MechaCat02
359c46afad
The CLI talks only to the Pi's /api surface and holds no Schulcloud credential — only the same bearer token the Claude connector uses. That is not layering for its own sake: a Schulcloud session dies after two hours idle and a CLI process lives for seconds, so a CLI with its own token would be dead most times you reached for it. Routing through the Pi means one session, one keepalive, one monthly cookie paste. sync is a one-way mirror, which follows from the data rather than from scope-cutting: file records are immutable upstream, so there is no versioning, no conflict resolution and no merge. State is keyed by file record id with the path as derived output, so an upstream rename moves the local file instead of duplicating it — verified against the live server. Verification is size-only because the download endpoint exposes no ETag and Schulcloud publishes no hash; size still catches the failure that happens, a truncated download. Downloads land on a .part neighbour and are renamed, so an interrupted run leaves no half-file that a later run mistakes for complete. Deletions are reported but not propagated — a teacher removing a worksheet is no reason to destroy the student's copy — with --prune to opt in. what_changed now clamps to the oldest stored generation instead of refusing, and says it did: "what's new this week" is a reasonable question to ask a two-day-old index. Two build bugs caught by the checks rather than by luck: the smoke harness constructed the app without services, so the index-backed tools were never exercised; and the Docker build could not see scripts/copy-assets.mjs, so the image would have shipped without migrations and silently degraded to live-only. 67 unit tests (9 needing Postgres), smoke green both ways — 34 checks with an index, 32 without, because graceful degradation is a supported mode and not a fallback nobody runs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
47 lines
1.6 KiB
Caddyfile
47 lines
1.6 KiB
Caddyfile
# Add this to the Pi's existing Caddyfile.
|
|
#
|
|
# Caddy obtains and renews the certificate automatically, provided the VPS
|
|
# forwards ports 80 and 443 through to this Caddy and the DNS name resolves to
|
|
# the VPS's public address.
|
|
#
|
|
# The bearer-token check lives in the application, not here: Caddy would have
|
|
# to be reloaded to rotate the token, whereas the app reads it from the
|
|
# environment. Caddy's job is TLS, timeouts and keeping the container off the
|
|
# public interface.
|
|
|
|
mcp.example.org {
|
|
encode zstd gzip
|
|
|
|
# `schulcloud-mcp` is the Compose service name; Docker's embedded DNS
|
|
# resolves it on the shared network. No host port is published. One proxy
|
|
# serves both surfaces: /mcp for Claude and /api for the CLI.
|
|
reverse_proxy schulcloud-mcp:8080 {
|
|
# MCP's Streamable HTTP transport keeps a server-sent-events channel
|
|
# open for server-initiated messages. Without flush_interval -1 Caddy
|
|
# buffers those, and the connector appears to hang.
|
|
flush_interval -1
|
|
|
|
# Long enough for a full re-crawl (~270 upstream requests) and for the
|
|
# CLI streaming large files out of the mirror.
|
|
transport http {
|
|
read_timeout 600s
|
|
write_timeout 600s
|
|
}
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
Referrer-Policy "no-referrer"
|
|
-Server
|
|
}
|
|
|
|
log {
|
|
output file /var/log/caddy/schulcloud-mcp.log
|
|
format json
|
|
# Request URLs are not secrets here (the token is in a header, not the
|
|
# path), but the Authorization header must never be written to disk.
|
|
# Caddy does not log headers by default; do not add them.
|
|
}
|
|
}
|