ai: persist FlowAgent MSAL token cache via mcpo bind mount #18

Merged
AVB merged 1 commits from flowagent-auth-mount into main 2026-09-09 08:45:02 -07:00
Owner

Summary

Adds the missing bind mount that persists FlowAgent's delegated-user MSAL token cache across ai_mcpo restarts. Companion to homelab/mcp-config#9 (dual-audience token pre-warm + headless-auth guard) — see that PR for the corrected root-cause analysis of the 2026-09-08 stall.

Change

Single line added to the mcpo service's volumes: list in ai/ai.yaml:

- /volume1/docker/mcpo/flowagent-auth:/app/flowagent-auth

Why

config.json.template's flowagent entry sets HOME=/app/flowagent-auth for the flowagent subprocess — this is where FlowAgent's MsalTokenProvider disk cache plugin (createMsalDiskCachePlugin, packages/core/dist/auth/msal-disk-cache.js) writes its serialized MSAL token cache (default path resolves via XDG_CACHE_HOME/HOME, see defaultMsalCacheDir()).

Reviewing the current mcpo service's mount list confirmed it was not persisted — mounts were only ssh_keys, config.json, mcpo_data, uv-cache. Any successful delegated-user MSAL sign-in for list_connections / create_connection / resolve_refs / pick_or_create_connection / resolve_params would be silently lost on every mcpo restart or redeploy, forcing a fresh (currently guarded-against, see companion PR) interactive sign-in every time.

Pre-flight already done

Host directory pre-created on shared CephFS (identical across all three docker LXCs per infra convention):

mkdir -p /volume1/docker/mcpo/flowagent-auth

Verified present via ls -la /volume1/docker/mcpo/ on docker-2 (LXC 4032).

Scope check

  • Diff is the single mount-list line only — no image tag change, no other service touched.
  • Does not modify mcpo-critical (Proxmox-access service, explicitly excluded per infra convention).

Deploy note

This is a single-file stack (ai.yaml, no folder+extension-file merge) — stack-deploy.sh will render it via envsubst (not docker compose config), so the existing $-escaping in the file is already correct for that path and untouched by this change.

Depends on / should merge alongside homelab/mcp-config#9 for the fixes to be coherent, but this mount is safe to deploy independently (adding a new empty-but-precreated bind mount to an existing service does not require the image-side changes to be present first).

## Summary Adds the missing bind mount that persists FlowAgent's delegated-user MSAL token cache across `ai_mcpo` restarts. Companion to `homelab/mcp-config#9` (dual-audience token pre-warm + headless-auth guard) — see that PR for the corrected root-cause analysis of the 2026-09-08 stall. ## Change Single line added to the `mcpo` service's `volumes:` list in `ai/ai.yaml`: ```yaml - /volume1/docker/mcpo/flowagent-auth:/app/flowagent-auth ``` ## Why `config.json.template`'s `flowagent` entry sets `HOME=/app/flowagent-auth` for the flowagent subprocess — this is where FlowAgent's `MsalTokenProvider` disk cache plugin (`createMsalDiskCachePlugin`, `packages/core/dist/auth/msal-disk-cache.js`) writes its serialized MSAL token cache (default path resolves via `XDG_CACHE_HOME`/`HOME`, see `defaultMsalCacheDir()`). Reviewing the current `mcpo` service's mount list confirmed it was **not** persisted — mounts were only `ssh_keys`, `config.json`, `mcpo_data`, `uv-cache`. Any successful delegated-user MSAL sign-in for `list_connections` / `create_connection` / `resolve_refs` / `pick_or_create_connection` / `resolve_params` would be silently lost on every mcpo restart or redeploy, forcing a fresh (currently guarded-against, see companion PR) interactive sign-in every time. ## Pre-flight already done Host directory pre-created on shared CephFS (identical across all three docker LXCs per infra convention): ``` mkdir -p /volume1/docker/mcpo/flowagent-auth ``` Verified present via `ls -la /volume1/docker/mcpo/` on docker-2 (LXC 4032). ## Scope check - Diff is the single mount-list line only — no image tag change, no other service touched. - Does not modify `mcpo-critical` (Proxmox-access service, explicitly excluded per infra convention). ## Deploy note This is a single-file stack (`ai.yaml`, no folder+extension-file merge) — `stack-deploy.sh` will render it via `envsubst` (not `docker compose config`), so the existing `$`-escaping in the file is already correct for that path and untouched by this change. Depends on / should merge alongside `homelab/mcp-config#9` for the fixes to be coherent, but this mount is safe to deploy independently (adding a new empty-but-precreated bind mount to an existing service does not require the image-side changes to be present first).
Bot added 1 commit 2026-09-09 00:17:03 -07:00
Adds the missing bind mount for FlowAgent's delegated-user MSAL disk
token cache:

    /volume1/docker/mcpo/flowagent-auth:/app/flowagent-auth

Confirmed via `docker service inspect ai_mcpo --format '{{json .Spec.TaskTemplate.ContainerSpec.Mounts}}'`-equivalent review of the current
compose that mcpo's mounts were only: ssh_keys, config.json, mcpo_data,
uv-cache -- flowagent-auth (set as HOME for the flowagent subprocess via
config.json.template's env.HOME=/app/flowagent-auth) was NOT persisted,
so any successful delegated-user MSAL sign-in (list_connections /
create_connection / resolve_refs / pick_or_create_connection /
resolve_params -- the tools that use MsalTokenProvider, see companion
homelab/mcp-config PR #9) would be silently lost on every mcpo restart,
forcing a fresh interactive sign-in every time.

Host dir already exists (pre-created on shared CephFS, identical across
all three docker LXCs):
    mkdir -p /volume1/docker/mcpo/flowagent-auth

This does NOT change the flowagent image tag/pin -- that stays
git.bryanmail.net/homelab/flowagent-mcpo:c5b22618404a pending the
companion mcp-config PR merging and its Woodpecker build producing a new
commit-sha tag to bump to.

No other changes to ai.yaml in this commit -- diff is mount-list addition
only.
AVB merged commit 000792f702 into main 2026-09-09 08:45:02 -07:00
Sign in to join this conversation.