# unifi-network-mcp — the UniFi Network MCP server (unifi-network-mcp on
# PyPI, from sirkirby/unifi-mcp) as a streamable-HTTP container for cluster0.
#
# Built by Gitea Actions (.gitea/workflows/build.yaml):
#   - on push to main
#   - weekly Mon 06:00 UTC (resolves newest published upstream, skips if unchanged)
#   - on manual workflow_dispatch with an explicit version
#
# The upstream unifi-network-mcp version is pinned via the
# UNIFI_NETWORK_MCP_VERSION build-arg. Published as
# gitea.williammiceli.systems/hermes/unifi-network-mcp:v<version> (plus
# :latest). The cluster0 image-update cron then bumps the deployment tag
# like any other app.
#
# Controller credentials (UNIFI_HOST / UNIFI_USERNAME / UNIFI_PASSWORD) are
# injected at deploy time from the server's own Kubernetes secret — they are
# NEVER baked into this image.

ARG UNIFI_NETWORK_MCP_VERSION=0.27.1

FROM docker.io/library/python:3.13-slim

ARG UNIFI_NETWORK_MCP_VERSION
RUN pip install --no-cache-dir unifi-network-mcp==${UNIFI_NETWORK_MCP_VERSION}

# This image exists to serve streamable-HTTP MCP in-cluster, so enable the
# HTTP transport here (upstream default is stdio). As PID 1 the server runs
# HTTP-only (stdio is skipped when no client is attached to stdin).
ENV UNIFI_MCP_HTTP_ENABLED=true
ENV UNIFI_MCP_HTTP_TRANSPORT=streamable-http
# Bind all interfaces by default; UNIFI_MCP_ALLOWED_HOSTS is set by the
# Deployment (the server's DNS-rebinding protection validates Host headers
# against this allowlist).
ENV UNIFI_MCP_HOST=0.0.0.0
ENV UNIFI_MCP_PORT=3000
EXPOSE 3000

# No HEALTHCHECK: upstream exposes no /health endpoint on the HTTP transport
# (only /mcp). The Kubernetes Deployment uses tcpSocket probes instead.

# Console-script entrypoint installed by the PyPI package.
ENTRYPOINT ["unifi-network-mcp"]