You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat(server): add TLS/HTTPS support with reverse proxy configuration
Add direct TLS termination and reverse proxy support for production deployments:
- Add SSL_CERT_PATH, SSL_KEY_PATH, SSL_CA_PATH, SSL_PASSPHRASE env vars
- Add TRUST_PROXY env var for Express trust proxy configuration
- Create HTTPS server when SSL certificates are provided
- Support all transport modes (SSE, StreamableHTTP, Dual) with TLS
- Update Node.js requirement to >=24 in README
Documentation:
- Create SSL.md with comprehensive TLS/HTTPS setup guide
- Include nginx, Envoy, Caddy, Traefik reverse proxy configurations
- Add Docker Compose examples for each proxy
- Document HTTP/2 best practices (via reverse proxy)
- Add security checklist and troubleshooting guide
Copy file name to clipboardExpand all lines: README.md
+38-1Lines changed: 38 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ This fork is actively maintained and enhanced with strict TypeScript standards,
14
14
15
15
## Requirements
16
16
17
-
-**Node.js**: >=18.0.0 (required for native fetch API support)
17
+
-**Node.js**: >=24.0.0 (required for native fetch with Undici dispatcher pattern)
18
18
-**GitLab**: Compatible with GitLab.com and self-hosted instances
19
19
20
20
## Usage
@@ -201,6 +201,38 @@ The GitLab MCP Server automatically selects the appropriate transport mode based
201
201
- Optimal for command-line tools and direct MCP protocol usage
202
202
- Lower resource usage
203
203
204
+
## TLS/HTTPS Configuration
205
+
206
+
GitLab MCP Server supports secure HTTPS connections via:
207
+
208
+
| Approach | Best For | HTTP/2 | Auto-Renewal |
209
+
|----------|----------|--------|--------------|
210
+
|**Direct TLS**| Development, simple deployments | No | Manual |
211
+
|**Reverse Proxy**| Production (recommended) | Yes | Yes |
212
+
213
+
**Quick Start - Direct TLS:**
214
+
```bash
215
+
docker run -d \
216
+
-e PORT=3000 \
217
+
-e SSL_CERT_PATH=/certs/server.crt \
218
+
-e SSL_KEY_PATH=/certs/server.key \
219
+
-e GITLAB_TOKEN=your_token \
220
+
-v $(pwd)/certs:/certs:ro \
221
+
-p 3000:3000 \
222
+
ghcr.io/structured-world/gitlab-mcp:latest
223
+
```
224
+
225
+
**Quick Start - Reverse Proxy (Caddy):**
226
+
```
227
+
gitlab-mcp.example.com {
228
+
reverse_proxy gitlab-mcp:3002 {
229
+
flush_interval -1
230
+
}
231
+
}
232
+
```
233
+
234
+
For complete setup guides including **nginx**, **Envoy**, **Caddy**, and **Traefik** configurations with HTTP/2 support, see **[SSL.md](SSL.md)**.
235
+
204
236
## OAuth Authentication (Claude Custom Connector)
205
237
206
238
GitLab MCP Server supports OAuth 2.1 authentication for use as a **Claude Custom Connector**. This enables secure per-user authentication without sharing GitLab tokens.
@@ -419,6 +451,11 @@ When OAuth is enabled, the following endpoints are available:
419
451
-`USE_VARIABLES`: When set to 'true', enables the CI/CD variables-related tools (list_variables, get_variable, create_variable, update_variable, delete_variable). Supports both project-level and group-level variables. By default, variables features are enabled.
420
452
-`GITLAB_AUTH_COOKIE_PATH`: Path to an authentication cookie file for GitLab instances that require cookie-based authentication. When provided, the cookie will be included in all GitLab API requests.
421
453
-`SKIP_TLS_VERIFY`: When set to 'true', skips TLS certificate verification for all GitLab API requests (both REST and GraphQL). **WARNING**: This bypasses SSL certificate validation and should only be used for testing with self-signed certificates or trusted internal GitLab instances. Never use this in production environments.
454
+
-`SSL_CERT_PATH`: Path to PEM certificate file for direct HTTPS/TLS termination. Requires `SSL_KEY_PATH` to also be set.
455
+
-`SSL_KEY_PATH`: Path to PEM private key file for direct HTTPS/TLS termination. Requires `SSL_CERT_PATH` to also be set.
456
+
-`SSL_CA_PATH`: Optional path to CA certificate chain for client certificate validation.
457
+
-`SSL_PASSPHRASE`: Optional passphrase for encrypted private keys.
458
+
-`TRUST_PROXY`: Enable Express trust proxy for reverse proxy deployments. Values: `true`, `false`, `loopback`, `linklocal`, `uniquelocal`, hop count, or specific IP addresses.
0 commit comments