| allowed_mcp_clients |
MCP OAuth client allowlist published as ALLOWED_MCP_CLIENTS. Each entry is id or `id |
redirect_uri`. Empty list keeps the upstream defaults (claude-desktop, test-mcp-client). |
list(string) |
[] |
| allowed_mgmt_client |
Management API client allowlist published as ALLOWED_MGMT_CLIENT (comma-separated client IDs). Required from upstream v0.74.0+: when unset/empty the management API is fail-closed and rejects all tokens. Empty string skips publishing the env var. |
string |
"" |
no |
| bedrock_embedding_model |
Bedrock model ID used for semantic search embeddings |
string |
"amazon.titan-embed-text-v2:0" |
no |
| container_port |
Port the server listens on inside the container |
number |
8004 |
no |
| cpu |
Fargate task vCPU units (1024 = 1 vCPU) |
number |
512 |
no |
| image |
Container image (without tag) |
string |
"ghcr.io/cbcoutinho/nextcloud-mcp-server" |
no |
| image_tag |
Container image tag. Pin to a specific release; avoid :latest. |
string |
n/a |
yes |
| log_retention_days |
CloudWatch log retention in days |
number |
30 |
no |
| memory |
Fargate task memory (MiB) |
number |
1024 |
no |
| name |
Logical name prefix for resources |
string |
"nextcloud-mcp-server" |
no |
| nextcloud_url |
Public URL of the Nextcloud instance the MCP server pairs with (e.g., https://cloud.example.com). Used to advertise the OIDC discovery endpoint via /api/v1/status so the astrolabe Nextcloud app can discover Nextcloud's oidc_provider as the IdP instead of falling back to http://localhost. |
string |
n/a |
yes |
| private_subnet_ids |
Private subnet IDs (for EFS mount targets only). |
list(string) |
n/a |
yes |
| public_subnet_ids |
Public subnet IDs (for the ALB and the ECS task ENI). Tasks run with assign_public_ip=true since this VPC has no NAT gateway; the task SG only allows ingress from the ALB SG. |
list(string) |
n/a |
yes |
| qdrant_collection |
Qdrant collection name. Set to a stable value (anything other than upstream's default 'nextcloud_content') so the upstream config doesn't fall through to its hostname-based auto-naming, which churns the collection on every rolling deploy. |
string |
"nextcloud-mcp" |
no |
| qdrant_cpu |
Qdrant Fargate task vCPU units (1024 = 1 vCPU) |
number |
512 |
no |
| qdrant_image |
Qdrant container image (without tag) |
string |
"qdrant/qdrant" |
no |
| qdrant_image_tag |
Qdrant container image tag (e.g., v1.15.0). Pin to a specific release; avoid :latest. Required only when use_external_qdrant = false; omit (or pass null) when use_external_qdrant = true. |
string |
null |
no |
| qdrant_memory |
Qdrant Fargate task memory (MiB) |
number |
1024 |
no |
| secret_arn |
ARN of the Secrets Manager secret holding JSON {host, client_id, client_secret, token_encryption_key, webhook_secret} |
string |
n/a |
yes |
| use_external_qdrant |
When true, skip the in-AWS Qdrant ECS task and source QDRANT_URL/QDRANT_API_KEY from the Secrets Manager secret (keys: qdrant_url, qdrant_api_key). When false, run an in-AWS Qdrant Fargate task and point the MCP server at it via Cloud Map DNS. |
bool |
false |
no |
| vector_sync_processor_workers |
Concurrent embedding workers. Keep at 1 unless you've verified Bedrock quota headroom. |
number |
1 |
no |
| vector_sync_scan_interval |
Seconds between background vector sync scans |
number |
60 |
no |
| vpc_id |
VPC ID to deploy into |
string |
n/a |
yes |
| zone_id |
Route53 hosted zone ID for the random subdomain |
string |
n/a |
yes |
| zone_name |
Route53 hosted zone name (without trailing dot), e.g. astrolabeonline.com |
string |
n/a |
yes |
