airano-ir
9b70b259bb
Plugin visibility control, UI/UX fixes, unified admin panel, database-backed settings, and security hardening. Highlights: - ENABLED_PLUGINS env var for plugin visibility (F.1) - Admin designation via ADMIN_EMAILS (F.4a) - Master key scope control (F.4b) - Panel unification + settings from UI (F.4c) - exec() removal, shell injection fix, bcrypt migration (F.8) - 5 new test suites Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
209 lines
8.0 KiB
Plaintext
209 lines
8.0 KiB
Plaintext
# ===================================
|
|
# MCP Hub — Environment Configuration
|
|
# ===================================
|
|
#
|
|
# MINIMUM TO START: Just set MASTER_API_KEY and one site below.
|
|
# Full docs: https://github.com/airano-ir/mcphub/blob/main/docs/getting-started.md
|
|
#
|
|
# After editing, run:
|
|
# docker compose up -d
|
|
# curl http://localhost:8000/health # verify server
|
|
# open http://localhost:8000/dashboard # web dashboard
|
|
# ===================================
|
|
|
|
# ============================================
|
|
# REQUIRED
|
|
# ============================================
|
|
|
|
# Master API key for authentication (also used to log into the dashboard)
|
|
# Generate with: python -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
MASTER_API_KEY=your-secure-key-here
|
|
|
|
# Encryption key for user credentials (REQUIRED for Live Platform / Track E)
|
|
# Generate with: python -c "import os, base64; print(base64.b64encode(os.urandom(32)).decode())"
|
|
ENCRYPTION_KEY=
|
|
|
|
# Dashboard session secret (REQUIRED for production)
|
|
# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
|
|
DASHBOARD_SESSION_SECRET=
|
|
|
|
# ============================================
|
|
# PLUGIN VISIBILITY (Track F.1)
|
|
# ============================================
|
|
# Comma-separated list of plugins visible to public (OAuth) users.
|
|
# Admin users always see all plugins regardless of this setting.
|
|
# Default (if not set): wordpress,woocommerce,supabase
|
|
# ENABLED_PLUGINS=wordpress,woocommerce,supabase
|
|
|
|
# ============================================
|
|
# ADMIN SYSTEM (Track F.4)
|
|
# ============================================
|
|
# Comma-separated list of emails that get admin role on OAuth login.
|
|
# These users see the full admin dashboard (projects, API keys, health, etc.)
|
|
# If not set, OAuth users only get the standard user dashboard.
|
|
# ADMIN_EMAILS=admin@example.com,boss@company.com
|
|
|
|
# Disable Master Key login to the web dashboard (default: false).
|
|
# When true, only OAuth users (with admin email) can access admin dashboard.
|
|
# Master Key still works for MCP endpoints — only dashboard login is affected.
|
|
# DISABLE_MASTER_KEY_LOGIN=false
|
|
|
|
# ============================================
|
|
# WORDPRESS SITES
|
|
# ============================================
|
|
# Pattern: WORDPRESS_{SITE_ID}_{CONFIG_KEY}
|
|
# Add as many sites as you want (SITE1, SITE2, SITE3, ...)
|
|
#
|
|
# How to create a WordPress Application Password:
|
|
# 1. Log into WordPress admin → Users → Your Profile
|
|
# 2. Scroll to "Application Passwords" section
|
|
# 3. Enter name "MCP Hub" → click "Add New"
|
|
# 4. Copy the generated password (format: xxxx xxxx xxxx xxxx)
|
|
|
|
WORDPRESS_SITE1_URL=https://your-site.com
|
|
WORDPRESS_SITE1_USERNAME=admin
|
|
WORDPRESS_SITE1_APP_PASSWORD=xxxx xxxx xxxx xxxx
|
|
WORDPRESS_SITE1_ALIAS=mysite
|
|
|
|
# Optional: Docker container name for WP-CLI tools (cache flush, transients, etc.)
|
|
# Find your container name with: docker ps --filter name=wordpress
|
|
# This lets MCP Hub run wp-cli commands inside your WordPress container.
|
|
# WORDPRESS_SITE1_CONTAINER=wordpress-container-name
|
|
|
|
# Second site example (uncomment to use):
|
|
# WORDPRESS_SITE2_URL=https://another-site.com
|
|
# WORDPRESS_SITE2_USERNAME=admin
|
|
# WORDPRESS_SITE2_APP_PASSWORD=yyyy yyyy yyyy yyyy
|
|
# WORDPRESS_SITE2_ALIAS=blog
|
|
|
|
# ============================================
|
|
# WORDPRESS ADVANCED (database, bulk, system)
|
|
# ============================================
|
|
# Pattern: WORDPRESS_ADVANCED_{SITE_ID}_{CONFIG_KEY}
|
|
# Provides database operations, bulk operations, and system management.
|
|
# REQUIRES Docker socket AND container name — all tools use WP-CLI.
|
|
#
|
|
# Uses the same credentials as WordPress, but the CONTAINER key is REQUIRED.
|
|
# WORDPRESS_ADVANCED_SITE1_URL=https://your-site.com
|
|
# WORDPRESS_ADVANCED_SITE1_USERNAME=admin
|
|
# WORDPRESS_ADVANCED_SITE1_APP_PASSWORD=xxxx xxxx xxxx xxxx
|
|
# WORDPRESS_ADVANCED_SITE1_CONTAINER=wordpress-container-name
|
|
# WORDPRESS_ADVANCED_SITE1_ALIAS=mysite-advanced
|
|
|
|
# ============================================
|
|
# WOOCOMMERCE STORES
|
|
# ============================================
|
|
# Pattern: WOOCOMMERCE_{STORE_ID}_{CONFIG_KEY}
|
|
# WooCommerce is a separate plugin — uses Consumer Key/Secret, not App Passwords.
|
|
#
|
|
# Create keys: WooCommerce → Settings → Advanced → REST API → Add Key
|
|
|
|
# WOOCOMMERCE_STORE1_URL=https://your-store.com
|
|
# WOOCOMMERCE_STORE1_CONSUMER_KEY=ck_xxxxx
|
|
# WOOCOMMERCE_STORE1_CONSUMER_SECRET=cs_xxxxx
|
|
# WOOCOMMERCE_STORE1_ALIAS=mystore
|
|
|
|
# ============================================
|
|
# OTHER PLUGINS (uncomment to use)
|
|
# ============================================
|
|
# All plugins auto-discover their environment variables at startup.
|
|
# Pattern: {PLUGIN_TYPE}_{INSTANCE_ID}_{CONFIG_KEY}
|
|
|
|
# --- Gitea ---
|
|
# GITEA_REPO1_URL=https://git.example.com
|
|
# GITEA_REPO1_TOKEN=your_gitea_token
|
|
# GITEA_REPO1_ALIAS=mygitea
|
|
|
|
# --- n8n ---
|
|
# N8N_INSTANCE1_URL=https://n8n.example.com
|
|
# N8N_INSTANCE1_API_KEY=your_n8n_api_key
|
|
# N8N_INSTANCE1_ALIAS=myn8n
|
|
|
|
# --- Supabase (Self-Hosted or Cloud) ---
|
|
# Works with both self-hosted Supabase and supabase.com cloud projects.
|
|
# For cloud: URL is https://xxxx.supabase.co
|
|
# For self-hosted: URL is your Kong gateway (e.g., http://your-server:8000)
|
|
#
|
|
# SERVICE_ROLE_KEY is required (bypasses RLS, full admin access).
|
|
# ANON_KEY is optional — if omitted, SERVICE_ROLE_KEY is used for all calls.
|
|
#
|
|
# Note: postgres-meta tools (list_tables, execute_sql, get_table_schema, etc.)
|
|
# require the /pg/ Kong route or a direct META_URL. These tools do NOT work
|
|
# on supabase.com cloud (postgres-meta is internal only on cloud).
|
|
# PostgREST/Auth/Storage/Functions tools work on both cloud and self-hosted.
|
|
#
|
|
# SUPABASE_PROJECT1_URL=https://xxxx.supabase.co
|
|
# SUPABASE_PROJECT1_SERVICE_ROLE_KEY=your_service_role_key
|
|
# SUPABASE_PROJECT1_ANON_KEY=your_anon_key
|
|
# SUPABASE_PROJECT1_ALIAS=mysupabase
|
|
#
|
|
# Optional: direct postgres-meta URL for self-hosted when /pg/ is not via Kong:
|
|
# SUPABASE_PROJECT1_META_URL=http://localhost:5555
|
|
#
|
|
# Optional: Basic Auth for postgres-meta when exposed via a public URL.
|
|
# Format: username:password — not needed for internal Docker networks or Kong.
|
|
# SUPABASE_PROJECT1_META_AUTH=admin:secretpassword
|
|
|
|
# --- OpenPanel ---
|
|
# OPENPANEL_INSTANCE1_URL=https://openpanel.example.com
|
|
# OPENPANEL_INSTANCE1_CLIENT_ID=your_client_id
|
|
# OPENPANEL_INSTANCE1_CLIENT_SECRET=your_client_secret
|
|
# OPENPANEL_INSTANCE1_ALIAS=myopenpanel
|
|
|
|
# --- Appwrite ---
|
|
# APPWRITE_PROJECT1_URL=https://appwrite.example.com
|
|
# APPWRITE_PROJECT1_API_KEY=your_appwrite_api_key
|
|
# APPWRITE_PROJECT1_PROJECT_ID=your_project_id
|
|
# APPWRITE_PROJECT1_ALIAS=myappwrite
|
|
|
|
# --- Directus ---
|
|
# DIRECTUS_INSTANCE1_URL=https://directus.example.com
|
|
# DIRECTUS_INSTANCE1_TOKEN=your_directus_token
|
|
# DIRECTUS_INSTANCE1_ALIAS=mydirectus
|
|
|
|
# ============================================
|
|
# OAUTH (optional — for ChatGPT/Claude auto-registration)
|
|
# ============================================
|
|
# Only needed if you want ChatGPT or Claude to auto-register via OAuth.
|
|
# For local testing with API key auth, you can skip these.
|
|
|
|
# OAUTH_JWT_SECRET_KEY=your-jwt-secret
|
|
# OAUTH_BASE_URL=https://your-public-domain.com
|
|
|
|
# ============================================
|
|
# OAUTH SOCIAL LOGIN (optional — for user registration)
|
|
# ============================================
|
|
# Enable GitHub and/or Google login for the Live Platform.
|
|
# Create OAuth apps:
|
|
# GitHub: https://github.com/settings/developers → New OAuth App
|
|
# - Callback URL: https://your-domain.com/auth/callback/github
|
|
# Google: https://console.cloud.google.com/apis/credentials → Create OAuth Client
|
|
# - Callback URL: https://your-domain.com/auth/callback/google
|
|
|
|
# GITHUB_CLIENT_ID=
|
|
# GITHUB_CLIENT_SECRET=
|
|
# GOOGLE_CLIENT_ID=
|
|
# GOOGLE_CLIENT_SECRET=
|
|
# PUBLIC_URL=https://mcp.example.com
|
|
# SESSION_EXPIRY_HOURS=168
|
|
|
|
# === SITE MANAGEMENT (E.3) ===
|
|
# MAX_SITES_PER_USER=10
|
|
# USER_RATE_LIMIT_PER_MIN=30
|
|
# USER_RATE_LIMIT_PER_HR=500
|
|
|
|
# ============================================
|
|
# ADVANCED (optional — defaults are fine)
|
|
# ============================================
|
|
|
|
# Logging
|
|
LOG_LEVEL=INFO
|
|
|
|
# Database path (default: data/mcphub.db)
|
|
# DATABASE_PATH=/app/data/mcphub.db
|
|
|
|
# Rate limits (per client)
|
|
# RATE_LIMIT_PER_MINUTE=60
|
|
# RATE_LIMIT_PER_HOUR=1000
|
|
# RATE_LIMIT_PER_DAY=10000
|