move to public-mcp

- full-vmcp serves as public entry point at mcp.ngorse.com
- Single Keycloak client (public-mcp) for all external tools
- authServerConfig proxies auth to Keycloak
- state-docs-vmcp becomes internal-only (no auth required)
- Shared OIDC config for token validation
- All external clients authenticate once at gateway

manifest/overlays/production/secrets/kustomization.yaml

@@ -3,5 +3,5 @@ kind: Kustomization
 
 namespace: toolhive-system
 
-# resources:
+resources:
-#   - state-docs-vmcp-secret.sealed.secret.yaml
+  - public-mcp-secret.sealed.secret.yaml

manifest/overlays/production/secrets/public-mcp-secret.sealed.secret.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    sealedsecrets.bitnami.com/cluster-wide: "true"
+  name: public-mcp-secret
+  namespace: keycloak
+spec:
+  encryptedData:
+    client-id: AgANqLN6opyrUHiqVaUKvHwUr4chY38qb03WxUzXWll6SDh7bRvHcZ3wAMHfsmigEz2cSWVMWg0VmEcP16r6gcEiYGQ2/Ol182oXbtI/bWad/3rFFzMlLrKie8H9oGS/LgyRyhEiQ2hDzsdAJWARdHrRhbpFvJ1QeUJtcIBGKy8CcjTm8YfW7u/IqNyo0X+NIK2vImO9UdrmzIIDwQav0e30dRkmtbL5lamR563Qa1k4alEdOTF/E2fe6OVxaIqjpbzHnjmbKRA1ymhYGOasm8hTUeE/IVicAZNeQAg0ps31PSHpwjnEzyDZ1k7p5Dvc4+RhNXhOmONnI38/EbTA0dXra2ZeRxdcmErGrN2KrVZmlxyBK3462z8yWbiGU4esAdHJAdAjBkD+sDP2jYIsy7wvzArYM/hbFqDBrLs9vf29bYyUfRoRo/0BS+iO06zBjr0ssUT95FBrs1RLXDJUaomFkylz32L+jLfalKc4N1xeIwA76VOk4m3lVllmZP0YFC/mifHJ6qzuOgJqBw8fTkYhASiwyfsbbk3c8f4VlHqvXPKhJKkJvaUMMve59XpKuVX8O3phW2nJG4hl86OVkfOQRIZgPqn6t5UiHyJCPv6JoxAITs40thG06QUn263MTyZyaNGw9/PPVmSO/O5N2DIElWl75FpAEg3fqsljJiq2NGVQWLmT3C7tdyUwDEuu0r91cQmfUY7EehBD
+    client-secret: AgCCe5CH8xoDedXE9iM4GGEw/K7LhdXzH3lPynjlJ85OdMLuM6yYkaN37xF9FbdwhkQQnX3pjM08ILjEnpWtIx8zNmzTl+U90sSo85YqbSyZcNK7uy3oCTaRB6sdtPmdcDWEjtUcvv7+2WZcnAH8IfpT7wpesrjkO7uND0ZFX2bqhR26goq40gSiNahfCLp5QkZlsnTb6r6uw2N0utOLFDp3m233Nh268kxamlvr8E1IYDZFBC8KDIz9rfKvuMNBV6CA++FDeYybS1WNkgK3hQ+tGRVy5L7zB6x06zKzh4UIBn1t9sEga1x2ZH2Szgcb6EgBXmQ3rFaJ7O52dUltLV4GHX4uqRmjj+aZFQQuaJuvgp1Dc0rhFFwKveH5R0VcEarSDHeRlQmPiszKTsk8tgfCw8U64uoe6ACPq0isWVYBvUxttm/nB3MNSEl3TOquw9UtsiV1CaqC5LpI4qO1EatpARF57uqxw1Ewl8e8WrcBQ3WlI+7kjsJ2jHODx8sTlByqW7PZeJB4pk8sIq3NXA4VK/7f+852itxE0R7S67nZ4xFi75V6omyaEcniDVaPzxoC6EiFsPrUj8QpA+eRlKZRFTS4fmQRUkKVGYEnSWxDTkM1ot5dPx1MkA6MsEwq7wiuZwIbXeLK9Z3NqqsJ5LyTwidXhim5vf4iMHqH6Fj9ZL0RZTjMqfLXSjDD+Tu9qwMnXfkZx6EMsOLKc5uz73lP2VpGoUyq9ndqHsEbqYjbHQ==
+  template:
+    metadata:
+      annotations:
+        reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+        reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+        reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: keycloak, toolhive-system
+        sealedsecrets.bitnami.com/cluster-wide: "true"
+        sealedsecrets.bitnami.com/managed: "true"
+      name: public-mcp-secret
+      namespace: keycloak

manifest/overlays/production/vmcp-servers/full-vmcp-ngorse-ingress.yaml

@@ -12,6 +12,12 @@ spec:
   entryPoints:
     - websecure
   routes:
+    - kind: Rule
+      match: Host(`mcp.ngorse.com`)
+      services:
+        - name: vmcp-full-vmcp
+          namespace: toolhive-system
+          port: 4483
     - kind: Rule
       match: Host(`full-vmcp.ngorse.com`)
       services:

manifest/overlays/production/vmcp-servers/full-vmcp.yaml

@@ -21,16 +21,15 @@ spec:
   incomingAuth:
     type: oidc
     oidcConfigRef:
-      name: full-vmcp-oidc
+      name: public-mcp-oidc
-      audience: http://full-vmcp.toolhive-system.svc.cluster.local:4483
   authServerConfig:
-    issuer: https://full-vmcp.ngorse.com
+    issuer: https://mcp.ngorse.com
     upstreamProviders:
       - name: keycloak
         type: oidc
         oidcConfig:
           issuerUrl: https://cloak.olb42.com/realms/home-lab
-          clientId: toolhive-full-vmcp
+          clientId: public-mcp
   config:
     aggregation:
       conflictResolution: prefix

manifest/overlays/production/vmcp-servers/kustomization.yaml

@@ -4,8 +4,8 @@ kind: Kustomization
 namespace: toolhive-system
 
 resources:
+  - oidcconfig-public-mcp.yaml
   - oidcconfig-state-docs-vmcp.yaml
-  - oidcconfig-full-vmcp.yaml
   - full-vmcp.yaml
   - full-vmcp-ingress.yaml
   - full-vmcp-ngorse-ingress.yaml

manifest/overlays/production/vmcp-servers/oidcconfig-public-mcp.yaml

@@ -1,13 +1,13 @@
 apiVersion: toolhive.stacklok.dev/v1beta1
 kind: MCPOIDCConfig
 metadata:
-  name: full-vmcp-oidc
+  name: public-mcp-oidc
   namespace: toolhive-system
 spec:
   type: inline
   inline:
-    issuer: https://full-vmcp.ngorse.com
+    issuer: https://mcp.ngorse.com
-    clientId: toolhive-full-vmcp
+    clientId: public-mcp
     clientSecretRef:
-      name: toolhive-full-vmcp-secret
+      name: public-mcp-secret
       key: client-secret

manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml

@@ -14,18 +14,7 @@ spec:
   embeddingServerRef:
     name: homelab-embedding
   incomingAuth:
-    type: oidc
+    type: anonymous
-    oidcConfigRef:
-      name: state-docs-vmcp-oidc
-      audience: state-docs-vmcp
-  authServerConfig:
-    issuer: https://state-docs.ngorse.com
-    upstreamProviders:
-      - name: keycloak
-        type: oidc
-        oidcConfig:
-          issuerUrl: https://cloak.olb42.com/realms/home-lab
-          clientId: state-docs-vmcp
   config:
     aggregation:
       conflictResolution: prefix