63 lines
1.6 KiB
Plaintext
63 lines
1.6 KiB
Plaintext
{
|
|
auto_https off
|
|
admin off
|
|
}
|
|
|
|
# One host, one path per server. This is the shape the catalog in the workflow manager expects -
|
|
# ${{host}}/coding-agent/mcp and its siblings - so a flow configured against a remote deployment
|
|
# runs against this stack by changing the host and nothing else.
|
|
:3100 {
|
|
handle_path /coding-agent/* {
|
|
reverse_proxy coding-agent-mcp:3000 {
|
|
flush_interval -1
|
|
}
|
|
}
|
|
|
|
handle_path /dev-server/* {
|
|
reverse_proxy dev-server-mcp:3000 {
|
|
flush_interval -1
|
|
}
|
|
}
|
|
|
|
handle_path /browser/* {
|
|
reverse_proxy browser-mcp:3000 {
|
|
flush_interval -1
|
|
}
|
|
}
|
|
|
|
# The one door a person opens, as opposed to the three above, which a machine opens with an API
|
|
# key. handle_path strips the prefix, so the worker's proxy sees /<execution-key>/... and the
|
|
# application behind it sees the path it would see at the root.
|
|
#
|
|
# Same origin as the MCP endpoints above, which is a compromise worth naming: JavaScript in a
|
|
# previewed page can reach /dev-server/mcp. It gets 401 - those endpoints authenticate by
|
|
# bearer token, never by cookie, so there is no ambient authority for a page to borrow - and
|
|
# the preview's own cookie is scoped to /preview/<key>/ and travels nowhere else.
|
|
handle_path /preview/* {
|
|
reverse_proxy dev-server-worker:4500
|
|
}
|
|
|
|
handle {
|
|
respond "No MCP server is published at this path" 404
|
|
}
|
|
}
|
|
|
|
# The original one-port-per-server listeners, kept for clients configured before the paths existed.
|
|
:3101 {
|
|
reverse_proxy coding-agent-mcp:3000 {
|
|
flush_interval -1
|
|
}
|
|
}
|
|
|
|
:3102 {
|
|
reverse_proxy dev-server-mcp:3000 {
|
|
flush_interval -1
|
|
}
|
|
}
|
|
|
|
:3103 {
|
|
reverse_proxy browser-mcp:3000 {
|
|
flush_interval -1
|
|
}
|
|
}
|