mirror of
https://github.com/mcloh/Enterprise-MCP-Service-Bus.git
synced 2026-11-05 22:14:11 +00:00
65 lines
3.1 KiB
Plaintext
65 lines
3.1 KiB
Plaintext
# Copy to .env and fill in real values for local development.
|
|
# Never commit a real .env -- see docs/RI-PLANNING.md, EP-00-T05 (gestão de segredos).
|
|
|
|
# --- Gateway (EP-05) ---
|
|
GATEWAY_HOST=0.0.0.0
|
|
GATEWAY_PORT=8000
|
|
|
|
# --- Example Sales-domain MCP server (EP-06-T02) ---
|
|
SALES_DOMAIN_HOST=0.0.0.0
|
|
SALES_DOMAIN_PORT=8100
|
|
# How the Gateway reaches it (service name resolves inside docker compose;
|
|
# use 127.0.0.1 for `make dev`, which runs both processes on the host).
|
|
SALES_DOMAIN_URL=http://sales-domain:8100/mcp
|
|
|
|
# --- Example Finance-domain MCP server (EP-06-T03) ---
|
|
FINANCE_DOMAIN_HOST=0.0.0.0
|
|
FINANCE_DOMAIN_PORT=8101
|
|
FINANCE_DOMAIN_URL=http://finance-domain:8101/mcp
|
|
|
|
# --- Observability (EP-08) ---
|
|
# Unset (default): traces print to stdout via ConsoleSpanExporter.
|
|
# Set to "http://otel-collector:4318" and run with `--profile observability`
|
|
# to export real OTLP traces to the local otel-collector + Jaeger
|
|
# (EP-08-T04; UI at http://localhost:16686). Requires the `emcp-bus[otlp]`
|
|
# extra (already installed in the Docker image, see deploy/docker/Dockerfile).
|
|
# OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318
|
|
|
|
# Where the Gateway and example domain servers append audit events
|
|
# (EP-08-T02) -- JSONL, append-only, never contains raw token/secret values.
|
|
EMCP_AUDIT_LOG_PATH=/tmp/emcp-audit.jsonl
|
|
|
|
# TTL (milliseconds) the Gateway hints clients to cache a `tools/list`
|
|
# response for (EP-05-T03, SEP-2549) -- always `cacheScope: "private"`,
|
|
# never configurable to "public" (README.md §45 Teste 5).
|
|
# EMCP_TOOLS_LIST_CACHE_TTL_MS=5000
|
|
|
|
# --- PDP (EP-03) ---
|
|
# Required: the Gateway fails closed at startup if this is unreachable
|
|
# (README.md §38, EP-05-T06) -- there is no "run without a PDP" mode.
|
|
OPA_URL=http://opa:8181
|
|
|
|
# --- Identity / OIDC (EP-01-T01/T03) ---
|
|
# Unset (default): no OIDC provider configured, every request is
|
|
# unauthenticated -- deny-by-default falls back to the Gateway's own
|
|
# handler-level checks instead of the SDK's RequireAuthMiddleware (see
|
|
# emcp_bus/gateway/server.py's module docstring). Uncomment all three to
|
|
# enable real bearer-token auth against the `keycloak` compose service
|
|
# (profile `identity`; realm imported from deploy/keycloak/realm-export.json
|
|
# -- clients sales-read-agent/sales-write-agent/finance-payments-agent,
|
|
# secrets `dev-<client-id>-secret`, matching config/clients/*.yaml). Run with
|
|
# `docker compose --profile core --profile identity up`. Any OIDC-compliant
|
|
# IdP works here, not just Keycloak (EP-01-T03 is IdP-agnostic).
|
|
# OIDC_JWKS_URL=http://keycloak:8080/realms/emcp/protocol/openid-connect/certs
|
|
# OIDC_ISSUER=http://keycloak:8080/realms/emcp
|
|
# OIDC_AUDIENCE=emcp-gateway
|
|
|
|
# --- Downstream / outbound identity (EP-07) ---
|
|
# Never the inbound MCP Client's token -- see config/backends/*.yaml and
|
|
# src/emcp_bus/downstream/identity.py. Also the credential the domain
|
|
# servers themselves require of every inbound request when run via `main()`
|
|
# (EP-05-T07's `BackendCredentialGate`) -- a request lacking it never
|
|
# reaches a tool handler, whether or not it also came through the Gateway.
|
|
SALES_DOMAIN_SERVICE_TOKEN=dev-sales-domain-service-token
|
|
FINANCE_DOMAIN_SERVICE_TOKEN=dev-finance-domain-service-token
|