base/devtools/penpot-mcp.Dockerfile

FROM node:22-alpine
ARG WS_URI=wss://mcp-designer.sunbeam.pt/ws
RUN npm install -g pnpm@latest
COPY . /opt/penpot-mcp/
WORKDIR /opt/penpot-mcp
RUN WS_URI=$WS_URI pnpm -r install && WS_URI=$WS_URI pnpm run build
ENV PENPOT_MCP_REMOTE_MODE=true \
    PENPOT_MCP_SERVER_HOST=0.0.0.0 \
    PENPOT_MCP_SERVER_PORT=4401 \
    PENPOT_MCP_WEBSOCKET_PORT=4402
EXPOSE 4400 4401 4402
CMD ["pnpm", "run", "start"]
feat(devtools): deploy Penpot + MCP server, wildcard TLS via DNS-01 Penpot (designer.sunbeam.pt): - Frontend/backend/exporter deployments with OIDC-only auth via Hydra - VSO-managed DB, S3, and app secrets from OpenBao - PostgreSQL user/db in CNPG postInitSQL - Hydra Maester enabledNamespaces extended to devtools Penpot MCP server (mcp-designer.sunbeam.pt): - Pre-built Node.js image pushed to Gitea registry - Auth-gated via Pingora auth_request → Hydra /userinfo - WebSocket path for browser plugin connection Wildcard TLS: - Switched cert-manager from HTTP-01 (per-SAN) to DNS-01 via Scaleway webhook - Certificate collapsed to *.sunbeam.pt + sunbeam.pt - Added scaleway-certmanager-webhook Helm chart - VSO secret for Scaleway DNS API credentials in cert-manager namespace - Added cert-manager to OpenBao VSO auth role 2026-04-04 12:53:27 +01:00			`FROM node:22-alpine`
fix(devtools): stabilize Penpot MCP, fix S3 creds, OIDC registration MCP server: - Replace vite build --watch + livePreview with static vite preview (watch mode was reloading the plugin iframe, killing WebSocket) - Bake WS_URI at Docker build time for production WebSocket URL - Add server-side application-level keepalive messages every 25s - Add client-side auto-reconnect with exponential backoff - Set Pingora route timeout to 86400s for WebSocket idle tolerance Penpot: - Add AWS_ACCESS_KEY_ID/SECRET env vars for S3 SDK compatibility - Set S3 region to satisfy AWS SDK credential chain - Enable OIDC registration (disable-registration blocks OIDC signup) - Fix frontend port (8080 not 80) - Add penpot bucket to seaweedfs-buckets init job 2026-04-04 15:37:45 +01:00			`ARG WS_URI=wss://mcp-designer.sunbeam.pt/ws`
			`RUN npm install -g pnpm@latest`
			`COPY . /opt/penpot-mcp/`
			`WORKDIR /opt/penpot-mcp`
			`RUN WS_URI=$WS_URI pnpm -r install && WS_URI=$WS_URI pnpm run build`
feat(devtools): deploy Penpot + MCP server, wildcard TLS via DNS-01 Penpot (designer.sunbeam.pt): - Frontend/backend/exporter deployments with OIDC-only auth via Hydra - VSO-managed DB, S3, and app secrets from OpenBao - PostgreSQL user/db in CNPG postInitSQL - Hydra Maester enabledNamespaces extended to devtools Penpot MCP server (mcp-designer.sunbeam.pt): - Pre-built Node.js image pushed to Gitea registry - Auth-gated via Pingora auth_request → Hydra /userinfo - WebSocket path for browser plugin connection Wildcard TLS: - Switched cert-manager from HTTP-01 (per-SAN) to DNS-01 via Scaleway webhook - Certificate collapsed to *.sunbeam.pt + sunbeam.pt - Added scaleway-certmanager-webhook Helm chart - VSO secret for Scaleway DNS API credentials in cert-manager namespace - Added cert-manager to OpenBao VSO auth role 2026-04-04 12:53:27 +01:00			`ENV PENPOT_MCP_REMOTE_MODE=true \`
			`PENPOT_MCP_SERVER_HOST=0.0.0.0 \`
			`PENPOT_MCP_SERVER_PORT=4401 \`
			`PENPOT_MCP_WEBSOCKET_PORT=4402`
fix(devtools): stabilize Penpot MCP, fix S3 creds, OIDC registration MCP server: - Replace vite build --watch + livePreview with static vite preview (watch mode was reloading the plugin iframe, killing WebSocket) - Bake WS_URI at Docker build time for production WebSocket URL - Add server-side application-level keepalive messages every 25s - Add client-side auto-reconnect with exponential backoff - Set Pingora route timeout to 86400s for WebSocket idle tolerance Penpot: - Add AWS_ACCESS_KEY_ID/SECRET env vars for S3 SDK compatibility - Set S3 region to satisfy AWS SDK credential chain - Enable OIDC registration (disable-registration blocks OIDC signup) - Fix frontend port (8080 not 80) - Add penpot bucket to seaweedfs-buckets init job 2026-04-04 15:37:45 +01:00			`EXPOSE 4400 4401 4402`
feat(devtools): deploy Penpot + MCP server, wildcard TLS via DNS-01 Penpot (designer.sunbeam.pt): - Frontend/backend/exporter deployments with OIDC-only auth via Hydra - VSO-managed DB, S3, and app secrets from OpenBao - PostgreSQL user/db in CNPG postInitSQL - Hydra Maester enabledNamespaces extended to devtools Penpot MCP server (mcp-designer.sunbeam.pt): - Pre-built Node.js image pushed to Gitea registry - Auth-gated via Pingora auth_request → Hydra /userinfo - WebSocket path for browser plugin connection Wildcard TLS: - Switched cert-manager from HTTP-01 (per-SAN) to DNS-01 via Scaleway webhook - Certificate collapsed to *.sunbeam.pt + sunbeam.pt - Added scaleway-certmanager-webhook Helm chart - VSO secret for Scaleway DNS API credentials in cert-manager namespace - Added cert-manager to OpenBao VSO auth role 2026-04-04 12:53:27 +01:00			`CMD ["pnpm", "run", "start"]`