Remove the Forgejo MCP connector: servers on dev/dev-new, the public endpoint, and its OIDC client #288

New issue

Closed

opened 2026-08-07 22:27:31 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-08-07 22:27:31 +02:00

Owner

Part of #266. Remove the Forgejo MCP connector entirely — the forgejo-mcp servers, the public endpoint that fronted them, and the OIDC client that gated it. Decided during the Keycloak migration: it was the one Authelia client not migrated (#279), and the bespoke OIDC flow that fronted it has no Keycloak equivalent worth rebuilding.

This is a feature removal, not dead-code cleanup: mcp-forgejo.cloonar.com currently works. Afterwards Claude.ai can no longer reach Forgejo as a remote MCP connector, and the connector should be deleted on the Claude.ai side too.

Scope

The servers — `dev` and `dev-new`

Both hosts run their own instance; remove from both. hosts/fw/configuration.nix:43 shows dev's microvm import is currently commented out in favour of dev-new, but its config is retained as a documented fallback, so leaving one behind would make the fallback inconsistent.

Delete hosts/dev/modules/forgejo-mcp.nix and hosts/dev-new/modules/forgejo-mcp.nix. Each carries the forgejo-mcp user/group, the systemd unit on port 8090, the sops.secrets.forgejo-mcp-token declaration, and an nftables rule ip saddr 10.42.97.5 tcp dport 8090 accept.
Drop the imports at hosts/dev/configuration.nix:16 and hosts/dev-new/configuration.nix:17.

The public endpoint — web-02

Delete hosts/fw/vms/web/mcp-forgejo.nix — the vhost plus the hand-rolled OIDC flow against Authelia's /api/oidc/{authorization,token,userinfo} and the auth_request /_oidc_check bearer gate.
Drop the import at hosts/fw/vms/web/default.nix:81.

DNS — fw

hosts/fw/modules/ddclient.nix:23 — remove "mcp-forgejo.cloonar.com".
hosts/fw/modules/dnsmasq.nix:130 — remove the split-horizon entry.

The OIDC client — web-arm

hosts/web-arm/modules/authelia.nix:324-362 — remove the claude-mcp-forgejo client entry, including its audience / requested_audience_mode RFC 8707 block.

Authelia is still live and serving nothing else via forward-auth, so removing one client is safe. There is no cross-host deploy-ordering constraint: the whole feature is going away, so it does not matter whether the vhost or the client disappears first.

Comments vs. ADRs — treat them differently

Update stale code comments that assert something false about the current configuration once this lands: hosts/dev-new/configuration.nix:45 ("lab.cloonar.com / mcp-forgejo / dev.cloonar.com keep working unchanged"), hosts/fw/configuration.nix:43, and hosts/fw/modules/dnsmasq.nix:116. Drop the mcp-forgejo mention; leave the surrounding rationale intact.

Do not edit the ADRs. docs/adr/0005 and docs/adr/0022 both reference mcp-forgejo. They record decisions as they were made, and rewriting them to erase a service that existed at the time falsifies the record. ADR-0022 already documents the decision to drop it.

Human steps

Secrets (per CLAUDE.md the agent does not touch these) — after the PR merges, so no module still declares them:

hosts/dev/secrets.yaml — forgejo-mcp-token
hosts/dev-new/secrets.yaml — forgejo-mcp-token
hosts/fw/vms/web/secrets.yaml — forgejo-mcp-client-secret

Also:

Revoke the claude-mcp bot's PAT in Forgejo, and delete the bot account if it serves nothing else. The token is the actual credential here — deleting the sops entry only removes the copy.
Delete the public mcp-forgejo.cloonar.com DNS record at the provider. Removing it from ddclient stops updates but does not remove the record.
Remove the Forgejo connector from Claude.ai.

Out of scope

Retiring Authelia (M6) — this removes one client, not the module.
The other dead-config removals in the sibling cleanup issue.

Verification

scripts/pre-commit dry-builds the affected hosts (dev, dev-new, fw, web-arm).

Human, after deploy:

https://mcp-forgejo.cloonar.com no longer resolves or serves.
systemctl status forgejo-mcp on dev-new — unit gone.
Authelia still works for nothing else that matters, but confirm auth.cloonar.com itself still comes up — the client list changed, and a malformed identity_providers.oidc.clients entry fails Authelia at startup.
lab.cloonar.com and the six Keycloak clients are unaffected.

Part of #266. Remove the Forgejo MCP connector entirely — the `forgejo-mcp` servers, the public endpoint that fronted them, and the OIDC client that gated it. Decided during the Keycloak migration: it was the one Authelia client not migrated (#279), and the bespoke OIDC flow that fronted it has no Keycloak equivalent worth rebuilding. This is a **feature removal**, not dead-code cleanup: `mcp-forgejo.cloonar.com` currently works. Afterwards Claude.ai can no longer reach Forgejo as a remote MCP connector, and the connector should be deleted on the Claude.ai side too. ## Scope ### The servers — `dev` and `dev-new` Both hosts run their own instance; remove from both. `hosts/fw/configuration.nix:43` shows `dev`'s microvm import is currently commented out in favour of `dev-new`, but its config is retained as a documented fallback, so leaving one behind would make the fallback inconsistent. - Delete `hosts/dev/modules/forgejo-mcp.nix` and `hosts/dev-new/modules/forgejo-mcp.nix`. Each carries the `forgejo-mcp` user/group, the systemd unit on port 8090, the `sops.secrets.forgejo-mcp-token` declaration, and an nftables rule `ip saddr 10.42.97.5 tcp dport 8090 accept`. - Drop the imports at `hosts/dev/configuration.nix:16` and `hosts/dev-new/configuration.nix:17`. ### The public endpoint — web-02 - Delete `hosts/fw/vms/web/mcp-forgejo.nix` — the vhost plus the hand-rolled OIDC flow against Authelia's `/api/oidc/{authorization,token,userinfo}` and the `auth_request /_oidc_check` bearer gate. - Drop the import at `hosts/fw/vms/web/default.nix:81`. ### DNS — fw - `hosts/fw/modules/ddclient.nix:23` — remove `"mcp-forgejo.cloonar.com"`. - `hosts/fw/modules/dnsmasq.nix:130` — remove the split-horizon entry. ### The OIDC client — web-arm - `hosts/web-arm/modules/authelia.nix:324-362` — remove the `claude-mcp-forgejo` client entry, including its `audience` / `requested_audience_mode` RFC 8707 block. Authelia is still live and serving nothing else via forward-auth, so removing one client is safe. There is no cross-host deploy-ordering constraint: the whole feature is going away, so it does not matter whether the vhost or the client disappears first. ## Comments vs. ADRs — treat them differently **Update stale code comments** that assert something false about the current configuration once this lands: `hosts/dev-new/configuration.nix:45` ("lab.cloonar.com / mcp-forgejo / dev.cloonar.com keep working unchanged"), `hosts/fw/configuration.nix:43`, and `hosts/fw/modules/dnsmasq.nix:116`. Drop the mcp-forgejo mention; leave the surrounding rationale intact. **Do not edit the ADRs.** `docs/adr/0005` and `docs/adr/0022` both reference mcp-forgejo. They record decisions as they were made, and rewriting them to erase a service that existed at the time falsifies the record. ADR-0022 already documents the decision to drop it. ## Human steps Secrets (per CLAUDE.md the agent does not touch these) — after the PR merges, so no module still declares them: - `hosts/dev/secrets.yaml` — `forgejo-mcp-token` - `hosts/dev-new/secrets.yaml` — `forgejo-mcp-token` - `hosts/fw/vms/web/secrets.yaml` — `forgejo-mcp-client-secret` Also: - **Revoke the `claude-mcp` bot's PAT in Forgejo**, and delete the bot account if it serves nothing else. The token is the actual credential here — deleting the sops entry only removes the copy. - Delete the public `mcp-forgejo.cloonar.com` DNS record at the provider. Removing it from ddclient stops updates but does not remove the record. - Remove the Forgejo connector from Claude.ai. ## Out of scope - Retiring Authelia (M6) — this removes one client, not the module. - The other dead-config removals in the sibling cleanup issue. ## Verification - `scripts/pre-commit` dry-builds the affected hosts (`dev`, `dev-new`, `fw`, `web-arm`). Human, after deploy: 1. `https://mcp-forgejo.cloonar.com` no longer resolves or serves. 2. `systemctl status forgejo-mcp` on `dev-new` — unit gone. 3. **Authelia still works for nothing else that matters, but confirm `auth.cloonar.com` itself still comes up** — the client list changed, and a malformed `identity_providers.oidc.clients` entry fails Authelia at startup. 4. `lab.cloonar.com` and the six Keycloak clients are unaffected.

dominik.polakovics added the

ready-for-agent

label

2026-08-07 22:27:31 +02:00

dominik.polakovics referenced this issue from a commit

2026-08-07 23:06:25 +02:00

feat: remove the Forgejo MCP connector

dominik.polakovics referenced this issue from a pull request that will close it,

2026-08-07 23:06:53 +02:00

feat: remove the Forgejo MCP connector #292

dominik.polakovics closed this issue

2026-08-07 23:08:51 +02:00