David/MEGAINFRA-WEBAPP
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
MEGAINFRA-WEBAPP/docs/setup/env-and-mcp.md

3.1 KiB
Raw Permalink Blame History

Environment variables and MCP setup

Use the API and MCP connection guide for tested app settings, credential locations, examples and results. Verified on 5 October 2026.

Environment files

File Role
.env.local Ignored local development/MCP credentials; loaded by Next.js development and npm run mcp
.env.local.example Committed template; replace placeholders on another machine
.env.coolify Committed production template containing placeholders
.env.coolify.local Ignored deployment reference; not automatically loaded by the app
cooler.env Ignored deployment reference containing the ingest secret verified against production

Both .env.local and .env.coolify.local retain the placeholder N8N_INGEST_SECRET. Production rejected it. The value in cooler.env passed an authenticated production read. No credentials were changed during verification.

Credentials and MCP

  • MEGA MCP: NEXT_PUBLIC_POCKETBASE_URL, POCKETBASE_ADMIN_EMAIL, POCKETBASE_ADMIN_PASSWORD; optional POCKETBASE_ADMIN_TOKEN. The adapter requires email/password even when a token exists.
  • Named-user app API: MEGA login and its mega_session cookie in AUTH_MODE=users.
  • Machine API routes: x-ingest-secret matching deployed N8N_INGEST_SECRET.
  • Posted receipt correction: operational authorization, same-origin request and RECEIPT_CORRECTION_SECRET as the correction code.
  • Outbound AI: provider-specific credentials; these are not MEGA API keys.

MEGA MCP uses local stdio, distinct from the external n8n MCP service at N8N_MCP_URL. The n8n bearer token is separate and was not tested here. Do not use the n8n HTTP settings for MEGA's stdio server.

Copy-ready settings: Codex TOML, MCP JSON. They contain paths, not secret values.

Deployment and n8n

Use your deployment environment manager for actual production variables. Ignored local files do not automatically update Coolify or n8n. When changing an ingest secret, update the app and each calling workflow together; generating a new string alone does not connect a client.

Named-user sessions last 60 days from sign-in (including sign-in after a required password change). The app cookie lifetime in src/lib/auth/session-policy.ts must match PocketBase users.authToken.duration (5,184,000 seconds). Use python3 scripts/migrations/2026-10-19-user-session-lifetime.py to preview the backend setting and add --apply --confirm-host <configured PocketBase URL> to apply it. Deploy the matching app change too. Existing tokens and cookies keep their original expiry; users receive the longer session when they next sign in.

See COOLIFY.md for deployment, delivery-note workflow for batch tick integration, and purchase-order workflow for PO ingestion.

Remote purchasing MCP

See remote setup and deployment for the same-app /api/mcp endpoint, dedicated keys, purchasing writes and no-delete policy.