Add Dockerfile + Gitea Actions workflow for mcp-grafana container

- Dockerfile: fetches pinned upstream release binary (static Go) from
  grafana/mcp-grafana GitHub releases, sha256-verified against the
  release's own checksums file, runs from scratch.
- Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch;
  resolves newest release, skips if tag published, pushes
  gitea.williammiceli.systems/hermes/grafana-mcp:v<ver> + :latest.
- REGISTRY_TOKEN repo Actions secret already provisioned.

.gitea/workflows/build.yaml

@@ -0,0 +1,109 @@
+# Builds and publishes the grafana-mcp (Grafana MCP server) container image
+# to the Gitea registry. This repo deliberately contains no build process
+# that depends on Hermes' container — Gitea Actions builds and pushes it
+# standalone.
+#
+# Triggers:
+#   - push to main (e.g. bumping the Dockerfile default version ARG)
+#   - weekly schedule, Mon 06:00 UTC — resolves the newest upstream release
+#     and builds it if not yet published, ~7h BEFORE the cluster0
+#     image-update cron (Mon 13:00 UTC) so the Monday pass picks it up like
+#     any other app.
+#   - workflow_dispatch with an explicit version input
+name: build
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'grafana/mcp-grafana GitHub release (empty = latest)'
+        required: false
+        default: ''
+
+env:
+  REGISTRY: gitea.williammiceli.systems
+  IMAGE: gitea.williammiceli.systems/hermes/grafana-mcp
+
+jobs:
+  build:
+    runs-on: ubuntu-latest # cluster0 Gitea runner (registers this label; has docker + network)
+    # Minimal explicit scopes: read code (checkout), write packages (registry push).
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Resolve upstream version
+        id: ver
+        run: |
+          if [ -n "${{ github.event.inputs.version }}" ]; then
+            VER="${{ github.event.inputs.version }}"
+          else
+            VER=$(curl -fsSL https://api.github.com/repos/grafana/mcp-grafana/releases/latest \
+              | python3 -c "import sys,json;print(json.load(sys.stdin)['tag_name'])")
+          fi
+          [ -n "$VER" ] || { echo "could not resolve upstream version"; exit 1; }
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
+          echo "Resolved grafana/mcp-grafana version: $VER"
+
+      - name: Skip if already published
+        id: skip
+        run: |
+          if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.version }}" >/dev/null 2>&1; then
+            echo "Image $IMAGE:v${{ steps.ver.outputs.version }} already exists — nothing to do."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Configure registry credentials
+        # Dedicated scoped PAT (repo Actions secret REGISTRY_TOKEN) — Gitea's
+        # container registry rejects scope requests from the Actions job token
+        # (upstream issue #23642). Write config.json directly; no login ping.
+        run: |
+          mkdir -p "$HOME/.docker"
+          AUTH=$(printf 'Hermes:%s' "${{ secrets.REGISTRY_TOKEN }}" | base64 -w0)
+          printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY" "$AUTH" > "$HOME/.docker/config.json"
+          chmod 600 "$HOME/.docker/config.json"
+          echo "docker config.json written for $REGISTRY"
+
+      - name: Diagnose registry auth (runs only if a later step fails)
+        if: failure()
+        # Prints only metadata (lengths, status codes) — never the token itself.
+        run: |
+          T="${{ secrets.REGISTRY_TOKEN }}"
+          echo "REGISTRY_TOKEN length: ${#T} (0 = secret empty or missing)"
+          echo "--- /v2/ ping with basic auth ---"
+          curl -s -o /dev/null -w "HTTP %{http_code}\n" -u "Hermes:$T" \
+            "https://gitea.williammiceli.systems/v2/" || true
+          echo "--- bearer-token flow (what docker push does after a 401 challenge) ---"
+          BT=$(curl -s -u "Hermes:$T" -G "https://gitea.williammiceli.systems/v2/token" \
+            --data-urlencode "service=container_registry" \
+            --data-urlencode "scope=repository:hermes/grafana-mcp:pull,push" \
+            | python3 -c "import sys,json;print(json.load(sys.stdin).get('token',''))")
+          echo "bearer token length: ${#BT}"
+          curl -s -o /dev/null -w "bearer tags/list: HTTP %{http_code}\n" \
+            -H "Authorization: Bearer $BT" \
+            "https://gitea.williammiceli.systems/v2/hermes/grafana-mcp/tags/list" || true
+
+      - name: Build
+        if: steps.skip.outputs.skip != 'true'
+        run: |
+          VER="${{ steps.ver.outputs.version }}"
+          docker build --build-arg MCP_GRAFANA_VERSION="$VER" \
+            -t "$IMAGE:v$VER" -t "$IMAGE:latest" .
+
+      - name: Push
+        if: steps.skip.outputs.skip != 'true'
+        run: |
+          VER="${{ steps.ver.outputs.version }}"
+          docker push "$IMAGE:v$VER"
+          docker push "$IMAGE:latest"

Dockerfile

@@ -0,0 +1,62 @@
+# grafana-mcp — Grafana's official MCP server (grafana/mcp-grafana) as a
+# streamable-HTTP container for cluster0.
+#
+# Built by Gitea Actions (.gitea/workflows/build.yaml):
+#   - on push to main
+#   - weekly Mon 06:00 UTC (resolves the newest upstream release, skips if
+#     the tag is already published) — lands ~7h BEFORE the cluster0
+#     image-update cron (Mon 13:00 UTC) so the Monday pass bumps the
+#     deployment tag like any other app.
+#   - on manual workflow_dispatch with an explicit version
+#
+# The upstream release is a SINGLE static Go binary, fetched from the pinned
+# GitHub release and verified against the release's own sha256 checksums
+# file. No vendored code. Published as
+# gitea.williammiceli.systems/hermes/grafana-mcp:v<version> (plus :latest).
+#
+# The upstream Grafana credentials (GRAFANA_URL is baked in as a default,
+# GRAFANA_SERVICE_ACCOUNT_TOKEN is deploy-time only) are NEVER baked into
+# this image — the token comes from the server's own Kubernetes secret
+# (Kubernetes_Cluster0, namespace ai-0-1) at deploy time.
+
+ARG MCP_GRAFANA_VERSION=v1.1.0
+
+FROM docker.io/library/alpine:3.22 AS fetch
+
+ARG MCP_GRAFANA_VERSION
+ARG TARGETARCH
+
+# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
+# upstream release. ca-certificates for HTTPS to github.com.
+RUN apk add --no-cache curl tar coreutils ca-certificates
+
+WORKDIR /tmp
+
+# Fetch the release checksums file and the linux/${TARGETARCH} tarball, then
+# verify the tarball's sha256 against the checksums file. Fails the build on
+# any mismatch (checksums.txt entries: "<sha256>  mcp-grafana_Linux_<arch>.tar.gz").
+RUN set -eux; \
+    SHORT="${MCP_GRAFANA_VERSION#v}"; \
+    case "$TARGETARCH" in \
+        amd64) ASSET="Linux_x86_64" ;; \
+        arm64) ASSET="Linux_arm64" ;; \
+        *) echo "unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \
+    curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o mcp.tar.gz; \
+    grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \
+    tar -xzf mcp.tar.gz mcp-grafana; \
+    chmod +x mcp-grafana
+
+# The binary is fully static (no INTERP segment) — scratch is sufficient.
+FROM scratch
+
+COPY --from=fetch /tmp/mcp-grafana /mcp-grafana
+
+EXPOSE 3000
+
+# streamable-http on all interfaces, port 3000 (the service port).
+# --allowed-hosts is supplied by the Deployment args (DNS-rebinding
+# protection: only the in-cluster service hostname is trusted).
+# GRAFANA_URL + GRAFANA_SERVICE_ACCOUNT_TOKEN come from the pod env.
+ENTRYPOINT ["/mcp-grafana", "--transport", "streamable-http", "--address", "0.0.0.0:3000"]

README.md

@@ -0,0 +1,49 @@
+# grafana-mcp
+
+[Grafana's official MCP server](https://github.com/grafana/mcp-grafana)
+(`mcp-grafana`) packaged as a container image for cluster0, served over
+streamable-HTTP so the Hermes agent (namespace `ai-0`) can call it as an
+HTTP MCP server.
+
+## What's in this repo
+
+| File | Purpose |
+|---|---|
+| `Dockerfile` | Multi-stage: fetches the pinned upstream release binary from GitHub (sha256-verified against the release's own checksums file) and copies it into `scratch` (the binary is fully static). |
+| `.gitea/workflows/build.yaml` | Builds + pushes `gitea.williammiceli.systems/hermes/grafana-mcp:v<version>` (+ `latest`). Triggers: push to main, **weekly Mon 06:00 UTC** (lands before the cluster0 image-update cron at Mon 13:00 UTC), and manual dispatch. Skips if the tag already exists. |
+
+The upstream version is pinned via the `MCP_GRAFANA_VERSION` build-arg
+(default `v1.1.0`); the workflow resolves the newest GitHub release and
+skips the build when it's already published.
+
+## Deployment (cluster0)
+
+Manifests: `William/Kubernetes_Cluster0`, app dir
+`cluster0 (Personal)/#active/#applications/ai-0 (Hermes Agent)/ai-0-1 (Grafana MCP)/`,
+namespace `ai-0-1`.
+
+Runtime env (set by the Deployment, from the server's own Infisical-managed
+secret — never baked into the image):
+
+| Var | Value |
+|---|---|
+| `GRAFANA_URL` | `http://grafana-service.personal-0.svc.cluster.local` |
+| `GRAFANA_SERVICE_ACCOUNT_TOKEN` | Grafana service-account token (Infisical project `ai-0-1`) |
+| `ALLOWED_HOSTS` (Deployment env, read by args) | `grafana-mcp-service.ai-0-1.svc.cluster.local` |
+
+The service is **ClusterIP-only** (no Ingress/NodePort): it exposes Will's
+Grafana instance, so only in-cluster consumers can reach it. Hermes consumes
+it via `http://grafana-mcp-service.ai-0-1.svc.cluster.local:3000/mcp`.
+
+### Grafana service account
+
+Create in Grafana (Administration → Service Accounts) with the **Editor**
+built-in role (upstream-recommended quick setup; covers all read + most
+write tools) or granular RBAC scopes, then add a token and store it as
+`GRAFANA_SERVICE_ACCOUNT_TOKEN` in Infisical project `ai-0-1` (env `prod`).
+
+## Registry auth for pushes
+
+The workflow uses a scoped PAT (`write:package`) stored as repo Actions
+secret `REGISTRY_TOKEN` — Gitea's container registry rejects scoped token
+requests from the Actions job token (upstream #23642).