feat: docker-compose support + Docker Hub publish workflow

.env.example

@@ -0,0 +1,34 @@
+# Copy this file to .env and fill in your own values, then run:
+#   docker-compose up --build
+# See GETTING_STARTED.md for a full walkthrough.
+
+# Required: base URL of your oCIS instance.
+OCIS_MCP_OCIS_URL=https://your-ocis-instance.example.com
+
+# Required: shared secret every MCP client must send as "Authorization: Bearer <secret>".
+# docker-compose.yml always binds 0.0.0.0:8090 (needed for port publishing to work), so the
+# server refuses to start without this secret. Generate one with: openssl rand -hex 32
+OCIS_MCP_HTTP_SECRET=
+
+# Recommended: an oCIS app token. Create one in the oCIS web UI under
+# Settings > Security > App tokens, or run (against your oCIS deployment, not this repo):
+#   docker compose exec ocis ocis auth-app create --user-name="admin" --expiration="8760h"
+OCIS_MCP_APP_TOKEN_USER=
+OCIS_MCP_APP_TOKEN_VALUE=
+
+# Alternative to an app token: OIDC (see README > Authentication).
+#OCIS_MCP_AUTH_MODE=oidc
+#OCIS_MCP_OIDC_ACCESS_TOKEN=
+
+# Dev-only: skip TLS verification for a self-signed oCIS test instance.
+#OCIS_MCP_TLS_SKIP_VERIFY=true
+#OCIS_MCP_INSECURE=true
+
+# Optional: log verbosity (debug, info, warn, error). Defaults to info.
+#OCIS_MCP_LOG_LEVEL=debug
+
+# Optional: host port to publish. Defaults to 8090.
+#OCIS_MCP_SERVER_PORT=8090
+
+# Optional: image tag to build/run. Defaults to "dev" (local build).
+#OCIS_MCP_SERVER_TAG=dev

.github/workflows/docker.yml

@@ -0,0 +1,99 @@
+name: Docker
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build (all platforms, no push)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build linux/amd64 and load for smoke test
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          platforms: linux/amd64
+          load: true
+          tags: ocis-mcp-server:smoke-test
+
+      - name: Smoke test the built image
+        run: |
+          set +e
+          output=$(docker run --rm ocis-mcp-server:smoke-test 2>&1)
+          status=$?
+          echo "$output"
+          if [ "$status" -ne 1 ]; then
+            echo "::error::expected exit code 1 (missing OCIS_MCP_OCIS_URL), got $status"
+            exit 1
+          fi
+          if ! echo "$output" | grep -q "OCIS_MCP_OCIS_URL is required"; then
+            echo "::error::expected the config-validation error in the container's output, did not find it"
+            exit 1
+          fi
+          echo "Smoke test passed: image starts and fails config validation as expected."
+
+      - name: Build linux/amd64 + linux/arm64 (validate only, no push)
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: false
+
+  publish:
+    name: Publish to Docker Hub
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: owncloud/ocis-mcp-server
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+
+      - name: Build and push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -18,3 +18,6 @@ coverage.html
 # OS
 .DS_Store
 Thumbs.db
+
+# Local environment config (see .env.example) — never commit real secrets
+.env

README.md

@@ -17,8 +17,9 @@ See the **[Getting Started Guide](GETTING_STARTED.md)** for a full walkthrough.
 make build
 
 # Configure
-export OCIS_URL=https://your-ocis-instance.example.com
-export OCIS_ACCESS_TOKEN=your-token
+export OCIS_MCP_OCIS_URL=https://your-ocis-instance.example.com
+export OCIS_MCP_APP_TOKEN_USER=admin
+export OCIS_MCP_APP_TOKEN_VALUE=your-app-token
 
 # Run
 ./ocis-mcp-server
@@ -28,9 +29,25 @@ export OCIS_ACCESS_TOKEN=your-token
 
 ```bash
 make docker-build
-docker run -e OCIS_URL=... -e OCIS_ACCESS_TOKEN=... owncloud/ocis-mcp-server
+docker run \
+  -e OCIS_MCP_OCIS_URL=https://your-ocis-instance.example.com \
+  -e OCIS_MCP_APP_TOKEN_USER=admin \
+  -e OCIS_MCP_APP_TOKEN_VALUE=your-app-token \
+  owncloud/ocis-mcp-server
 ```
 
+### Docker Compose
+
+```bash
+cp .env.example .env
+# edit .env: set OCIS_MCP_OCIS_URL, OCIS_MCP_HTTP_SECRET, and an app token
+docker-compose up --build
+```
+
+The server listens on `http://localhost:8090/mcp` (see `.env.example` for every available
+setting, and [Securing the HTTP transport](#securing-the-http-transport) below for what
+`OCIS_MCP_HTTP_SECRET` protects against).
+
 ### Run Tests
 
 ```bash

docker-compose.yml

@@ -0,0 +1,14 @@
+---
+services:
+  ocis-mcp-server:
+    build:
+      context: .
+    image: owncloud/ocis-mcp-server:${OCIS_MCP_SERVER_TAG:-dev}
+    env_file:
+      - .env
+    environment:
+      OCIS_MCP_TRANSPORT: http
+      OCIS_MCP_HTTP_ADDR: 0.0.0.0:8090
+    ports:
+      - "${OCIS_MCP_SERVER_PORT:-8090}:8090"
+    restart: unless-stopped