unifi-network-mcp image: Dockerfile + Gitea Actions build workflow + README

Dockerfile

@@ -0,0 +1,42 @@
+# unifi-network-mcp — the UniFi Network MCP server (unifi-network-mcp on
+# PyPI, from sirkirby/unifi-mcp) as a streamable-HTTP container for cluster0.
+#
+# Built by Gitea Actions (.gitea/workflows/build.yaml):
+#   - on push to main
+#   - weekly Mon 06:00 UTC (resolves newest published upstream, skips if unchanged)
+#   - on manual workflow_dispatch with an explicit version
+#
+# The upstream unifi-network-mcp version is pinned via the
+# UNIFI_NETWORK_MCP_VERSION build-arg. Published as
+# gitea.williammiceli.systems/hermes/unifi-network-mcp:v<version> (plus
+# :latest). The cluster0 image-update cron then bumps the deployment tag
+# like any other app.
+#
+# Controller credentials (UNIFI_HOST / UNIFI_USERNAME / UNIFI_PASSWORD) are
+# injected at deploy time from the server's own Kubernetes secret — they are
+# NEVER baked into this image.
+
+ARG UNIFI_NETWORK_MCP_VERSION=0.27.1
+
+FROM docker.io/library/python:3.13-slim
+
+ARG UNIFI_NETWORK_MCP_VERSION
+RUN pip install --no-cache-dir unifi-network-mcp==${UNIFI_NETWORK_MCP_VERSION}
+
+# This image exists to serve streamable-HTTP MCP in-cluster, so enable the
+# HTTP transport here (upstream default is stdio). As PID 1 the server runs
+# HTTP-only (stdio is skipped when no client is attached to stdin).
+ENV UNIFI_MCP_HTTP_ENABLED=true
+ENV UNIFI_MCP_HTTP_TRANSPORT=streamable-http
+# Bind all interfaces by default; UNIFI_MCP_ALLOWED_HOSTS is set by the
+# Deployment (the server's DNS-rebinding protection validates Host headers
+# against this allowlist).
+ENV UNIFI_MCP_HOST=0.0.0.0
+ENV UNIFI_MCP_PORT=3000
+EXPOSE 3000
+
+# No HEALTHCHECK: upstream exposes no /health endpoint on the HTTP transport
+# (only /mcp). The Kubernetes Deployment uses tcpSocket probes instead.
+
+# Console-script entrypoint installed by the PyPI package.
+ENTRYPOINT ["unifi-network-mcp"]