Josep Piguillem
80d9bee6e0
- Logs default to warnings and errors (MCP_LOG_LEVEL): the library logged every tool on every request (~48 lines per call). - DNS rebinding protection on /mcp, as the MCP spec asks of HTTP servers: the Host header must be in MCP_ALLOWED_HOSTS (default: localhost; compose default mcp.taskstream.pireon.dev,localhost) and a browser Origin, when present, too; otherwise 403 with a JSON-RPC error. Uses the official validators from @modelcontextprotocol/server. - Test for allowed/foreign Host and Origin; .env.example, compose and docs/09-mcp.md document the variables; Word/PDF regenerated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
2.0 KiB
Plaintext
50 lines
2.0 KiB
Plaintext
PORT=3000
|
|
|
|
# Write model (commands)
|
|
POSTGRES_URL=postgres://taskstream:taskstream@localhost:5432/taskstream
|
|
# Creates/updates tables from the entities. Use migrations in production.
|
|
POSTGRES_SYNCHRONIZE=true
|
|
|
|
# Read model (queries)
|
|
MONGO_URL=mongodb://localhost:27017/taskstream_read
|
|
|
|
# Event stream (write → read), GraphQL pub/sub and session cache
|
|
REDIS_URL=redis://localhost:6379
|
|
EVENT_STREAM_KEY=task-stream:events
|
|
# Set to false on API-only instances when the events bridge (projections) runs elsewhere
|
|
EVENTS_BRIDGE_ENABLED=true
|
|
|
|
# Pireon identity server (https://oauth.pireon.dev/api/documentation)
|
|
PIREON_BASE_URL=https://oauth.pireon.dev
|
|
# Secret returned when registering the webhook (POST /api/clients/{client}/webhooks)
|
|
PIREON_WEBHOOK_SECRET=
|
|
# OAuth clients of task-stream in Pireon (POST /api/clients). Each Pireon client allows ONE grant type:
|
|
# authorization_code → "Sign in with Pireon" and Swagger UI. Redirect URIs to register:
|
|
# http://localhost:4200/auth/callback, http://localhost:3000/api/docs/oauth2-redirect.html
|
|
PIREON_CLIENT_ID=
|
|
PIREON_CLIENT_SECRET=
|
|
# password → email + password sign-in (defaults to the client above when empty)
|
|
PIREON_PASSWORD_CLIENT_ID=
|
|
PIREON_PASSWORD_CLIENT_SECRET=
|
|
PIREON_SCOPES=users:read
|
|
PIREON_PASSWORD_GRANT=true
|
|
AUTH_SESSION_TTL_SECONDS=60
|
|
|
|
GRAPHQL_PLAYGROUND=true
|
|
|
|
# REST + OpenAPI for other apps (Swagger UI at /api/docs). The document is also written to OPENAPI_FILE.
|
|
SWAGGER_ENABLED=true
|
|
OPENAPI_FILE=apps/api/openapi.json
|
|
|
|
# Docker builds only: token of Pireon's Nexus for @pi/ui (build secret, never stored in an image).
|
|
# Locally: export NEXUS_TOKEN=$(grep '^//nexus.pireon.dev/repository/npm-releases/:_authToken=' ~/.npmrc | cut -d= -f2-)
|
|
NEXUS_TOKEN=
|
|
|
|
# MCP server (apps/mcp, docs/09-mcp.md). Port: not PORT, which is the API's.
|
|
MCP_PORT=3010
|
|
TASKSTREAM_API_URL=http://localhost:3000
|
|
# Domains it answers on, comma-separated (DNS rebinding protection). Empty: localhost only.
|
|
MCP_ALLOWED_HOSTS=
|
|
# error | warn | log | debug | verbose (warn: the library logs every tool on every call otherwise)
|
|
MCP_LOG_LEVEL=warn
|