a5ee017291
Unit was hard-coding HOMELAB_MCP_SSH_USER=mcp-reader, overriding the new code's 'root' default. No mcp-reader user exists on hubris — the key is authorized for root, with a strict command= wrapper. Also pin HOMELAB_MCP_HUBRIS_HOST + KNOWN_HOSTS env so the service doesn't depend on the python defaults staying in sync with the unit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
30 lines
997 B
Desktop File
30 lines
997 B
Desktop File
[Unit]
|
|
Description=Homelab MCP server (read-only context + management)
|
|
After=network-online.target homelab-context-sync.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
WorkingDirectory=/opt/homelab-context
|
|
Environment=HOMELAB_CONTEXT_DIR=/opt/homelab-context
|
|
Environment=HOMELAB_MCP_SSH_KEY=/etc/homelab-mcp/mcp-reader.key
|
|
# SSH user is `root` on hubris — the restricted shell at command="..." in
|
|
# authorized_keys (see mcp/mcp-reader-shell) provides the access boundary,
|
|
# not a separate user account.
|
|
Environment=HOMELAB_MCP_SSH_USER=root
|
|
Environment=HOMELAB_MCP_HUBRIS_HOST=192.168.8.77
|
|
Environment=HOMELAB_MCP_SSH_KNOWN_HOSTS=/etc/homelab-mcp/known_hosts
|
|
ExecStart=/opt/homelab-mcp/.venv/bin/python /opt/homelab-mcp/mcp/server.py
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
# Stay confined.
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
NoNewPrivileges=true
|
|
ReadOnlyPaths=/opt/homelab-context /opt/homelab-mcp
|
|
ReadWritePaths=/var/log/homelab-mcp
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|