From 23f636a501bd7e10d3ffb914c90496f17338fd70 Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Sat, 15 Aug 2026 22:24:37 +0000 Subject: [PATCH] Add Dockerfile + Gitea Actions workflow for mcp-grafana container - Dockerfile: fetches pinned upstream release binary (static Go) from grafana/mcp-grafana GitHub releases, sha256-verified against the release's own checksums file, runs from scratch. - Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch; resolves newest release, skips if tag published, pushes gitea.williammiceli.systems/hermes/grafana-mcp:v + :latest. - REGISTRY_TOKEN repo Actions secret already provisioned. --- .gitea/workflows/build.yaml | 109 ++++++++++++++++++++++++++++++++++++ Dockerfile | 62 ++++++++++++++++++++ README.md | 49 ++++++++++++++++ 3 files changed, 220 insertions(+) create mode 100644 .gitea/workflows/build.yaml create mode 100644 Dockerfile create mode 100644 README.md diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml new file mode 100644 index 0000000..dbc0f89 --- /dev/null +++ b/.gitea/workflows/build.yaml @@ -0,0 +1,109 @@ +# Builds and publishes the grafana-mcp (Grafana MCP server) container image +# to the Gitea registry. This repo deliberately contains no build process +# that depends on Hermes' container — Gitea Actions builds and pushes it +# standalone. +# +# Triggers: +# - push to main (e.g. bumping the Dockerfile default version ARG) +# - weekly schedule, Mon 06:00 UTC — resolves the newest upstream release +# and builds it if not yet published, ~7h BEFORE the cluster0 +# image-update cron (Mon 13:00 UTC) so the Monday pass picks it up like +# any other app. +# - workflow_dispatch with an explicit version input +name: build + +on: + push: + branches: [main] + schedule: + - cron: '0 6 * * 1' + workflow_dispatch: + inputs: + version: + description: 'grafana/mcp-grafana GitHub release (empty = latest)' + required: false + default: '' + +env: + REGISTRY: gitea.williammiceli.systems + IMAGE: gitea.williammiceli.systems/hermes/grafana-mcp + +jobs: + build: + runs-on: ubuntu-latest # cluster0 Gitea runner (registers this label; has docker + network) + # Minimal explicit scopes: read code (checkout), write packages (registry push). + permissions: + contents: read + packages: write + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Resolve upstream version + id: ver + run: | + if [ -n "${{ github.event.inputs.version }}" ]; then + VER="${{ github.event.inputs.version }}" + else + VER=$(curl -fsSL https://api.github.com/repos/grafana/mcp-grafana/releases/latest \ + | python3 -c "import sys,json;print(json.load(sys.stdin)['tag_name'])") + fi + [ -n "$VER" ] || { echo "could not resolve upstream version"; exit 1; } + echo "version=$VER" >> "$GITHUB_OUTPUT" + echo "Resolved grafana/mcp-grafana version: $VER" + + - name: Skip if already published + id: skip + run: | + if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.version }}" >/dev/null 2>&1; then + echo "Image $IMAGE:v${{ steps.ver.outputs.version }} already exists — nothing to do." + echo "skip=true" >> "$GITHUB_OUTPUT" + else + echo "skip=false" >> "$GITHUB_OUTPUT" + fi + + - name: Configure registry credentials + # Dedicated scoped PAT (repo Actions secret REGISTRY_TOKEN) — Gitea's + # container registry rejects scope requests from the Actions job token + # (upstream issue #23642). Write config.json directly; no login ping. + run: | + mkdir -p "$HOME/.docker" + AUTH=$(printf 'Hermes:%s' "${{ secrets.REGISTRY_TOKEN }}" | base64 -w0) + printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY" "$AUTH" > "$HOME/.docker/config.json" + chmod 600 "$HOME/.docker/config.json" + echo "docker config.json written for $REGISTRY" + + - name: Diagnose registry auth (runs only if a later step fails) + if: failure() + # Prints only metadata (lengths, status codes) — never the token itself. + run: | + T="${{ secrets.REGISTRY_TOKEN }}" + echo "REGISTRY_TOKEN length: ${#T} (0 = secret empty or missing)" + echo "--- /v2/ ping with basic auth ---" + curl -s -o /dev/null -w "HTTP %{http_code}\n" -u "Hermes:$T" \ + "https://gitea.williammiceli.systems/v2/" || true + echo "--- bearer-token flow (what docker push does after a 401 challenge) ---" + BT=$(curl -s -u "Hermes:$T" -G "https://gitea.williammiceli.systems/v2/token" \ + --data-urlencode "service=container_registry" \ + --data-urlencode "scope=repository:hermes/grafana-mcp:pull,push" \ + | python3 -c "import sys,json;print(json.load(sys.stdin).get('token',''))") + echo "bearer token length: ${#BT}" + curl -s -o /dev/null -w "bearer tags/list: HTTP %{http_code}\n" \ + -H "Authorization: Bearer $BT" \ + "https://gitea.williammiceli.systems/v2/hermes/grafana-mcp/tags/list" || true + + - name: Build + if: steps.skip.outputs.skip != 'true' + run: | + VER="${{ steps.ver.outputs.version }}" + docker build --build-arg MCP_GRAFANA_VERSION="$VER" \ + -t "$IMAGE:v$VER" -t "$IMAGE:latest" . + + - name: Push + if: steps.skip.outputs.skip != 'true' + run: | + VER="${{ steps.ver.outputs.version }}" + docker push "$IMAGE:v$VER" + docker push "$IMAGE:latest" diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..ee58a14 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,62 @@ +# grafana-mcp — Grafana's official MCP server (grafana/mcp-grafana) as a +# streamable-HTTP container for cluster0. +# +# Built by Gitea Actions (.gitea/workflows/build.yaml): +# - on push to main +# - weekly Mon 06:00 UTC (resolves the newest upstream release, skips if +# the tag is already published) — lands ~7h BEFORE the cluster0 +# image-update cron (Mon 13:00 UTC) so the Monday pass bumps the +# deployment tag like any other app. +# - on manual workflow_dispatch with an explicit version +# +# The upstream release is a SINGLE static Go binary, fetched from the pinned +# GitHub release and verified against the release's own sha256 checksums +# file. No vendored code. Published as +# gitea.williammiceli.systems/hermes/grafana-mcp:v (plus :latest). +# +# The upstream Grafana credentials (GRAFANA_URL is baked in as a default, +# GRAFANA_SERVICE_ACCOUNT_TOKEN is deploy-time only) are NEVER baked into +# this image — the token comes from the server's own Kubernetes secret +# (Kubernetes_Cluster0, namespace ai-0-1) at deploy time. + +ARG MCP_GRAFANA_VERSION=v1.1.0 + +FROM docker.io/library/alpine:3.22 AS fetch + +ARG MCP_GRAFANA_VERSION +ARG TARGETARCH + +# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned +# upstream release. ca-certificates for HTTPS to github.com. +RUN apk add --no-cache curl tar coreutils ca-certificates + +WORKDIR /tmp + +# Fetch the release checksums file and the linux/${TARGETARCH} tarball, then +# verify the tarball's sha256 against the checksums file. Fails the build on +# any mismatch (checksums.txt entries: " mcp-grafana_Linux_.tar.gz"). +RUN set -eux; \ + SHORT="${MCP_GRAFANA_VERSION#v}"; \ + case "$TARGETARCH" in \ + amd64) ASSET="Linux_x86_64" ;; \ + arm64) ASSET="Linux_arm64" ;; \ + *) echo "unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \ + esac; \ + curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \ + curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o mcp.tar.gz; \ + grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \ + tar -xzf mcp.tar.gz mcp-grafana; \ + chmod +x mcp-grafana + +# The binary is fully static (no INTERP segment) — scratch is sufficient. +FROM scratch + +COPY --from=fetch /tmp/mcp-grafana /mcp-grafana + +EXPOSE 3000 + +# streamable-http on all interfaces, port 3000 (the service port). +# --allowed-hosts is supplied by the Deployment args (DNS-rebinding +# protection: only the in-cluster service hostname is trusted). +# GRAFANA_URL + GRAFANA_SERVICE_ACCOUNT_TOKEN come from the pod env. +ENTRYPOINT ["/mcp-grafana", "--transport", "streamable-http", "--address", "0.0.0.0:3000"] diff --git a/README.md b/README.md new file mode 100644 index 0000000..c476b6d --- /dev/null +++ b/README.md @@ -0,0 +1,49 @@ +# grafana-mcp + +[Grafana's official MCP server](https://github.com/grafana/mcp-grafana) +(`mcp-grafana`) packaged as a container image for cluster0, served over +streamable-HTTP so the Hermes agent (namespace `ai-0`) can call it as an +HTTP MCP server. + +## What's in this repo + +| File | Purpose | +|---|---| +| `Dockerfile` | Multi-stage: fetches the pinned upstream release binary from GitHub (sha256-verified against the release's own checksums file) and copies it into `scratch` (the binary is fully static). | +| `.gitea/workflows/build.yaml` | Builds + pushes `gitea.williammiceli.systems/hermes/grafana-mcp:v` (+ `latest`). Triggers: push to main, **weekly Mon 06:00 UTC** (lands before the cluster0 image-update cron at Mon 13:00 UTC), and manual dispatch. Skips if the tag already exists. | + +The upstream version is pinned via the `MCP_GRAFANA_VERSION` build-arg +(default `v1.1.0`); the workflow resolves the newest GitHub release and +skips the build when it's already published. + +## Deployment (cluster0) + +Manifests: `William/Kubernetes_Cluster0`, app dir +`cluster0 (Personal)/#active/#applications/ai-0 (Hermes Agent)/ai-0-1 (Grafana MCP)/`, +namespace `ai-0-1`. + +Runtime env (set by the Deployment, from the server's own Infisical-managed +secret — never baked into the image): + +| Var | Value | +|---|---| +| `GRAFANA_URL` | `http://grafana-service.personal-0.svc.cluster.local` | +| `GRAFANA_SERVICE_ACCOUNT_TOKEN` | Grafana service-account token (Infisical project `ai-0-1`) | +| `ALLOWED_HOSTS` (Deployment env, read by args) | `grafana-mcp-service.ai-0-1.svc.cluster.local` | + +The service is **ClusterIP-only** (no Ingress/NodePort): it exposes Will's +Grafana instance, so only in-cluster consumers can reach it. Hermes consumes +it via `http://grafana-mcp-service.ai-0-1.svc.cluster.local:3000/mcp`. + +### Grafana service account + +Create in Grafana (Administration → Service Accounts) with the **Editor** +built-in role (upstream-recommended quick setup; covers all read + most +write tools) or granular RBAC scopes, then add a token and store it as +`GRAFANA_SERVICE_ACCOUNT_TOKEN` in Infisical project `ai-0-1` (env `prod`). + +## Registry auth for pushes + +The workflow uses a scoped PAT (`write:package`) stored as repo Actions +secret `REGISTRY_TOKEN` — Gitea's container registry rejects scoped token +requests from the Actions job token (upstream #23642).