feat: add mcp-homelab jarvis agent

2026-03-28 12:28:01 +01:00
parent b699ec21a6
commit 463aa300ee
10 changed files with 606 additions and 0 deletions
@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: mcp-homelab
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./clusters/homelab/apps/mcp-homelab
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homelab          # dein bestehendes GitRepository-Objekt
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age       # dein bestehendes SOPS-Secret
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: mcp-homelab
+      namespace: mcp-homelab
@@ -0,0 +1,105 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mcp-homelab
+  namespace: mcp-homelab
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mcp-homelab
+  template:
+    metadata:
+      labels:
+        app: mcp-homelab
+    spec:
+      serviceAccountName: mcp-homelab
+      imagePullSecrets:
+        - name: gitea-registry
+
+      volumes:
+        - name: obsidian-repo
+          emptyDir: {}
+
+      initContainers:
+        - name: git-clone
+          image: alpine/git:latest
+          command:
+            - git
+            - clone
+            - --depth=1
+            - $(OBSIDIAN_GIT_URL)
+            - /obsidian
+          volumeMounts:
+            - name: obsidian-repo
+              mountPath: /obsidian
+          env:
+            - name: OBSIDIAN_GIT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: mcp-homelab-secret
+                  key: obsidian-git-url
+
+      containers:
+        - name: mcp-server
+          image: gittea.net-scope.org/admin/mcp-homelab:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8000
+              name: http
+          env:
+            - name: POSTGRES_DSN_MAP
+              valueFrom:
+                secretKeyRef:
+                  name: mcp-homelab-secret
+                  key: postgres-dsn-map
+            - name: OBSIDIAN_ROOT
+              value: /obsidian
+          volumeMounts:
+            - name: obsidian-repo
+              mountPath: /obsidian
+              readOnly: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          readinessProbe:
+            httpGet:
+              path: /mcp
+              port: 8000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /mcp
+              port: 8000
+            initialDelaySeconds: 15
+            periodSeconds: 30
+
+        - name: git-sync
+          image: registry.k8s.io/git-sync/git-sync:v4.3.0
+          args:
+            - --repo=$(OBSIDIAN_GIT_URL)
+            - --root=/obsidian
+            - --link=current
+            - --period=5m
+            - --depth=1
+          env:
+            - name: OBSIDIAN_GIT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: mcp-homelab-secret
+                  key: obsidian-git-url
+          volumeMounts:
+            - name: obsidian-repo
+              mountPath: /obsidian
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - secret.sops.yaml
+  - deployment.yaml
+  - service.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mcp-homelab
@@ -0,0 +1,43 @@
+#ENC[AES256_GCM,data:aWH6HGsACsPR4CNnd0bbOTQNLHKajxgyv9xILSxqycXR8NlX2y95QjVUwITdQsExm4UewEU8w/o1sZbNzJyELBCWmpKx,iv:wh9B0u2QKDacUYuF34idj2gZPo5fbKPi0jiWgUNV54U=,tag:j55j8+GjdcJ4F2m7NgzsFg==,type:comment]
+#
+#ENC[AES256_GCM,data:y4Vv8sYtYjBsln103TfImseoAaFavvY2ZRCMPKykL7wPLk/j24MYyqxUjYD8aI8eGdN/7Br1Bmg=,iv:zeblUfh1qqtfA0Mo4nQTQI3iAtkHLKpaBeLlu/WGoek=,tag:V6MEyn0So0dxZekGHtYK6Q==,type:comment]
+#ENC[AES256_GCM,data:IXxQwsbZCfu+1q8hWGs2TZQMv3b8gJN5aoNnsxC5CLIo5Azo1+Uai0xhXCnlsfHMaKyWA4D5IRtbY5tNrVN1QTDYZULpBOvc8z6TThac8LxeLK/4mBGk5Ze0,iv:sb9blCNvZaY+JVsm3xVlUI8uiA3QEylZtA3PsP4hupA=,tag:aEoT4P8l1cuBEeWdpycMQA==,type:comment]
+#ENC[AES256_GCM,data:ofN+IuJiOkb6eacB85fc6EA7jdaR0YgBx3mpRmzsSQ67uaw5tcm5WXeOu0y1fG4OS2oO1KYgkybBTM1axXGSpwa314KCKqmzOy0PJQ==,iv:eJ7fJuD+kFlaoelEZ1Zxvx7tk3jS5u0GfciNP8LGCKA=,tag:Hxb2sKw25jr9nECsekE3Ig==,type:comment]
+#
+#ENC[AES256_GCM,data:m7EBfqgMmhq/ck9mhaWNeo93iV9U55f+EvffAO+Quj8ll1PRI33+kr1UrssaMLd6ALk54WoSuAKUz49OnAjyBBKXzW4=,iv:/jonyVWRMeb0ws2xTY0vco3UZA+KUuraJv887bScpw8=,tag:5Oi7dwzVV7OdFlj0LD2xgQ==,type:comment]
+#ENC[AES256_GCM,data:sjctJ1bxGUcFcSleSU6SATbDFuI8PG5/nYijCGr1/ZTaD4ajXyeqnVVFHp+aVrzZJAsf68P897qa1EuB/w04caljZnwC/Xfh,iv:FbjN464MOM4k1YCQNOArIzcBdY4w6P3Lv/+9TS0gmeE=,tag:7TcXsQ3uyeRcdeDB+CqxQw==,type:comment]
+#
+#ENC[AES256_GCM,data:qiJH+xqbWrDYrioVEqp19/2Z2k29iYpFgs0YWhaoDZNL027S5nxGN8mkAvG55fUayrBiARHL,iv:fGcGYKp5rSIL2W5PK+o1xT3ggkyiRxKpEvoJd2OT2XI=,tag:G3tMfzKlXG9otAfAZD4y9A==,type:comment]
+#ENC[AES256_GCM,data:sDfPM45xav786JSBDfJGoW46DeQFFDR1+/Qx7LgGbIZ9PtG5YdBpab932QJjTIpOaGB/U8cfI0jN3xsJkrMDLWHcJf7zW3bxw2JJDifu5g==,iv:P4XkdXbjSyYFSkXcIsxxKrmh3Ri6A5RB92z+ubb48NQ=,tag:KMikrrlbpC0Je0jXqEDNcQ==,type:comment]
+#ENC[AES256_GCM,data:bEbQxtuwW7otEgParlh1VuVA/MUCULaRY0vt3f1hGWU5rf+4ngguBY0toE7OQnsGxc8C/OwGVAVS0AJGkJs2wPIyJv6lYyoWpL+TcOAzbSrQdPAfj+Ch7Wm5V0Ws,iv:MqakFV6hsFwJazhSuy7WaQjJd5n3ULUm4ja3Jt6nDh8=,tag:0V85t0TEstuIH9jYuwGPhA==,type:comment]
+apiVersion: ENC[AES256_GCM,data:lmI=,iv:AtOXGIjF5WlitRyc6rBf6AWbcxZoiD9h4FUzpkAMEBs=,tag:7DgvZCrwLMV/ftO7/ITqlQ==,type:str]
+kind: ENC[AES256_GCM,data:jjAxX6/S,iv:Z16uZIVpDXWeW1Tb5x1LX5a4gEoOqqK147j+w2P1J6I=,tag:OalEXJUr8bKR2amkXvumSA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:FaqxQ0xe4PsKz8XXVvJecR3f,iv:EDMG+9c1+MTzcepVSQMr9V/+3r448hcm5VvljY/pkts=,tag:UD+dGESPftkjmdtHE4nYvg==,type:str]
+    namespace: ENC[AES256_GCM,data:qfrKbojLx2r80Vg=,iv:yCHoANU0YMCVk+7XyaZaJ4XmcnuDeAmRpvZ+/tVBwsY=,tag:VoCDjBYdLwO0UYHIrwpQXg==,type:str]
+type: ENC[AES256_GCM,data:Wm3M3d+C,iv:DNE5u1Me8cDKFvLBuHYfhO4lWUaEIapCSEIa5HGcN2g=,tag:oMOlPocK1f/fXaFFsU5VQQ==,type:str]
+stringData:
+    postgres-dsn-map: ENC[AES256_GCM,data:QhZ9oPJKPdo1JejgYdCRioRYSnMG2rPeFK7FiNHMyxwAkTE1Eo+w7KQSyg23FaZjlOiqQLsuhDOcxsOQQHU96tH/TxaFYyyZQHpE2RmY3uPhxtwxkA==,iv:yfl68UoTsDrefPqja99csaZe6EyusxvT76gcd7Xuha8=,tag:BhlDuxCWMGFNpdVqiU+E9g==,type:str]
+    obsidian-git-url: ENC[AES256_GCM,data:7XjpAD6J+SHocyGzB8OTOYSCHoiX/vk13FJzBr98dmypti8jgscjzm4/ra684UYgtwmjWCxB++msOQaHA+Rem4Veo5cUxGCpewUTJfGCzaEM,iv:EEmVyQrydUUT2PjhYve3Ne7P5HLnv5HReF4a31FYyOk=,tag:xkiHplMffn8md4FqSsuh4g==,type:str]
+data:
+    .dockerconfigjson: ENC[AES256_GCM,data:hTR/Nu6pn5tYukkA2DL6LTzF7xHxK8JhozikA2A69F2BdAOBoR5qs9VhcCBge1g3rYlJhcipxXpyh49nsNDKw4nmElmsdxwqtLts784i5QqteUib04+M6rXgL8ims4nFif2hBKO7KdSOQZG3ifVWWcKssO6lag/R8U6Br8EwsH3S/qMzi3C6wLsxbXiJ14D3f8efXA==,iv:YXXI9OvNCJZx0JUFWd92z5qomtaYjojwiwGtrdQswnE=,tag:fwaV+FzZYYsYA3LJXVLTNw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUMFJIY2J3NU5STExjOFY3
+            MTVTTkU2L2tkSUNla0V6RjN4dTBKTC95cXgwCllzRFVnTHR5MWEzN21mbkVwRGNX
+            ZW5md3VBaFpOQmlTbXZMS290TUVNdHMKLS0tIGY4ckR0VVQ5anVzYWNKcDBVY2VM
+            djNWcjVrQkcrOG5SbVAyRjI4RU5HUFUKBFiAp/eh9mUvM7LitqK5A/iOyDSr6+93
+            nJXpIm3gQg8sTXauycMWU7WJ/nSa4UHVDVMr7FZxRIcGJdHm8Iz5mg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-28T10:42:22Z"
+    mac: ENC[AES256_GCM,data:TKsn8y9wTo1sWIbwxH/s6PFB5HbQxlnTCz1m9KHpJyWwrsUpFhCM7VCoIJWBZDTnzuNK7xy/rc5kBgXI52lADywA6KZdzYBAvSwKIEBN/cccIu3SKnrRxbr9xP3uTZd2LCiqx4Nf9pRwU0bBkTerCt54FZ/YY5Tw1CBbrL7KtR8=,iv:LLM9NNPDnmg/xLTcGkM04SMLisRLFd/ksMJ/JQHFo50=,tag:3yXGjUl3wR66kgFgsYwHAA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mcp-homelab
+  namespace: mcp-homelab
+spec:
+  selector:
+    app: mcp-homelab
+  ports:
+    - name: http
+      port: 8000
+      targetPort: 8000
+  type: ClusterIP
@@ -0,0 +1,60 @@
+# ServiceAccount fuer den MCP-Server Pod
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mcp-homelab
+  namespace: mcp-homelab
+---
+# ClusterRole: ausschliesslich lesender Zugriff auf erlaubte Ressourcen.
+# Bewusst restriktiver als "view" ClusterRole — keine Secrets, keine RBAC-Objekte.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: mcp-homelab-reader
+rules:
+  - apiGroups: [""]
+    resources:
+      - pods
+      - pods/log
+      - services
+      - nodes
+      - events
+      - configmaps
+      - persistentvolumeclaims
+      - namespaces
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources:
+      - deployments
+      - replicasets
+      - statefulsets
+      - daemonsets
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["kustomize.toolkit.fluxcd.io"]
+    resources: ["kustomizations"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["helm.toolkit.fluxcd.io"]
+    resources: ["helmreleases"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["source.toolkit.fluxcd.io"]
+    resources:
+      - gitrepositories
+      - helmrepositories
+      - imagerepositories
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["postgresql.cnpg.io"]
+    resources: ["clusters"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: mcp-homelab-reader
+subjects:
+  - kind: ServiceAccount
+    name: mcp-homelab
+    namespace: mcp-homelab
+roleRef:
+  kind: ClusterRole
+  name: mcp-homelab-reader
+  apiGroup: rbac.authorization.k8s.io