430 lines
15 KiB
Python
Executable File
430 lines
15 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Manage the user-level read-only HTTP NocoBase CRM MCP systemd service."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import os
|
|
import secrets
|
|
import shlex
|
|
import shutil
|
|
import socket
|
|
import subprocess
|
|
import urllib.error
|
|
import urllib.request
|
|
from dataclasses import dataclass
|
|
from pathlib import Path
|
|
from typing import Sequence
|
|
|
|
|
|
SERVICE_NAME = "nocobase-crm-mcp.service"
|
|
ENV_RELATIVE_PATH = Path(".runtime") / "nocobase-crm-mcp.env"
|
|
DEFAULT_HOST = "0.0.0.0"
|
|
DEFAULT_PORT = 10087
|
|
DEFAULT_PATH = "/mcp"
|
|
DEFAULT_NB_ENV = "nb-mcp"
|
|
DEFAULT_CONFIG_PATH = "config.json"
|
|
DEFAULT_TOKEN_BYTES = 32
|
|
DEFAULT_UV_CACHE_DIR = "/tmp/uv-cache"
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class ServicePaths:
|
|
project_root: Path
|
|
unit_path: Path
|
|
env_path: Path
|
|
|
|
|
|
def generate_token(num_bytes: int = DEFAULT_TOKEN_BYTES) -> str:
|
|
return secrets.token_urlsafe(num_bytes)
|
|
|
|
|
|
def systemd_quote(value: str | Path) -> str:
|
|
return shlex.quote(str(value))
|
|
|
|
|
|
def find_uv_path() -> Path:
|
|
configured = os.environ.get("UV_PATH", "").strip()
|
|
discovered = configured or shutil.which("uv")
|
|
if not discovered:
|
|
raise RuntimeError("Could not find uv on PATH. Install uv or set UV_PATH to its absolute path.")
|
|
return Path(discovered).expanduser().resolve()
|
|
|
|
|
|
def resolve_service_paths(project_root: Path, config_home: Path | None = None) -> ServicePaths:
|
|
root = project_root.expanduser().resolve()
|
|
base_config = config_home or Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config"))
|
|
unit_path = base_config.expanduser() / "systemd" / "user" / SERVICE_NAME
|
|
return ServicePaths(project_root=root, unit_path=unit_path, env_path=root / ENV_RELATIVE_PATH)
|
|
|
|
|
|
def render_service_unit(
|
|
*,
|
|
project_root: Path,
|
|
env_file: Path,
|
|
host: str = DEFAULT_HOST,
|
|
port: int = DEFAULT_PORT,
|
|
path: str = DEFAULT_PATH,
|
|
uv_cache_dir: str = DEFAULT_UV_CACHE_DIR,
|
|
uv_path: Path | None = None,
|
|
) -> str:
|
|
resolved_uv_path = uv_path or find_uv_path()
|
|
command = " ".join(
|
|
[
|
|
systemd_quote(resolved_uv_path),
|
|
"run",
|
|
"--no-sync",
|
|
"nocobase-crm-mcp",
|
|
"--transport",
|
|
"streamable-http",
|
|
"--host",
|
|
host,
|
|
"--port",
|
|
str(port),
|
|
"--path",
|
|
path,
|
|
]
|
|
)
|
|
return (
|
|
"[Unit]\n"
|
|
"Description=NocoBase CRM readonly HTTP MCP server\n"
|
|
"After=network-online.target\n"
|
|
"Wants=network-online.target\n"
|
|
"\n"
|
|
"[Service]\n"
|
|
"Type=simple\n"
|
|
f"WorkingDirectory={systemd_quote(project_root)}\n"
|
|
f"EnvironmentFile={systemd_quote(env_file)}\n"
|
|
f"Environment=UV_CACHE_DIR={systemd_quote(uv_cache_dir)}\n"
|
|
f"ExecStart={command}\n"
|
|
"Restart=on-failure\n"
|
|
"RestartSec=5\n"
|
|
"\n"
|
|
"[Install]\n"
|
|
"WantedBy=default.target\n"
|
|
)
|
|
|
|
|
|
def write_token_env_file(
|
|
env_path: Path,
|
|
token: str,
|
|
*,
|
|
host: str = DEFAULT_HOST,
|
|
port: int = DEFAULT_PORT,
|
|
path: str = DEFAULT_PATH,
|
|
nb_env: str = DEFAULT_NB_ENV,
|
|
config_path: str = DEFAULT_CONFIG_PATH,
|
|
) -> None:
|
|
env_path.parent.mkdir(parents=True, exist_ok=True)
|
|
env_path.parent.chmod(0o700)
|
|
fd = os.open(env_path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
|
|
with os.fdopen(fd, "w", encoding="utf-8") as env_file:
|
|
env_file.write(f"NOCOBASE_MCP_TOKEN={token}\n")
|
|
env_file.write(f"NOCOBASE_MCP_HOST={host}\n")
|
|
env_file.write(f"NOCOBASE_MCP_PORT={port}\n")
|
|
env_file.write(f"NOCOBASE_MCP_PATH={path}\n")
|
|
env_file.write(f"NOCOBASE_MCP_ENV={nb_env}\n")
|
|
env_file.write(f"NOCOBASE_MCP_CONFIG={config_path}\n")
|
|
env_path.chmod(0o600)
|
|
|
|
|
|
def read_service_env_file(env_path: Path) -> dict[str, str]:
|
|
if not env_path.exists():
|
|
raise RuntimeError(
|
|
f"Missing MCP service env file: {env_path}. Run scripts/mcp_service.sh start to create it, "
|
|
"or scripts/mcp_service.sh new-token to rotate it."
|
|
)
|
|
values: dict[str, str] = {}
|
|
for raw_line in env_path.read_text(encoding="utf-8").splitlines():
|
|
line = raw_line.strip()
|
|
if not line or line.startswith("#"):
|
|
continue
|
|
key, separator, value = line.partition("=")
|
|
if separator:
|
|
values[key.strip()] = value.strip()
|
|
return values
|
|
|
|
|
|
def saved_service_config(project_root: Path) -> tuple[str, str, int, str, str, str]:
|
|
paths = resolve_service_paths(project_root)
|
|
values = read_service_env_file(paths.env_path)
|
|
token = values.get("NOCOBASE_MCP_TOKEN", "").strip()
|
|
if not token:
|
|
raise RuntimeError(f"Missing NOCOBASE_MCP_TOKEN in {paths.env_path}")
|
|
host = values.get("NOCOBASE_MCP_HOST") or DEFAULT_HOST
|
|
port = int(values.get("NOCOBASE_MCP_PORT") or DEFAULT_PORT)
|
|
path = values.get("NOCOBASE_MCP_PATH") or DEFAULT_PATH
|
|
nb_env = values.get("NOCOBASE_MCP_ENV") or DEFAULT_NB_ENV
|
|
config_path = values.get("NOCOBASE_MCP_CONFIG") or DEFAULT_CONFIG_PATH
|
|
return token, host, port, path, nb_env, config_path
|
|
|
|
|
|
def write_service_unit(paths: ServicePaths, *, host: str = DEFAULT_HOST, port: int = DEFAULT_PORT, path: str = DEFAULT_PATH) -> None:
|
|
paths.unit_path.parent.mkdir(parents=True, exist_ok=True)
|
|
unit = render_service_unit(project_root=paths.project_root, env_file=paths.env_path, host=host, port=port, path=path)
|
|
paths.unit_path.write_text(unit, encoding="utf-8")
|
|
|
|
|
|
def detect_remote_hosts() -> list[str]:
|
|
hosts: list[str] = []
|
|
try:
|
|
result = subprocess.run(["hostname", "-I"], capture_output=True, text=True, check=False)
|
|
except OSError:
|
|
result = None
|
|
if result and result.returncode == 0:
|
|
hosts.extend(result.stdout.split())
|
|
try:
|
|
for info in socket.getaddrinfo(socket.gethostname(), None):
|
|
hosts.append(info[4][0])
|
|
except OSError:
|
|
pass
|
|
cleaned: list[str] = []
|
|
for host in hosts:
|
|
normalized = host.strip()
|
|
if not normalized or normalized.startswith("127.") or normalized == "::1" or normalized.startswith("fe80:"):
|
|
continue
|
|
if normalized not in cleaned:
|
|
cleaned.append(normalized)
|
|
return cleaned
|
|
|
|
|
|
def render_remote_config(
|
|
*,
|
|
hosts: Sequence[str],
|
|
token: str,
|
|
port: int = DEFAULT_PORT,
|
|
path: str = DEFAULT_PATH,
|
|
service_status: str | None = None,
|
|
) -> str:
|
|
host = hosts[0] if hosts else "<server-ip>"
|
|
url = f"http://{host}:{port}{path}"
|
|
alternatives = "\n".join(f"- http://{candidate}:{port}{path}" for candidate in hosts[1:])
|
|
alternatives_section = f"\nOther detected addresses:\n{alternatives}\n" if alternatives else ""
|
|
status_section = f"Service status: {service_status}\n\n" if service_status else ""
|
|
return (
|
|
"Saved MCP client config.\n"
|
|
"\n"
|
|
f"{status_section}"
|
|
"Use this URL from another machine:\n"
|
|
f"{url}\n"
|
|
f"{alternatives_section}"
|
|
"\n"
|
|
"Use this header:\n"
|
|
f"Authorization: Bearer {token}\n"
|
|
"\n"
|
|
"Example MCP client config:\n"
|
|
"{\n"
|
|
' "mcpServers": {\n'
|
|
' "nocobase-crm": {\n'
|
|
' "type": "streamable-http",\n'
|
|
f' "url": "{url}",\n'
|
|
' "headers": {\n'
|
|
f' "Authorization": "Bearer {token}"\n'
|
|
" }\n"
|
|
" }\n"
|
|
" }\n"
|
|
"}\n"
|
|
)
|
|
|
|
|
|
def show_config(project_root: Path) -> str:
|
|
token, _host, port, path, _nb_env, _config_path = saved_service_config(project_root)
|
|
return render_remote_config(
|
|
hosts=detect_remote_hosts(),
|
|
token=token,
|
|
port=port,
|
|
path=path,
|
|
service_status=service_state(),
|
|
)
|
|
|
|
|
|
def run_systemctl(args: Sequence[str], *, check: bool = True) -> subprocess.CompletedProcess[str]:
|
|
return subprocess.run(["systemctl", "--user", *args], text=True, check=check)
|
|
|
|
|
|
def service_state() -> str:
|
|
result = subprocess.run(
|
|
["systemctl", "--user", "is-active", SERVICE_NAME],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
state = result.stdout.strip()
|
|
if state:
|
|
return state
|
|
if result.returncode == 0:
|
|
return "active"
|
|
return "unknown"
|
|
|
|
|
|
def probe_http_service(host: str, port: int, path: str, *, token: str, timeout: float = 2.0) -> dict[str, object]:
|
|
url = f"http://{host}:{port}{path}"
|
|
request = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"}, method="GET")
|
|
try:
|
|
with urllib.request.urlopen(request, timeout=timeout) as response:
|
|
return {"reachable": True, "status": response.status, "url": url}
|
|
except urllib.error.HTTPError as error:
|
|
return {"reachable": True, "status": error.code, "url": url}
|
|
except OSError as error:
|
|
return {"reachable": False, "error": str(error), "url": url}
|
|
|
|
|
|
def restart_service_if_installed(paths: ServicePaths) -> bool:
|
|
if not paths.unit_path.exists():
|
|
return False
|
|
run_systemctl(["restart", SERVICE_NAME])
|
|
return True
|
|
|
|
|
|
def new_token(
|
|
*,
|
|
project_root: Path,
|
|
host: str = DEFAULT_HOST,
|
|
port: int = DEFAULT_PORT,
|
|
path: str = DEFAULT_PATH,
|
|
nb_env: str = DEFAULT_NB_ENV,
|
|
config_path: str = DEFAULT_CONFIG_PATH,
|
|
token_bytes: int = DEFAULT_TOKEN_BYTES,
|
|
) -> str:
|
|
paths = resolve_service_paths(project_root)
|
|
token = generate_token(token_bytes)
|
|
write_token_env_file(paths.env_path, token, host=host, port=port, path=path, nb_env=nb_env, config_path=config_path)
|
|
restart_service_if_installed(paths)
|
|
return render_remote_config(hosts=detect_remote_hosts(), token=token, port=port, path=path, service_status=service_state())
|
|
|
|
|
|
def start_service(*, project_root: Path) -> str:
|
|
paths = resolve_service_paths(project_root)
|
|
if not paths.env_path.exists():
|
|
write_token_env_file(
|
|
paths.env_path,
|
|
generate_token(),
|
|
host=DEFAULT_HOST,
|
|
port=DEFAULT_PORT,
|
|
path=DEFAULT_PATH,
|
|
nb_env=DEFAULT_NB_ENV,
|
|
config_path=DEFAULT_CONFIG_PATH,
|
|
)
|
|
token, host, port, path, _nb_env, _config_path = saved_service_config(project_root)
|
|
write_service_unit(paths, host=host, port=port, path=path)
|
|
run_systemctl(["daemon-reload"])
|
|
run_systemctl(["enable", SERVICE_NAME])
|
|
run_systemctl(["restart", SERVICE_NAME])
|
|
try:
|
|
run_systemctl(["is-active", "--quiet", SERVICE_NAME])
|
|
except subprocess.CalledProcessError as error:
|
|
raise RuntimeError(f"{SERVICE_NAME} did not become active after restart") from error
|
|
probe = probe_http_service("127.0.0.1", port, path, token=token)
|
|
if not probe.get("reachable"):
|
|
raise RuntimeError(f"{SERVICE_NAME} is active but HTTP probe failed: {probe.get('error')}")
|
|
return render_remote_config(hosts=detect_remote_hosts(), token=token, port=port, path=path, service_status="active")
|
|
|
|
|
|
def stop_service() -> None:
|
|
run_systemctl(["stop", SERVICE_NAME])
|
|
|
|
|
|
def uninstall_service(project_root: Path) -> None:
|
|
paths = resolve_service_paths(project_root)
|
|
run_systemctl(["disable", "--now", SERVICE_NAME], check=False)
|
|
if paths.unit_path.exists():
|
|
paths.unit_path.unlink()
|
|
if paths.env_path.exists():
|
|
paths.env_path.unlink()
|
|
try:
|
|
paths.env_path.parent.rmdir()
|
|
except OSError:
|
|
pass
|
|
run_systemctl(["daemon-reload"], check=False)
|
|
run_systemctl(["reset-failed", SERVICE_NAME], check=False)
|
|
|
|
|
|
def service_status(*, project_root: Path) -> str:
|
|
paths = resolve_service_paths(project_root)
|
|
state = service_state()
|
|
lines = [
|
|
f"Service status: {state}",
|
|
f"Unit file: {paths.unit_path}",
|
|
f"Env file: {paths.env_path}",
|
|
]
|
|
if paths.env_path.exists():
|
|
token, _host, port, path, _nb_env, _config_path = saved_service_config(project_root)
|
|
hosts = detect_remote_hosts()
|
|
host = hosts[0] if hosts else "<server-ip>"
|
|
lines.append(f"MCP URL: http://{host}:{port}{path}")
|
|
probe = probe_http_service("127.0.0.1", port, path, token=token)
|
|
if probe.get("reachable"):
|
|
lines.append(f"HTTP probe: reachable (status {probe.get('status')})")
|
|
else:
|
|
lines.append(f"HTTP probe: not reachable ({probe.get('error')})")
|
|
else:
|
|
lines.append("MCP URL: unavailable until first start creates the env file")
|
|
lines.append("HTTP probe: skipped")
|
|
return "\n".join(lines) + "\n"
|
|
|
|
|
|
def main(argv: Sequence[str] | None = None) -> int:
|
|
parser = argparse.ArgumentParser(description="Manage the readonly HTTP NocoBase CRM MCP user service.")
|
|
subparsers = parser.add_subparsers(dest="command", required=True)
|
|
|
|
new_token_parser = subparsers.add_parser("new-token", help="Generate a new token and print remote MCP client configuration.")
|
|
new_token_parser.add_argument("--project-root", default=Path(__file__).resolve().parent.parent, type=Path)
|
|
new_token_parser.add_argument("--host", default=DEFAULT_HOST)
|
|
new_token_parser.add_argument("--port", default=DEFAULT_PORT, type=int)
|
|
new_token_parser.add_argument("--path", default=DEFAULT_PATH)
|
|
new_token_parser.add_argument("--nb-env", default=DEFAULT_NB_ENV)
|
|
new_token_parser.add_argument("--config-path", default=DEFAULT_CONFIG_PATH)
|
|
new_token_parser.add_argument("--token-bytes", default=DEFAULT_TOKEN_BYTES, type=int)
|
|
|
|
start_parser = subparsers.add_parser("start", help="Install or update the user service using the saved token, then start it.")
|
|
start_parser.add_argument("--project-root", default=Path(__file__).resolve().parent.parent, type=Path)
|
|
|
|
subparsers.add_parser("stop", help="Stop the user service without deleting service files.")
|
|
|
|
uninstall_parser = subparsers.add_parser("uninstall", help="Stop and remove the managed user service and token file.")
|
|
uninstall_parser.add_argument("--project-root", default=Path(__file__).resolve().parent.parent, type=Path)
|
|
|
|
show_config_parser = subparsers.add_parser("show-config", help="Print the saved token and remote MCP client configuration.")
|
|
show_config_parser.add_argument("--project-root", default=Path(__file__).resolve().parent.parent, type=Path)
|
|
|
|
status_parser = subparsers.add_parser("status", help="Show systemd status for the managed service.")
|
|
status_parser.add_argument("--project-root", default=Path(__file__).resolve().parent.parent, type=Path)
|
|
|
|
args = parser.parse_args(argv)
|
|
if args.command == "new-token":
|
|
print(
|
|
new_token(
|
|
project_root=args.project_root,
|
|
host=args.host,
|
|
port=args.port,
|
|
path=args.path,
|
|
nb_env=args.nb_env,
|
|
config_path=args.config_path,
|
|
token_bytes=args.token_bytes,
|
|
),
|
|
end="",
|
|
)
|
|
return 0
|
|
if args.command == "start":
|
|
print(start_service(project_root=args.project_root), end="")
|
|
return 0
|
|
if args.command == "stop":
|
|
stop_service()
|
|
print(f"Stopped {SERVICE_NAME}.")
|
|
return 0
|
|
if args.command == "uninstall":
|
|
uninstall_service(args.project_root)
|
|
print(f"Uninstalled {SERVICE_NAME}.")
|
|
return 0
|
|
if args.command == "show-config":
|
|
print(show_config(args.project_root), end="")
|
|
return 0
|
|
if args.command == "status":
|
|
print(service_status(project_root=args.project_root), end="")
|
|
return 0
|
|
raise AssertionError(f"unhandled command: {args.command}")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|