docker ps --filter name="$NAME" --format "{{.Names}} | {{.Status}}"
|
|
echo "== DB role (expect analytics_ro) =="; docker exec "$NAME" sh -lc 'printenv DATABASE_URL | sed -E "s#://([^:]+):[^@]+@#://\1:<pw>@#"'
|
|
echo "== health =="; docker exec "$NAME" python -c "import urllib.request; print(urllib.request.urlopen('http://localhost:${PORT}/healthz').read().decode())" 2>&1 | head
|