.env.example

# tailscale-rmcp — Tailscale MCP Server
# Copy to .env and fill in REQUIRED values. Never commit .env.
#
# SPLIT:
#   .env        → secrets + runtime docker vars (this file)
#   config.toml → all other config (tailnet, host, port, auth_mode, etc.)
#
# All values here can be overridden by environment variables using the same
# key names. Config from config.toml is overridden by TAILSCALE_* env vars.

# ── REQUIRED: Tailscale API ────────────────────────────────────────────────────

# Tailscale API key — create at https://login.tailscale.com/admin/settings/keys
TAILSCALE_API_KEY=tskey-api-...

# ── REQUIRED: MCP auth ────────────────────────────────────────────────────────

# Static bearer token for MCP clients (sensitive — generate with: openssl rand -hex 32)
# Must match what MCP clients send in Authorization: Bearer <token>
TAILSCALE_MCP_TOKEN=

# ── Optional: OAuth (only when auth_mode=oauth in config.toml) ────────────────

# Google OAuth client ID and secret — create at console.cloud.google.com
# TAILSCALE_MCP_GOOGLE_CLIENT_ID=
# TAILSCALE_MCP_GOOGLE_CLIENT_SECRET=

# ── Optional: Docker Compose runtime vars ─────────────────────────────────────

# Override the published MCP host port (container always listens on 40040)
# TAILSCALE_MCP_PORT=40040

# Docker network name (default: tailscale-rmcp — must exist before `docker compose up`)
# DOCKER_NETWORK=tailscale-rmcp

# ── Runtime overrides (also settable in config.toml) ──────────────────────────
# These override config.toml values when set. Prefer config.toml for non-secrets.

# TAILSCALE_TAILNET=-
# TAILSCALE_ALLOW_DESTRUCTIVE=false
# TAILSCALE_MCP_HOST=0.0.0.0
# TAILSCALE_MCP_NO_AUTH=false
# RUST_LOG=info