语义搜索服务器

Outline Stack (existing infra)         outline-net (shared network)
┌──────────────────────────────┐              │
│  [Outline]     [Redis]       │◄─────────────┼──────────────┐
└───────────────────▲──────────┘              │              │
                    │ (reuses logical DB /1)   │               │
┌───────────────────┴─────────────────────────▼──────────────┼
│ outline-mcp-vector (1 Container Stack)                     │              
│  - FastAPI (receives webhooks, responds immediately)        │
│  - Celery Worker & Beat (background chunking/embedding/sched)│
│  - MCP Server (serves the search_knowledge tool over Streamable HTTP) │
└─────────────────────────────────────────────┬──────────────┘
                                              │ (rag-net)
                                      ┌──────▼───────────────────────┐
                                      │ Qdrant (internal vector DB)   │
                                      └──────────────────────────────┘

# Add this to your existing Outline docker-compose.yml if it's missing, then restart Outline
services:
  outline:
    networks: [outline-net]
  redis:
    networks: [outline-net]

networks:
  outline-net:
    name: outline-net

# Outline integration (values gathered in step 1)
OUTLINE_API_KEY=ol_api_xxxxxxxxxxxx        # Outline API token
OUTLINE_WEBHOOK_SECRET=your_secret_key     # Secret copied from the Outline webhook screen
OUTLINE_API_URL=http://outline:3000        # Internal Docker-network URL
OUTLINE_PUBLIC_URL=https://wiki.domain.com # Public URL real users hit in their browser

# AI and vector DB settings
GOOGLE_API_KEYS=key1,key2,key3             # Gemini API keys (comma-separated for a round-robin pool)
QDRANT__SERVICE__API_KEY=strong_qdrant_key # Any string you like, used to authenticate to Qdrant

# DNS rebinding protection (Host/Origin header validation). Comma-separate your deployed
# domain(s); leave unset to keep this off (pre-existing behavior). Only relevant against
# malicious webpages attacking through a browser — non-browser clients (curl, Claude
# Desktop's remote connector) don't send an Origin header and aren't affected either way.
# MCP_ALLOWED_HOSTS=mcp.your-domain.com
# MCP_ALLOWED_ORIGINS=https://mcp.your-domain.com

# MCP auth — off by default (server is fully open). Set MCP_OAUTH_ENABLED=true and fill in
# the rest to require a Keycloak-issued Bearer JWT instead. This server is a Resource Server
# only; it validates against your Keycloak realm's JWKS, it doesn't run Keycloak itself
# (see docs/keycloak-reference-compose.yml for a throwaway realm to test against).
# MCP_OAUTH_ENABLED=true
# MCP_OAUTH_ISSUER_URL=https://keycloak.your-domain.com/realms/myrealm
# MCP_OAUTH_RESOURCE_URL=https://mcp.your-domain.com/mcp
# MCP_OAUTH_AUDIENCE=outline-mcp-client

version: '3.8'

services:
  qdrant:
    image: qdrant/qdrant:latest
    expose:
      - "6333"
    environment:
      - QDRANT__SERVICE__API_KEY
    volumes:
      - qdrant_data:/qdrant/storage
    networks:
      - rag-net
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo -e \"GET /healthz HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n\" > /dev/tcp/localhost/6333' || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5

  outline-mcp-vector:
    image: sjw0066/outline-mcp-vector:latest
    env_file: .env
    environment:
      - QDRANT_URL=http://qdrant:6333
      - REDIS_URL=redis://redis:6379/1 # Shares Outline's Redis container (logical DB 1)
      - MCP_HOST=0.0.0.0
      - MCP_PORT=8080
    ports:
      - "17000:8000"   # FastAPI port (webhook, sync)
      - "17080:8080"   # FastMCP Streamable HTTP port
    volumes:
      - sync_state:/data
    networks:
      - rag-net
      - outline-net    # Joins Outline's existing network
    depends_on:
      qdrant:
        condition: service_healthy

networks:
  rag-net:
    driver: bridge
  outline-net:
    external: true     # References the already-running Outline network

volumes:
  qdrant_data:
  sync_state:

docker compose up -d

server {
    listen 443 ssl;
    server_name mcp.your-domain.com;

    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;

    location / {
        # ⭐ Key part: forward to the MCP port (17080) exposed by docker-compose.
        proxy_pass http://localhost:17080;
        
        # Required to keep the streaming connection alive in real time
        proxy_buffering off;
        proxy_cache off;
        proxy_set_header Connection '';
        chunked_transfer_encoding off;
        
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

{
  "mcpServers": {
    "outline-knowledge-base": {
      "url": "https://mcp.your-domain.com/mcp"
    }
  }
}

claude mcp add --transport http outline-knowledge-base https://mcp.your-domain.com/mcp