docs: provide hardened nginx and systemd templates
This commit is contained in:
gpt-5-codex
Andre Heinecke
parent
4b14d45e28
commit
18d94d8913
|
|
@ -0,0 +1,131 @@
|
|||
# Example NGINX front-end for MCP Browser
|
||||
#
|
||||
# Replace the placeholder values (domain, certificate paths, slug, upstream
|
||||
# ports) with values that match your deployment. This configuration exposes:
|
||||
# * OAuth metadata + token endpoints implemented via an njs helper
|
||||
# * An authenticated Streamable HTTP MCP endpoint
|
||||
# * An unauthenticated debug endpoint (optional) that forwards to the
|
||||
# mcp-browser SSE bridge
|
||||
#
|
||||
# The example assumes that:
|
||||
# * An njs script lives at /etc/nginx/njs/mcp_oauth.js providing handlers
|
||||
# for the metadata/register/token endpoints.
|
||||
# * The mcp-browser bridge listens on 127.0.0.1:8251 for SSE requests.
|
||||
# * The upstream MCP server (or proxy) exposes streamable-http at
|
||||
# 127.0.0.1:8250.
|
||||
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
js_path /etc/nginx/njs;
|
||||
js_import mcp_oauth from /etc/nginx/njs/mcp_oauth.js;
|
||||
|
||||
# Upstream pools (tune keepalive as needed)
|
||||
upstream mcp_streamable_backend {
|
||||
server 127.0.0.1:8250;
|
||||
keepalive 32;
|
||||
}
|
||||
|
||||
upstream mcp_browser_backend {
|
||||
server 127.0.0.1:8251;
|
||||
keepalive 8;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name mcp.example.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/mcp.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mcp.example.com/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
# ssl_trusted_certificate /etc/letsencrypt/live/mcp.example.com/chain.pem;
|
||||
|
||||
add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
|
||||
|
||||
# --- OAuth discovery + token endpoints (served by njs helper) -------------
|
||||
# Replace __MCP_SLUG__ with the slug you publish in OAuth metadata.
|
||||
location = /.well-known/oauth-authorization-server/__MCP_SLUG__/mcp {
|
||||
default_type application/json;
|
||||
js_content mcp_oauth.metadata;
|
||||
}
|
||||
|
||||
location = /.well-known/oauth-protected-resource/__MCP_SLUG__/mcp {
|
||||
default_type application/json;
|
||||
js_content mcp_oauth.metadata;
|
||||
}
|
||||
|
||||
location = /.well-known/oauth-authorization-server {
|
||||
default_type application/json;
|
||||
js_content mcp_oauth.metadata;
|
||||
}
|
||||
|
||||
location = /.well-known/oauth-protected-resource {
|
||||
default_type application/json;
|
||||
js_content mcp_oauth.metadata;
|
||||
}
|
||||
|
||||
location = /register {
|
||||
default_type application/json;
|
||||
js_content mcp_oauth.register;
|
||||
}
|
||||
|
||||
location = /token {
|
||||
default_type application/json;
|
||||
js_content mcp_oauth.token;
|
||||
}
|
||||
|
||||
# Internal auth_request hook used by the protected MCP endpoint.
|
||||
location = /_oauth_check {
|
||||
internal;
|
||||
js_content mcp_oauth.check;
|
||||
}
|
||||
|
||||
# --- Protected Streamable HTTP MCP endpoint --------------------------------
|
||||
# Requires successful OAuth check before proxying to the upstream server.
|
||||
location ^~ /__MCP_SLUG__/mcp/ {
|
||||
auth_request /_oauth_check;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header Authorization "";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
# Streaming friendly defaults
|
||||
proxy_request_buffering off;
|
||||
proxy_buffering off;
|
||||
proxy_read_timeout 1d;
|
||||
proxy_send_timeout 1d;
|
||||
proxy_connect_timeout 30s;
|
||||
|
||||
# Advertise latest protocol version if desired
|
||||
# proxy_set_header MCP-Protocol-Version "2025-06-18";
|
||||
|
||||
proxy_pass http://mcp_streamable_backend;
|
||||
}
|
||||
|
||||
# --- Optional unauthenticated SSE bridge for local debugging ---------------
|
||||
location ^~ /__MCP_SLUG__/mcp-browser/ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-NginX-Proxy true;
|
||||
|
||||
proxy_request_buffering off;
|
||||
proxy_buffering off;
|
||||
proxy_cache off;
|
||||
proxy_read_timeout 1d;
|
||||
proxy_send_timeout 1d;
|
||||
send_timeout 1d;
|
||||
keepalive_timeout 1d;
|
||||
|
||||
proxy_pass http://mcp_browser_backend/servers/mcp-browser/sse;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
# Minimal NGINX reverse proxy for MCP Browser SSE bridge
|
||||
#
|
||||
# This configuration omits OAuth and exposes only the unauthenticated SSE
|
||||
# endpoint. It is intended for quick local setup (e.g. tunnelling the bridge
|
||||
# to the OpenAI MCP interface) and should not be used on the public Internet
|
||||
# without adding authentication.
|
||||
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
upstream mcp_browser_backend {
|
||||
server 127.0.0.1:8251;
|
||||
keepalive 4;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name mcp-dev.example.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/mcp-dev.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/mcp-dev.example.com/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
add_header X-Robots-Tag "noindex, nofollow, noarchive" always;
|
||||
|
||||
# Replace __MCP_SLUG__ with your private slug value.
|
||||
location ^~ /__MCP_SLUG__/mcp-browser/ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-NginX-Proxy true;
|
||||
|
||||
proxy_request_buffering off;
|
||||
proxy_buffering off;
|
||||
proxy_cache off;
|
||||
proxy_read_timeout 1d;
|
||||
proxy_send_timeout 1d;
|
||||
send_timeout 1d;
|
||||
keepalive_timeout 1d;
|
||||
|
||||
proxy_pass http://mcp_browser_backend/servers/mcp-browser/sse;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
[Unit]
|
||||
Description=Expose MCP Browser via HTTP bridge
|
||||
Documentation=https://github.com/Xilope0/mcp-browser
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment="PYTHONUNBUFFERED=1"
|
||||
Environment="MCP_PROXY_BIN=%h/.local/bin/mcp-proxy"
|
||||
Environment="MCP_PROXY_ALLOW_ORIGIN=https://platform.openai.com"
|
||||
Environment="MCP_PROXY_PORT=14001"
|
||||
Environment="MCP_PROXY_CONFIG=%h/.config/mcp-browser/proxy.yaml"
|
||||
Environment="MCP_PROXY_EXTRA_ARGS="
|
||||
EnvironmentFile=-%h/.config/mcp-browser/proxy.env
|
||||
|
||||
ExecStart=/usr/bin/env sh -c '\
|
||||
set -eu; \
|
||||
exec "$MCP_PROXY_BIN" \
|
||||
--allow-origin "$MCP_PROXY_ALLOW_ORIGIN" \
|
||||
--port "$MCP_PROXY_PORT" \
|
||||
--named-server-config "$MCP_PROXY_CONFIG" \
|
||||
$MCP_PROXY_EXTRA_ARGS'
|
||||
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
NoNewPrivileges=yes
|
||||
ProtectSystem=strict
|
||||
ProtectHome=read-only
|
||||
PrivateTmp=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectKernelModules=yes
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
RestrictSUIDSGID=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictNamespaces=yes
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
[Unit]
|
||||
Description=Maintain SSH reverse tunnel for MCP endpoints
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Environment="MCP_TUNNEL_HOST=mcp.example.com"
|
||||
Environment="MCP_TUNNEL_USER=mcp"
|
||||
Environment="MCP_TUNNEL_KEY=%h/.ssh/mcp_reverse"
|
||||
Environment="MCP_REMOTE_STREAMABLE_PORT=8250"
|
||||
Environment="MCP_LOCAL_STREAMABLE_PORT=14000"
|
||||
Environment="MCP_REMOTE_BROWSER_PORT=8251"
|
||||
Environment="MCP_LOCAL_BROWSER_PORT=14001"
|
||||
Environment="MCP_TUNNEL_EXTRA_ARGS="
|
||||
EnvironmentFile=-%h/.config/mcp-browser/tunnel.env
|
||||
|
||||
ExecStart=/usr/bin/env sh -c '\
|
||||
set -eu; \
|
||||
exec /usr/bin/ssh -F /dev/null -i "$MCP_TUNNEL_KEY" -NT \
|
||||
-o ExitOnForwardFailure=yes \
|
||||
-o ServerAliveInterval=15 \
|
||||
-o ServerAliveCountMax=3 \
|
||||
-o StreamLocalBindUnlink=yes \
|
||||
-R 127.0.0.1:"$MCP_REMOTE_STREAMABLE_PORT":127.0.0.1:"$MCP_LOCAL_STREAMABLE_PORT" \
|
||||
-R 127.0.0.1:"$MCP_REMOTE_BROWSER_PORT":127.0.0.1:"$MCP_LOCAL_BROWSER_PORT" \
|
||||
$MCP_TUNNEL_EXTRA_ARGS \
|
||||
"$MCP_TUNNEL_USER@$MCP_TUNNEL_HOST"'
|
||||
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
NoNewPrivileges=yes
|
||||
ProtectSystem=strict
|
||||
ProtectHome=read-only
|
||||
PrivateTmp=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectKernelModules=yes
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
RestrictSUIDSGID=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictNamespaces=yes
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
ReadOnlyPaths=%h/.ssh
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
Loading…
Reference in New Issue