MCP SSH SRE

# SSH Connection Configuration # When running ON the Unraid server itself (in Docker): # - Use SSH_HOST=localhost or SSH_HOST=127.0.0.1 # - Use network_mode: host in docker-compose.yml # - SSH_PRIVATE_KEY_PATH should be the path INSIDE the container (leave as is) # - Set SSH_KEY_HOST_PATH in docker-compose or .env for the host path # When running remotely (not on Unraid): # - Use SSH_HOST=unraid.local or your Unraid server's IP/hostname # - Comment out network_mode: host in docker-compose.yml # SSH server address (use 'localhost' when running on Unraid itself) SSH_HOST=localhost # SSH port SSH_PORT=22 # SSH username (should be a dedicated read-only user) SSH_USERNAME=mcp-readonly # Path to SSH private key INSIDE the container (don't change this) SSH_PRIVATE_KEY_PATH=/home/mcp/.ssh/id_rsa # Path to SSH private key on the HOST (for docker-compose volume mount) # For Unraid: /root/.ssh/id_rsa_mcp or /boot/config/ssh/id_rsa_mcp # For other systems: /home/user/.ssh/id_rsa_mcp SSH_KEY_HOST_PATH=/root/.ssh/id_rsa_mcp # Command execution timeout in milliseconds (default: 15000 = 15 seconds) # Increase for long-running commands like database dumps COMMAND_TIMEOUT_MS=15000 # Maximum consecutive command failures before circuit breaker opens (default: 3) # When circuit breaker is open, commands will fail immediately to prevent retry loops MAX_CONSECUTIVE_FAILURES=3 # ============================================================================= # Security Configuration # ============================================================================= # Require OAuth authentication for MCP endpoint access # CRITICAL: Set to 'true' for production deployments! # # Values: # - true Require valid OAuth token (RECOMMENDED for production) # - false Allow unauthenticated access (LOCAL DEVELOPMENT ONLY) # - development Log warnings but allow access (LOCAL DEVELOPMENT ONLY) # # WARNING: Setting this to 'false' exposes your Unraid server to anyone who # can reach the HTTP endpoint. Only use 'false' or 'development' for local # development behind a firewall. NEVER expose an unauthenticated server to # the internet. # # Default: true (secure by default) REQUIRE_AUTH=true # OAuth server URL (for OAuth discovery metadata) # REQUIRED for production: Set this to your public URL when behind a reverse proxy # If not set correctly, OAuth clients will fail with "protected resource does not match" error # Default: http://localhost:8080 OAUTH_SERVER_URL=https://mcp.example.com # Mock token for testing (optional, not used in production) MOCK_TOKEN=mcp-unraid-access-token