shadowdaoandClaude Opus 5
db17e0890e
MCP clients were being kicked back to an interactive login on a short cycle, reporting "requires re-authorization (token expired)". Cause: /.well-known/oauth-protected-resource advertised only openid/profile/email plus the audience scope. A client requests exactly the scopes it finds there, and Authentik issues a refresh token only when offline_access is among them — so the client received an access token with nothing to renew it with. Once that token aged out, re-authenticating by hand was the only path forward. This is the same trap the audience scope already documents one comment further up: a scope missing from this document is a scope the client will never ask for, however the IdP is configured. Adds OIDC_OFFLINE_ACCESS (default false). Enabling it appends offline_access to the advertised scopes. Left opt-in rather than always-on because it is only half the fix — the IdP also needs an offline_access scope mapping on the provider, and advertising a scope the IdP doesn't offer risks an invalid_scope rejection that would break authentication outright. A deployment turns this on after configuring its IdP; README documents both halves and how to verify each. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
111 lines
5.6 KiB
Bash
111 lines
5.6 KiB
Bash
# =============================================================================
|
|
# shared-memory — example environment file
|
|
# Copy to `.env` and fill in real values. Never commit `.env`.
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Public URL the app is reached at.
|
|
# Used for OIDC redirect URIs, MCP discovery metadata, and Auth.js callbacks.
|
|
# -----------------------------------------------------------------------------
|
|
PUBLIC_URL=https://memory.example.com
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Deployment mode
|
|
# -----------------------------------------------------------------------------
|
|
# By default the app exposes a plain HTTP port to the host for use behind an
|
|
# external reverse proxy (HAProxy, nginx, Traefik, Cloudflare Tunnel, etc.).
|
|
APP_PORT=3000
|
|
# Bind interface for the exposed port. Use 127.0.0.1 to only accept traffic
|
|
# from a proxy on the same host. Default 0.0.0.0 accepts from anywhere.
|
|
APP_BIND=0.0.0.0
|
|
|
|
# The two settings below are ONLY consumed by the optional `caddy` service,
|
|
# which is started with: `docker compose --profile tls up -d`.
|
|
# Leave them as-is if you terminate TLS upstream (HAProxy, etc.).
|
|
APP_HOSTNAME=memory.example.com
|
|
ACME_EMAIL=you@example.com
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Authentik OIDC
|
|
# Create two Applications in Authentik (one for the Web UI, one for the MCP
|
|
# resource server). See README.md for exact provider settings.
|
|
# -----------------------------------------------------------------------------
|
|
OIDC_ISSUER=https://auth.example.com/application/o/shared-memory/
|
|
# Issuer of MCP access tokens, when the MCP endpoint is a separate application
|
|
# in your IdP (it usually is). Authentik stamps each token with its own app
|
|
# slug, so verifying MCP tokens against OIDC_ISSUER fails with
|
|
# "claim invalid: iss". Defaults to OIDC_ISSUER.
|
|
OIDC_ISSUER_MCP=https://auth.example.com/application/o/shared-memory-mcp/
|
|
OIDC_CLIENT_ID_WEB=replace-me
|
|
OIDC_CLIENT_SECRET_WEB=replace-me
|
|
OIDC_CLIENT_ID_MCP=replace-me
|
|
OIDC_AUDIENCE=shared-memory
|
|
|
|
# Marketplace this instance's Claude Code plugin is published from. When set,
|
|
# the CLI tokens page shows the one-command plugin install so people only mint
|
|
# a bearer token when a browser sign-in genuinely isn't possible.
|
|
#PLUGIN_MARKETPLACE_URL=https://your-git-host/you/shared-memory.git
|
|
#PLUGIN_MARKETPLACE_NAME=shared-memory
|
|
# Scope whose IdP mapping emits `aud: <OIDC_AUDIENCE>`. Advertised in
|
|
# /.well-known/oauth-protected-resource so MCP clients request it — without
|
|
# that, Authentik never evaluates the mapping and every token 401s with
|
|
# "claim invalid: aud". Defaults to aud-<OIDC_AUDIENCE>; set only if you
|
|
# named the scope mapping something else.
|
|
#OIDC_AUDIENCE_SCOPE=aud-shared-memory
|
|
|
|
# Advertise `offline_access` so MCP clients receive a REFRESH token and can
|
|
# renew silently. Without it the client only gets a short-lived access token
|
|
# and kicks the user back to an interactive login every time it expires.
|
|
#
|
|
# Enable this ONLY after adding an `offline_access` scope mapping to the MCP
|
|
# provider in your IdP — advertising a scope the IdP doesn't offer can fail
|
|
# the whole authorization request. See README -> "Keeping sessions alive".
|
|
#OIDC_OFFLINE_ACCESS=true
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Database (Postgres 16 + pgvector — pgvector/pgvector:pg16 image)
|
|
# -----------------------------------------------------------------------------
|
|
POSTGRES_USER=memory
|
|
POSTGRES_PASSWORD=replace-me-with-a-strong-password
|
|
POSTGRES_DB=memory
|
|
|
|
# Built automatically by docker-compose from the values above. Override only
|
|
# if you point at an external Postgres.
|
|
# DATABASE_URL=postgres://memory:...@db:5432/memory
|
|
|
|
# When using docker-compose.external-db.yml, set DATABASE_URL explicitly.
|
|
# Example for AWS RDS Postgres with SSL:
|
|
# DATABASE_URL=postgres://memory:STRONG_PASSWORD@your-rds.region.rds.amazonaws.com:5432/memory?sslmode=require
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Embedder sidecar. Default points at the in-compose service.
|
|
# -----------------------------------------------------------------------------
|
|
EMBEDDER_URL=http://embedder:8080
|
|
EMBEDDING_MODEL=Xenova/bge-small-en-v1.5
|
|
EMBEDDING_DIM=384
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# NextAuth session signing — generate with: openssl rand -base64 32
|
|
# -----------------------------------------------------------------------------
|
|
NEXTAUTH_SECRET=replace-me-with-32-bytes-of-random
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# CLI token signing key. Used to mint HMAC-signed JWTs from /connect for
|
|
# pasting into MCP clients (Claude Code etc.). Rotate to invalidate all
|
|
# outstanding CLI tokens at once. Generate with: openssl rand -base64 32
|
|
# -----------------------------------------------------------------------------
|
|
CLI_TOKEN_SECRET=replace-me-with-32-bytes-of-random
|
|
|
|
# Lifetime (in days) of newly minted CLI tokens. Positive integer; unset or
|
|
# invalid values fall back to 90. Only affects tokens minted after this is set —
|
|
# already-issued tokens keep their original expiry.
|
|
# CLI_TOKEN_TTL_DAYS=90
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# App
|
|
# -----------------------------------------------------------------------------
|
|
LOG_LEVEL=info
|
|
|
|
# Optional: pin to a specific built image (e.g. for a registry-pushed build).
|
|
# IMAGE_REF=registry.example.com/shared-memory-web:0.1.0
|