[devin-ai-integration]

Summary

Follow-up to #1: a practical, secure deployment path for the HTTP and MCP servers, plus a few small runtime fixes it surfaced.

Deployment

• Dockerfile: multi-stage (uv builder → python:3.12-slim), non-root pip uid 10001, /data volume (key + sqlite), read-only policy mount at /config/policy.yaml, HEALTHCHECK on $PIP_HEALTH_PORT/healthz (8642 http / 8643 mcp). ENTRYPOINT docker/entrypoint.sh maps serve-http / serve-mcp (streamable-http) / any other pip-node subcommand (keygen, identity).
• docker-compose.yml: pip-http + pip-mcp sharing one pip-data volume (same identity), ports bound to 127.0.0.1 only, read_only, cap_drop: ALL, no-new-privileges, optional .env (required: false).
• deploy/deploy.sh up|down|status|logs|keygen|identity (bootstraps .env/policy.yaml from examples with warnings, waits for both health endpoints), deploy/Caddyfile.example (TLS termination), deploy/systemd/*.service.example (hardened bare-metal alternative).
• docs/DEPLOYMENT.md (linked from README/SECURITY): local run, container run, compose, TLS, key/policy/bearer handling, health/metrics, upgrades, checklist.
• CI: new docker job builds the image, validates compose, runs the container, waits for healthy, checks /.well-known/pip returns a handshake.

Runtime changes

• Settings.mcp_port (default 8643) so both transports run side-by-side on one host; serve-mcp uses it.
• build_mcp_http_app(server, bearer_token): wraps the streamable-http app with GET /healthz (exempt from bearer) and propagates the inner lifespan (lifespan=inner.router.lifespan_context) — without it the MCP session manager never started when mounted. Test now performs a real JSON-RPC initialize against /mcp.
• Settings validator: empty PIP_HTTP_BEARER_TOKEN= / PIP_PUBLIC_*_URL= in .env → None (an empty string previously enabled the bearer gate).
• SqliteStore: timeout=5 busy timeout (two processes share the DB in WAL mode).
• config/.env.example added (referenced by README but missing from main); .env and config/policy.yaml gitignored.

Verified: ruff / ruff format / mypy strict / pytest (122) green; docker build, docker compose config -q, docker compose up -d → both containers healthy, /healthz on 8642 and 8643, /.well-known/pip handshake, MCP initialize POST on :8643/mcp → 200 with serverInfo.name == "pip-v1".

Assumptions: TLS is terminated by a reverse proxy (ports stay loopback-only); one key shared by both transports of an instance; policy edits require a restart; the image binds 0.0.0.0 inside the container only.

Link to Devin session: https://app.devin.ai/sessions/4104d923252c419994b9ebddc2f28bec
Open in Devin Desktop: https://app.devin.ai/desktop/session/4104d923252c419994b9ebddc2f28bec?variant=devin
Requested by: @CommunityPoke

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring