steve
da5b8435bc
The MCP SDK's DNS rebinding protection rejects remote clients with 421 when the Host header isn't in the allowlist. Add KB_MCP_ALLOWED_HOSTS env var (comma-separated IPs/FQDNs) to configure additional allowed hosts while keeping localhost always permitted. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
42 lines
1.1 KiB
YAML
42 lines
1.1 KiB
YAML
services:
|
|
kb-engine:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.nvidia
|
|
runtime: nvidia
|
|
deploy:
|
|
resources:
|
|
reservations:
|
|
devices:
|
|
- driver: nvidia
|
|
count: 1
|
|
capabilities: [gpu]
|
|
ports:
|
|
- "${KB_PORT:-8000}:8000"
|
|
volumes:
|
|
- ${KB_DATA_PATH:-./data}:/data
|
|
environment:
|
|
- KB_MODEL=${KB_MODEL:-all-MiniLM-L6-v2}
|
|
- KB_DEVICE=${KB_DEVICE:-auto}
|
|
- KB_INGEST_DEVICE=${KB_INGEST_DEVICE:-auto}
|
|
- KB_API_KEY=${KB_API_KEY:-}
|
|
- KB_SEARCH_THRESHOLD=${KB_SEARCH_THRESHOLD:-0.01}
|
|
- HF_HUB_OFFLINE=${HF_HUB_OFFLINE:-}
|
|
restart: unless-stopped
|
|
|
|
kb-mcp:
|
|
build:
|
|
context: ../mcp
|
|
dockerfile: Dockerfile
|
|
ports:
|
|
- "${KB_MCP_PORT:-3000}:3000"
|
|
environment:
|
|
- KB_ENGINE_URL=http://kb-engine:8000
|
|
- KB_API_KEY=${KB_API_KEY:-}
|
|
- KB_MCP_API_KEY=${KB_MCP_API_KEY:-}
|
|
# Comma-separated IPs/FQDNs allowed to connect remotely (e.g. 192.168.1.50,kb.example.com)
|
|
- KB_MCP_ALLOWED_HOSTS=${KB_MCP_ALLOWED_HOSTS:-}
|
|
depends_on:
|
|
- kb-engine
|
|
restart: unless-stopped
|