build package action

.dockerignore

@@ -0,0 +1,10 @@
+.git
+.gitea
+deploy
+*.md
+*.service
+example.env
+.env
+test_live.py
+test_smoke.py
+install.sh

.gitea/workflows/docker-publish.yml

@@ -0,0 +1,51 @@
+name: Build and publish Docker image
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: docker
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Resolve registry and image metadata
+        id: meta
+        run: |
+          host="${GITEA_SERVER_URL#*://}"
+          image="$host/${GITEA_REPOSITORY,,}"
+          echo "host=$host" >> "$GITHUB_OUTPUT"
+          echo "image=$image" >> "$GITHUB_OUTPUT"
+          if [ "$GITEA_REF_TYPE" = "tag" ]; then
+            echo "tag=$GITEA_REF_NAME" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_REF_TYPE: ${{ gitea.ref_type }}
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+
+      - name: Log in to the Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ steps.meta.outputs.host }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}
+            ${{ steps.meta.outputs.image }}:${{ gitea.sha }}

Dockerfile

@@ -0,0 +1,22 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+COPY pyproject.toml ./
+COPY bookstack_mcp ./bookstack_mcp
+
+RUN pip install --no-cache-dir . \
+    && useradd --system --create-home --home-dir /home/bookstack-mcp --shell /usr/sbin/nologin bookstack-mcp
+
+# fastmcp writes OAuth client registrations/caches under $HOME; point it at the
+# service user's own home instead of the default root-owned locations.
+ENV HOME=/home/bookstack-mcp \
+    XDG_DATA_HOME=/home/bookstack-mcp/.local \
+    XDG_CONFIG_HOME=/home/bookstack-mcp/.config \
+    XDG_CACHE_HOME=/home/bookstack-mcp/.cache \
+    PYTHONUNBUFFERED=1
+
+USER bookstack-mcp
+EXPOSE 8080
+
+CMD ["python", "-m", "bookstack_mcp"]

README.md

@@ -123,7 +123,7 @@ Discovery URLs by provider:
 | Zitadel | `https://auth.example.com/.well-known/openid-configuration` |
 
 **Authelia users:** a ready-made config snippet is in
-[`deploy/authelia/configuration.snippet.yml`](deploy/authelia/configuration.snippet.yml).
+[`examples/authelia/configuration.snippet.yml`](examples/authelia/configuration.snippet.yml).
 Three things are easy to miss and each one produces a confusing failure:
 
 1. **Bypass forward-auth for `mcp.example.com`.** If the host sits behind
@@ -211,7 +211,7 @@ Then inside the container:
 ```bash
 apt update && apt install -y git
 git clone <your-repo> /tmp/bookstack-mcp && cd /tmp/bookstack-mcp
-bash deploy/lxc/install.sh
+bash scripts/install-lxc.sh
 ```
 
 The installer creates a `bookstack-mcp` system user, builds a venv at