.env.example

# SSH Connection Configuration

# When running ON the Unraid server itself (in Docker):
# - Use SSH_HOST=localhost or SSH_HOST=127.0.0.1
# - Use network_mode: host in docker-compose.yml
# - SSH_PRIVATE_KEY_PATH should be the path INSIDE the container (leave as is)
# - Set SSH_KEY_HOST_PATH in docker-compose or .env for the host path

# When running remotely (not on Unraid):
# - Use SSH_HOST=unraid.local or your Unraid server's IP/hostname
# - Comment out network_mode: host in docker-compose.yml

# SSH server address (use 'localhost' when running on Unraid itself)
SSH_HOST=localhost

# SSH port
SSH_PORT=22

# SSH username (should be a dedicated read-only user)
SSH_USERNAME=mcp-readonly

# Path to SSH private key INSIDE the container (don't change this)
SSH_PRIVATE_KEY_PATH=/home/mcp/.ssh/id_rsa

# Path to SSH private key on the HOST (for docker-compose volume mount)
# For Unraid: /root/.ssh/id_rsa_mcp or /boot/config/ssh/id_rsa_mcp
# For other systems: /home/user/.ssh/id_rsa_mcp
SSH_KEY_HOST_PATH=/root/.ssh/id_rsa_mcp

# Command execution timeout in milliseconds (default: 15000 = 15 seconds)
# Increase for long-running commands like database dumps
COMMAND_TIMEOUT_MS=15000

# Maximum consecutive command failures before circuit breaker opens (default: 3)
# When circuit breaker is open, commands will fail immediately to prevent retry loops
MAX_CONSECUTIVE_FAILURES=3

# =============================================================================
# Security Configuration
# =============================================================================

# Require OAuth authentication for MCP endpoint access
# CRITICAL: Set to 'true' for production deployments!
#
# Values:
#   - true         Require valid OAuth token (RECOMMENDED for production)
#   - false        Allow unauthenticated access (LOCAL DEVELOPMENT ONLY)
#   - development  Log warnings but allow access (LOCAL DEVELOPMENT ONLY)
#
# WARNING: Setting this to 'false' exposes your Unraid server to anyone who
# can reach the HTTP endpoint. Only use 'false' or 'development' for local
# development behind a firewall. NEVER expose an unauthenticated server to
# the internet.
#
# Default: true (secure by default)
REQUIRE_AUTH=true

# OAuth server URL (for OAuth discovery metadata)
# REQUIRED for production: Set this to your public URL when behind a reverse proxy
# If not set correctly, OAuth clients will fail with "protected resource does not match" error
# Default: http://localhost:8080
OAUTH_SERVER_URL=https://mcp.example.com

# Mock token for testing (optional, not used in production)
MOCK_TOKEN=mcp-unraid-access-token