# Claude AI Connector - Tailscale Funnel Configuration
#
# This profile exposes the MCP server (login-flow mode) via Tailscale Funnel
# for testing Claude AI connector integration.
#
# Usage:
#   1. Copy this file to .env and fill in TS_AUTHKEY
#   2. Run: docker compose --profile login-flow --profile claude-funnel up --build -d
#   3. Configure Claude.ai connector with: https://nextcloud-mcp-dev.<tailnet>.ts.net/mcp
#
# Prerequisites:
#   - Generate auth key at https://login.tailscale.com/admin/settings/keys
#     with tag:container and reusable=yes
#   - Ensure Tailscale ACL allows funnel for tag:container:
#     "nodeAttrs": [{ "target": ["tag:container"], "attr": ["funnel"] }]
#
# Security:
#   - /mcp endpoint restricted to Claude AI IPs (160.79.104.0/21)
#   - /oauth/* and /.well-known/* open to all IPs (needed for user login flow)
#   - All other paths return 404

TS_AUTHKEY=tskey-auth-REPLACE_ME