wehub-resource-sync
09e9f3545f
Test / Code Quality (push) Has been cancelled
Test / Test (macos-latest, Python 3.10) (push) Has been cancelled
Test / Test (macos-latest, Python 3.11) (push) Has been cancelled
Test / Test (macos-latest, Python 3.12) (push) Has been cancelled
Test / Test (macos-latest, Python 3.13) (push) Has been cancelled
Test / Test (macos-latest, Python 3.14) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.10) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.11) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.12) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.13) (push) Has been cancelled
Test / Test (ubuntu-latest, Python 3.14) (push) Has been cancelled
Test / Test (windows-latest, Python 3.10) (push) Has been cancelled
Test / Test (windows-latest, Python 3.11) (push) Has been cancelled
Test / Test (windows-latest, Python 3.12) (push) Has been cancelled
Test / Test (windows-latest, Python 3.13) (push) Has been cancelled
Test / Test (windows-latest, Python 3.14) (push) Has been cancelled
CodeQL / Analyze (push) Has been cancelled
dependency-audit / pip-audit (push) Has been cancelled
83 lines
2.9 KiB
Bash
Executable File
83 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
# Interactive first-run setup for the remote notebooklm-mcp deploy.
|
|
# Picks a tunnel, generates strong secrets, and writes deploy/.env.
|
|
# Invoked by `make setup`. Re-runnable only after you remove .env.
|
|
set -eu
|
|
|
|
cd "$(dirname "$0")"
|
|
|
|
if [ -e .env ]; then
|
|
echo "✗ deploy/.env already exists — refusing to overwrite it (it may hold secrets)."
|
|
echo " Edit it by hand, or 'rm .env' first to start over."
|
|
exit 1
|
|
fi
|
|
|
|
# Find a Python 3 with the stdlib `secrets` module (>=3.6). Probing the import
|
|
# (not just `command -v`) rejects a `python` that is really Python 2.
|
|
PY=""
|
|
for c in python3 python; do
|
|
if "$c" -c "import secrets" >/dev/null 2>&1; then PY="$c"; break; fi
|
|
done
|
|
[ -n "$PY" ] || { printf '%s\n' "✗ Need python3 (with the secrets module) on PATH."; exit 1; }
|
|
gen() { "$PY" -c "import secrets; print(secrets.token_urlsafe($1))"; }
|
|
|
|
printf 'Tunnel — [1] Cloudflare (needs a domain) [2] Tailscale Funnel (no domain) [1]: '
|
|
read -r choice
|
|
case "$choice" in
|
|
2 | tailscale | ts) TUNNEL=tailscale ;;
|
|
*) TUNNEL=cloudflare ;;
|
|
esac
|
|
|
|
printf 'Also connect from claude.ai (self-hosted OAuth, one password)? [y/N]: '
|
|
read -r want_oauth
|
|
case "$want_oauth" in
|
|
y | Y | yes) OAUTH=1 ;;
|
|
*) OAUTH= ;;
|
|
esac
|
|
|
|
if [ "$TUNNEL" = cloudflare ]; then
|
|
printf 'CF_TUNNEL_TOKEN (Cloudflare Zero Trust → Networks → Tunnels; blank to fill later): '
|
|
else
|
|
printf 'TS_AUTHKEY (Tailscale → Settings → Keys; blank to fill later): '
|
|
fi
|
|
read -r TUN_TOKEN
|
|
|
|
BASE_URL=
|
|
if [ -n "$OAUTH" ]; then
|
|
printf 'Public https origin claude.ai reaches (e.g. https://host.example.com): '
|
|
read -r BASE_URL
|
|
BASE_URL=${BASE_URL%/} # normalize to a bare origin (server rejects a trailing path)
|
|
fi
|
|
|
|
TOKEN=$(gen 32)
|
|
OAUTH_PW=$(gen 24)
|
|
|
|
# .env holds full-account secrets — create it 0600 (umask before the redirect, so
|
|
# there's no world-readable window between create and a later chmod).
|
|
umask 077
|
|
{
|
|
# printf '%s', never echo — a token can begin with '-' or (elsewhere) contain
|
|
# backslashes, both of which some echo implementations would mangle.
|
|
printf '%s\n' "# Generated by 'make setup'. Treat as secret (gitignored). See .env.example for all options."
|
|
printf 'TUNNEL=%s\n' "$TUNNEL"
|
|
printf 'NOTEBOOKLM_MCP_TOKEN=%s\n' "$TOKEN"
|
|
if [ -n "$OAUTH" ]; then
|
|
printf 'NOTEBOOKLM_MCP_OAUTH_PASSWORD=%s\n' "$OAUTH_PW"
|
|
printf 'NOTEBOOKLM_MCP_OAUTH_BASE_URL=%s\n' "$BASE_URL"
|
|
fi
|
|
if [ "$TUNNEL" = cloudflare ]; then
|
|
printf 'CF_TUNNEL_TOKEN=%s\n' "$TUN_TOKEN"
|
|
[ -n "$OAUTH" ] && printf '%s\n' "NOTEBOOKLM_MCP_TRUST_PROXY=1"
|
|
else
|
|
printf 'TS_AUTHKEY=%s\n' "$TUN_TOKEN"
|
|
fi
|
|
} > .env
|
|
|
|
echo
|
|
echo "✓ Wrote deploy/.env — TUNNEL=$TUNNEL, bearer token generated${OAUTH:+, OAuth password generated}."
|
|
echo "Next:"
|
|
echo " 1. Bootstrap the master token once (deploy/README.md §1) if you haven't."
|
|
echo " 2. Finish the tunnel setup (deploy/README.md §3)."
|
|
[ -z "$TUN_TOKEN" ] && echo " …then put the tunnel token in deploy/.env."
|
|
echo " 3. make up"
|