wehub-resource-sync
09e9f3545f
Test / Code Quality (push) Has been cancelled
Test / Test (macos-latest, Python 3.10) (push) Has been cancelled
Test / Test (macos-latest, Python 3.11) (push) Has been cancelled
Test / Test (macos-latest, Python 3.12) (push) Has been cancelled
Test / Test (macos-latest, Python 3.13) (push) Has been cancelled
Test / Test (macos-latest, Python 3.14) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.10) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.11) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.12) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.13) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.14) (push) Has been cancelled
Test / Test (windows-latest, Python 3.10) (push) Has been cancelled
Test / Test (windows-latest, Python 3.11) (push) Has been cancelled
Test / Test (windows-latest, Python 3.12) (push) Has been cancelled
Test / Test (windows-latest, Python 3.13) (push) Has been cancelled
Test / Test (windows-latest, Python 3.14) (push) Has been cancelled
CodeQL / Analyze (push) Has been cancelled
dependency-audit / pip-audit (push) Has been cancelled
68 lines
3.9 KiB
Bash
68 lines
3.9 KiB
Bash
# Copy to .env (which is gitignored) and fill in. NEVER commit real values.
|
|
# Or just run `make setup` — it picks a tunnel, generates the secrets below, and
|
|
# writes this file for you.
|
|
|
|
# Which tunnel to run (Compose profile): cloudflare or tailscale. `make setup`
|
|
# writes this; `make up`/`make dev` read it (a `TUNNEL=... make up` override wins).
|
|
TUNNEL=cloudflare
|
|
|
|
# Which published image `make up`/`make prod` pull. By default, make uses this
|
|
# checkout's pyproject version. Set this only for raw docker compose, a fork, or
|
|
# a pinned tag.
|
|
# NOTEBOOKLM_MCP_IMAGE=tenglin/notebooklm-mcp
|
|
# NOTEBOOKLM_MCP_VERSION=<version>
|
|
|
|
# Bearer token clients must present to use the MCP endpoint. Generate a strong
|
|
# random value, e.g.: python -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
# Works with Claude Code / Desktop (which send an Authorization header).
|
|
NOTEBOOKLM_MCP_TOKEN=
|
|
|
|
# --- Optional: self-hosted OAuth (only needed to connect from claude.ai, whose ---
|
|
# connector UI is OAuth-only). Leave BOTH unset to stay bearer-only (Claude
|
|
# Code/Desktop unaffected). When set, they're additive — the bearer keeps working
|
|
# AND claude.ai can connect via OAuth, gated by this one password. No external IdP.
|
|
# - PASSWORD: the gate. Use a long random value (>=16 chars); it's the primary
|
|
# brute-force defense. Generate: python -c "import secrets; print(secrets.token_urlsafe(24))"
|
|
# - BASE_URL: the public https URL claude.ai reaches (your tunnel hostname).
|
|
# NOTE: Cloudflare's edge sees this password in transit (it terminates TLS) — use a
|
|
# throwaway Google account. Rotating the password swaps the in-memory check but does
|
|
# NOT revoke already-issued OAuth tokens (they're long-lived and persisted): real
|
|
# revocation = delete the profile's oauth_state.json and restart. Both vars required
|
|
# together (partial → refuses to start).
|
|
# NOTEBOOKLM_MCP_OAUTH_PASSWORD=
|
|
# NOTEBOOKLM_MCP_OAUTH_BASE_URL=https://your-host.example.com
|
|
# Cloudflare ONLY: trust the tunnel's CF-Connecting-IP header so the login throttle keys
|
|
# per-IP instead of globally. Leave unset unless a trusted proxy sets that header (an
|
|
# exposed-directly origin could forge it to dodge the throttle). Tailscale Funnel does not
|
|
# set it, so this is a no-op there.
|
|
# NOTEBOOKLM_MCP_TRUST_PROXY=1
|
|
|
|
# --- Tunnel: pick ONE (see README §"Connect from claude.ai" / the tunnel options) ---
|
|
# A) Cloudflare (`make dev` / TUNNEL=cloudflare) — needs a domain in your Cloudflare
|
|
# account. Token: Cloudflare dashboard → Networking → Tunnels → your tunnel → its token.
|
|
# Route: Routes → Add route → Published application, Service URL http://notebooklm-mcp:9420.
|
|
CF_TUNNEL_TOKEN=
|
|
# Optional: pin the cloudflared image to a release from
|
|
# github.com/cloudflare/cloudflared/releases (defaults to `latest`).
|
|
# CLOUDFLARED_VERSION=2025.1.0
|
|
|
|
# B) Tailscale Funnel (`make dev TUNNEL=tailscale`) — NO domain; free stable HTTPS at
|
|
# https://notebooklm-mcp.<your-tailnet>.ts.net. One-time in the Tailscale admin
|
|
# console: enable MagicDNS + HTTPS certificates, and grant the `funnel` node
|
|
# attribute via Settings → Funnel → Manage (deep-links to the ACL policy editor;
|
|
# add nodeAttrs {"target":["*"],"attr":["funnel"]} and Save). TS_AUTHKEY is a
|
|
# NORMAL auth key (Settings → Keys) — Funnel comes from the policy, not the key.
|
|
# Then set NOTEBOOKLM_MCP_OAUTH_BASE_URL to that ts.net origin (tailscale profile only).
|
|
# TS_AUTHKEY=tskey-auth-xxxxxxxx
|
|
|
|
# Which host profile dir to mount — the Google account the server drives.
|
|
# Defaults to your local "default" profile. Point at a dedicated/throwaway
|
|
# profile here (recommended — master_token.json is a full-account credential).
|
|
# NOTEBOOKLM_PROFILE_DIR=/home/you/.notebooklm/profiles/throwaway
|
|
|
|
# The container runs as this uid:gid so the mounted profile needs NO chown (your
|
|
# own CLI keeps owning the files). `make` fills these from `id` automatically;
|
|
# set them only for raw `docker compose` (use your own: id -u / id -g).
|
|
# NOTEBOOKLM_UID=1000
|
|
# NOTEBOOKLM_GID=1000
|