Добавлен защищённый Docker Compose для MCP-сервисов

compose.yaml

@@ -0,0 +1,131 @@
+services:
+  proxmox-mcp-pve:
+    image: ghcr.io/rekklesna/proxmoxmcp-plus:latest
+    container_name: proxmox-mcp-pve
+    restart: unless-stopped
+    init: true
+    stop_grace_period: 30s
+    ports:
+      - "${MCP_BIND_ADDRESS:-192.168.31.100}:8811:8811"
+    environment:
+      PROXMOX_API_KEY: ${PROXMOX_PVE_API_KEY:?PROXMOX_PVE_API_KEY is required}
+    volumes:
+      - type: bind
+        source: ${MCP_CONFIG_ROOT:-/mnt/ssd/apps/mcp}/pve/config.json
+        target: /app/proxmox-config/config.json
+        read_only: true
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,noexec,nosuid,nodev
+    pids_limit: 128
+    mem_limit: 256m
+    cpus: 0.5
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    logging: &default-logging
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    networks:
+      - mcp-network
+
+  proxmox-mcp-kybinka:
+    image: ghcr.io/rekklesna/proxmoxmcp-plus:latest
+    container_name: proxmox-mcp-kybinka
+    restart: unless-stopped
+    init: true
+    stop_grace_period: 30s
+    ports:
+      - "${MCP_BIND_ADDRESS:-192.168.31.100}:8812:8811"
+    environment:
+      PROXMOX_API_KEY: ${PROXMOX_KYBINKA_API_KEY:?PROXMOX_KYBINKA_API_KEY is required}
+    volumes:
+      - type: bind
+        source: ${MCP_CONFIG_ROOT:-/mnt/ssd/apps/mcp}/kybinka/config.json
+        target: /app/proxmox-config/config.json
+        read_only: true
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,noexec,nosuid,nodev
+    pids_limit: 128
+    mem_limit: 256m
+    cpus: 0.5
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    logging: *default-logging
+    networks:
+      - mcp-network
+
+  proxmox-mcp-pve1:
+    image: ghcr.io/rekklesna/proxmoxmcp-plus:latest
+    container_name: proxmox-mcp-pve1
+    restart: unless-stopped
+    init: true
+    stop_grace_period: 30s
+    ports:
+      - "${MCP_BIND_ADDRESS:-192.168.31.100}:8813:8811"
+    environment:
+      PROXMOX_API_KEY: ${PROXMOX_PVE1_API_KEY:?PROXMOX_PVE1_API_KEY is required}
+    volumes:
+      - type: bind
+        source: ${MCP_CONFIG_ROOT:-/mnt/ssd/apps/mcp}/pve1/config.json
+        target: /app/proxmox-config/config.json
+        read_only: true
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,noexec,nosuid,nodev
+    pids_limit: 128
+    mem_limit: 256m
+    cpus: 0.5
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    logging: *default-logging
+    networks:
+      - mcp-network
+
+  truenas-mcp:
+    build:
+      context: ./truenas
+      dockerfile: Dockerfile
+    container_name: truenas-mcp
+    restart: unless-stopped
+    init: true
+    stop_grace_period: 30s
+    ports:
+      - "${MCP_BIND_ADDRESS:-192.168.31.100}:8814:8000"
+    environment:
+      TRUENAS_URL: ${TRUENAS_URL:-http://192.168.31.100}
+      TRUENAS_API_KEY: ${TRUENAS_API_KEY:?TRUENAS_API_KEY is required}
+      TRUENAS_VERIFY_SSL: ${TRUENAS_VERIFY_SSL:-false}
+      TRUENAS_ENABLE_DESTRUCTIVE_OPS: ${TRUENAS_ENABLE_DESTRUCTIVE_OPS:-false}
+      TRUENAS_LOG_LEVEL: ${TRUENAS_LOG_LEVEL:-INFO}
+    volumes:
+      - type: bind
+        source: ${MCP_CONFIG_ROOT:-/mnt/ssd/apps/mcp}/truenas/config.json
+        target: /app/config.json
+        read_only: true
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,noexec,nosuid,nodev
+    pids_limit: 128
+    mem_limit: 256m
+    cpus: 0.5
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    logging: *default-logging
+    networks:
+      - mcp-network
+
+networks:
+  mcp-network:
+    name: mcp-network
+    driver: bridge