# ---------------------------------------------------------------------------
# BookStack connection
# ---------------------------------------------------------------------------
# Root URL of your BookStack instance, no trailing slash and no /api suffix.
BOOKSTACK_URL=https://wiki.example.com

# From BookStack: profile menu > Edit Profile > API Tokens > Create Token.
# The token user's roles decide exactly what this MCP server can see and do.
# Create a dedicated user with only the access you want to expose.
BOOKSTACK_TOKEN_ID=
BOOKSTACK_TOKEN_SECRET=

# Set to false only if BookStack uses a self-signed certificate.
BOOKSTACK_VERIFY_TLS=true
BOOKSTACK_TIMEOUT=30

# ---------------------------------------------------------------------------
# Behaviour
# ---------------------------------------------------------------------------
# true  = search/read tools only (recommended to start)
# false = also expose create_page, update_page, create_book, create_chapter
BOOKSTACK_READ_ONLY=true

# Only relevant when BOOKSTACK_READ_ONLY=false. Adds delete_page (recycle bin).
BOOKSTACK_ALLOW_DELETE=false

# Page bodies longer than this are truncated before being sent to Claude.
MCP_MAX_CONTENT_CHARS=40000

# ---------------------------------------------------------------------------
# Transport
# ---------------------------------------------------------------------------
MCP_HOST=0.0.0.0
MCP_PORT=8080
MCP_PATH=/mcp

# Optional DNS-rebinding protection. Set to your public hostname(s).
# MCP_ALLOWED_HOSTS=mcp.example.com

# ---------------------------------------------------------------------------
# Auth: how Claude authenticates TO this server
#   none          no auth (local testing only)
#   token         static bearer tokens (Claude Code / CLI only)
#   oidc          your own IdP -- Authentik, Keycloak, Authelia, Zitadel, ...
#   github        GitHub OAuth (use if you have no IdP)
#   oidc+token    OIDC for claude.ai + static token for Claude Code  <-- recommended
#   github+token  same, with GitHub as the IdP
# ---------------------------------------------------------------------------
MCP_AUTH_MODE=oidc+token

# Public HTTPS URL of THIS server. Required for any OAuth mode.
MCP_PUBLIC_URL=https://mcp.example.com

# Comma-separated. Generate with: openssl rand -hex 32
MCP_STATIC_TOKENS=

# --- Option A: your own OIDC provider -------------------------------------
# The discovery document URL. Examples:
#   Authentik  https://auth.example.com/application/o/bookstack-mcp/.well-known/openid-configuration
#   Keycloak   https://auth.example.com/realms/main/.well-known/openid-configuration
#   Authelia   https://auth.example.com/.well-known/openid-configuration
#   Zitadel    https://auth.example.com/.well-known/openid-configuration
OIDC_CONFIG_URL=

# Register a NEW confidential client in your IdP for this server -- do not
# reuse the BookStack client. Redirect URI must be exactly:
#   https://mcp.example.com/auth/callback
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=

# Set true if your IdP issues opaque (non-JWT) access tokens; the ID token is
# then verified instead. Authelia and Okta commonly need this. Keycloak and
# Authentik issue JWTs, so leave it false.
OIDC_VERIFY_ID_TOKEN=false

# Claim holding the user's groups. Supports dot-notation for nested claims,
# e.g. Keycloak's resource_access.bookstack-mcp.roles
OIDC_GROUPS_CLAIM=groups

# Override the requested scopes entirely, if your provider needs something
# specific. Default: openid, profile, email, offline_access (+ groups claim
# when MCP_REQUIRED_GROUPS is set).
OIDC_SCOPES=

# --- Option B: GitHub instead of your own IdP -----------------------------
# https://github.com/settings/developers
# Callback URL: https://mcp.example.com/auth/callback
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# --- Who may use the server (applies to whichever provider you chose) ------
# Matched against login / preferred_username / email / sub. Case-insensitive.
MCP_ALLOWED_USERS=

# And/or require membership of at least one of these groups.
# Leave BOTH empty and anyone who can log in to your IdP gets in.
MCP_REQUIRED_GROUPS=wiki-users