Standardize Makefile docker/push targets for MCR

Add MCR and VERSION variables. Tag images with full MCR registry URL
and version. Add push target that builds then pushes to MCR.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -58,7 +58,7 @@ deploy/              Docker, systemd, install scripts, examples
 
 ## Shared Library
 
-MCNS uses `mcdsl` (git.wntrmute.dev/kyle/mcdsl) for shared platform packages:
+MCNS uses `mcdsl` (git.wntrmute.dev/mc/mcdsl) for shared platform packages:
 auth, db, config, httpserver, grpcserver. These provide MCIAS authentication,
 SQLite database helpers, TOML config loading, and TLS-configured HTTP/gRPC
 server scaffolding.

Makefile

@@ -1,6 +1,8 @@
-.PHONY: build test vet lint proto proto-lint clean docker all devserver
+.PHONY: build test vet lint proto proto-lint clean docker push all devserver
 
-LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty)"
+MCR     := mcr.svc.mcp.metacircular.net:8443
+VERSION := $(shell git describe --tags --always --dirty)
+LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(VERSION)"
 
 mcns:
 	CGO_ENABLED=0 go build $(LDFLAGS) -o mcns ./cmd/mcns
@@ -18,8 +20,8 @@ lint:
 	golangci-lint run ./...
 
 proto:
-	protoc --go_out=. --go_opt=module=git.wntrmute.dev/kyle/mcns \
+	protoc --go_out=. --go_opt=module=git.wntrmute.dev/mc/mcns \
-		--go-grpc_out=. --go-grpc_opt=module=git.wntrmute.dev/kyle/mcns \
+		--go-grpc_out=. --go-grpc_opt=module=git.wntrmute.dev/mc/mcns \
 		proto/mcns/v1/*.proto
 
 proto-lint:
@@ -30,7 +32,10 @@ clean:
 	rm -f mcns
 
 docker:
-	docker build --build-arg VERSION=$(shell git describe --tags --always --dirty) -t mcns -f Dockerfile .
+	docker build --build-arg VERSION=$(VERSION) -t $(MCR)/mcns:$(VERSION) -f Dockerfile .
+
+push: docker
+	docker push $(MCR)/mcns:$(VERSION)
 
 devserver: mcns
 	@mkdir -p srv

RUNBOOK.md

@@ -230,6 +230,28 @@ Symptoms: MCNS fails to start with "address already in use" on port 53.
    `[dns] listen_addr` in `mcns.toml` to a different address.
 4. Restart MCNS and verify DNS is responding.
 
+## Deployment with MCP
+
+MCNS runs on rift as a single container managed by MCP. The service
+definition lives at `~/.config/mcp/services/mcns.toml` on the operator's
+machine. A reference copy is maintained at `deploy/mcns-rift.toml` in
+this repository.
+
+The container image is pulled from MCR. The container mounts `/srv/mcns`
+and runs as `--user 0:0`. DNS listens on port 53 (UDP+TCP) on both
+192.168.88.181 and 100.95.252.120, with the management API on 8443/9443.
+
+Note: the operator's `~/.config/mcp/services/mcns.toml` may still
+reference the old CoreDNS image and needs updating to the new MCNS image.
+
+### Key Operations
+
+1. Deploy or update: `mcp deploy mcns`
+2. Restart: `mcp restart mcns`
+3. Stop: `mcp stop mcns` (WARNING: stops DNS for all internal zones)
+4. Check status: `mcp ps` or `mcp status mcns`
+5. View logs: `ssh rift 'doas su - mcp -s /bin/sh -c "podman logs mcns"'`
+
 ## Escalation
 
 Escalate when:

cmd/mcns/main.go

@@ -16,14 +16,14 @@ import (
 
 	"github.com/spf13/cobra"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
-	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
+	mcdsldb "git.wntrmute.dev/mc/mcdsl/db"
 
-	"git.wntrmute.dev/kyle/mcns/internal/config"
+	"git.wntrmute.dev/mc/mcns/internal/config"
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
-	mcnsdns "git.wntrmute.dev/kyle/mcns/internal/dns"
+	mcnsdns "git.wntrmute.dev/mc/mcns/internal/dns"
-	"git.wntrmute.dev/kyle/mcns/internal/grpcserver"
+	"git.wntrmute.dev/mc/mcns/internal/grpcserver"
-	"git.wntrmute.dev/kyle/mcns/internal/server"
+	"git.wntrmute.dev/mc/mcns/internal/server"
 )
 
 var version = "dev"

deploy/mcns-rift.toml

@@ -0,0 +1,17 @@
+name = "mcns"
+node = "rift"
+active = true
+
+[[components]]
+name = "dns"
+image = "mcr.svc.mcp.metacircular.net:8443/mcns:latest"
+user = "0:0"
+restart = "unless-stopped"
+ports = [
+    "192.168.88.181:53:53/tcp",
+    "192.168.88.181:53:53/udp",
+    "100.95.252.120:53:53/tcp",
+    "100.95.252.120:53:53/udp",
+]
+volumes = ["/srv/mcns:/srv/mcns"]
+cmd = ["server", "--config", "/srv/mcns/mcns.toml"]

gen/mcns/v1/admin.pb.go

@@ -110,7 +110,7 @@ const file_proto_mcns_v1_admin_proto_rawDesc = "" +
 	"\x0eHealthResponse\x12\x16\n" +
 	"\x06status\x18\x01 \x01(\tR\x06status2I\n" +
 	"\fAdminService\x129\n" +
-	"\x06Health\x12\x16.mcns.v1.HealthRequest\x1a\x17.mcns.v1.HealthResponseB/Z-git.wntrmute.dev/kyle/mcns/gen/mcns/v1;mcnsv1b\x06proto3"
+	"\x06Health\x12\x16.mcns.v1.HealthRequest\x1a\x17.mcns.v1.HealthResponseB-Z+git.wntrmute.dev/mc/mcns/gen/mcns/v1;mcnsv1b\x06proto3"
 
 var (
 	file_proto_mcns_v1_admin_proto_rawDescOnce sync.Once

gen/mcns/v1/auth.pb.go

@@ -222,7 +222,7 @@ const file_proto_mcns_v1_auth_proto_rawDesc = "" +
 	"\x0eLogoutResponse2\x80\x01\n" +
 	"\vAuthService\x126\n" +
 	"\x05Login\x12\x15.mcns.v1.LoginRequest\x1a\x16.mcns.v1.LoginResponse\x129\n" +
-	"\x06Logout\x12\x16.mcns.v1.LogoutRequest\x1a\x17.mcns.v1.LogoutResponseB/Z-git.wntrmute.dev/kyle/mcns/gen/mcns/v1;mcnsv1b\x06proto3"
+	"\x06Logout\x12\x16.mcns.v1.LogoutRequest\x1a\x17.mcns.v1.LogoutResponseB-Z+git.wntrmute.dev/mc/mcns/gen/mcns/v1;mcnsv1b\x06proto3"
 
 var (
 	file_proto_mcns_v1_auth_proto_rawDescOnce sync.Once

gen/mcns/v1/record.pb.go

@@ -551,7 +551,7 @@ const file_proto_mcns_v1_record_proto_rawDesc = "" +
 	"\fCreateRecord\x12\x1c.mcns.v1.CreateRecordRequest\x1a\x0f.mcns.v1.Record\x127\n" +
 	"\tGetRecord\x12\x19.mcns.v1.GetRecordRequest\x1a\x0f.mcns.v1.Record\x12=\n" +
 	"\fUpdateRecord\x12\x1c.mcns.v1.UpdateRecordRequest\x1a\x0f.mcns.v1.Record\x12K\n" +
-	"\fDeleteRecord\x12\x1c.mcns.v1.DeleteRecordRequest\x1a\x1d.mcns.v1.DeleteRecordResponseB/Z-git.wntrmute.dev/kyle/mcns/gen/mcns/v1;mcnsv1b\x06proto3"
+	"\fDeleteRecord\x12\x1c.mcns.v1.DeleteRecordRequest\x1a\x1d.mcns.v1.DeleteRecordResponseB-Z+git.wntrmute.dev/mc/mcns/gen/mcns/v1;mcnsv1b\x06proto3"
 
 var (
 	file_proto_mcns_v1_record_proto_rawDescOnce sync.Once

gen/mcns/v1/zone.pb.go

@@ -595,7 +595,7 @@ const file_proto_mcns_v1_zone_proto_rawDesc = "" +
 	"\n" +
 	"UpdateZone\x12\x1a.mcns.v1.UpdateZoneRequest\x1a\r.mcns.v1.Zone\x12E\n" +
 	"\n" +
-	"DeleteZone\x12\x1a.mcns.v1.DeleteZoneRequest\x1a\x1b.mcns.v1.DeleteZoneResponseB/Z-git.wntrmute.dev/kyle/mcns/gen/mcns/v1;mcnsv1b\x06proto3"
+	"DeleteZone\x12\x1a.mcns.v1.DeleteZoneRequest\x1a\x1b.mcns.v1.DeleteZoneResponseB-Z+git.wntrmute.dev/mc/mcns/gen/mcns/v1;mcnsv1b\x06proto3"
 
 var (
 	file_proto_mcns_v1_zone_proto_rawDescOnce sync.Once

go.mod

@@ -1,9 +1,9 @@
-module git.wntrmute.dev/kyle/mcns
+module git.wntrmute.dev/mc/mcns
 
 go 1.25.7
 
 require (
-	git.wntrmute.dev/kyle/mcdsl v1.0.0
+	git.wntrmute.dev/mc/mcdsl v1.2.0
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/miekg/dns v1.1.66
 	github.com/spf13/cobra v1.10.2

go.sum

@@ -1,5 +1,5 @@
-git.wntrmute.dev/kyle/mcdsl v1.0.0 h1:YB7dx4gdNYKKcVySpL6UkwHqdCJ9Nl1yS0+eHk0hNtk=
+git.wntrmute.dev/mc/mcdsl v1.2.0 h1:41hep7/PNZJfN0SN/nM+rQpyF1GSZcvNNjyVG81DI7U=
-git.wntrmute.dev/kyle/mcdsl v1.0.0/go.mod h1:wo0tGfUAxci3XnOe4/rFmR0RjUElKdYUazc+Np986sg=
+git.wntrmute.dev/mc/mcdsl v1.2.0/go.mod h1:lXYrAt74ZUix6rx9oVN8d2zH1YJoyp4uxPVKQ+SSxuM=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=

internal/config/config.go

@@ -3,7 +3,7 @@ package config
 import (
 	"fmt"
 
-	mcdslconfig "git.wntrmute.dev/kyle/mcdsl/config"
+	mcdslconfig "git.wntrmute.dev/mc/mcdsl/config"
 )
 
 // Config is the top-level MCNS configuration.

internal/db/db.go

@@ -4,7 +4,7 @@ import (
 	"database/sql"
 	"fmt"
 
-	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
+	mcdsldb "git.wntrmute.dev/mc/mcdsl/db"
 )
 
 // DB wraps a SQLite database connection.

internal/db/migrate.go

@@ -1,7 +1,7 @@
 package db
 
 import (
-	mcdsldb "git.wntrmute.dev/kyle/mcdsl/db"
+	mcdsldb "git.wntrmute.dev/mc/mcdsl/db"
 )
 
 // Migrations is the ordered list of MCNS schema migrations.

internal/dns/server.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/miekg/dns"
 
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 // Server is the MCNS DNS server. It listens on both UDP and TCP.

internal/dns/server_test.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/miekg/dns"
 
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 	"log/slog"
 )
 

internal/grpcserver/admin.go

@@ -3,8 +3,8 @@ package grpcserver
 import (
 	"context"
 
-	pb "git.wntrmute.dev/kyle/mcns/gen/mcns/v1"
+	pb "git.wntrmute.dev/mc/mcns/gen/mcns/v1"
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 type adminService struct {

internal/grpcserver/auth_handler.go

@@ -4,11 +4,11 @@ import (
 	"context"
 	"errors"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	pb "git.wntrmute.dev/kyle/mcns/gen/mcns/v1"
+	pb "git.wntrmute.dev/mc/mcns/gen/mcns/v1"
 )
 
 type authService struct {

internal/grpcserver/handlers_test.go

@@ -16,10 +16,10 @@ import (
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 
-	pb "git.wntrmute.dev/kyle/mcns/gen/mcns/v1"
+	pb "git.wntrmute.dev/mc/mcns/gen/mcns/v1"
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 // mockMCIAS starts a fake MCIAS HTTP server for token validation.

internal/grpcserver/interceptors.go

@@ -1,7 +1,7 @@
 package grpcserver
 
 import (
-	mcdslgrpc "git.wntrmute.dev/kyle/mcdsl/grpcserver"
+	mcdslgrpc "git.wntrmute.dev/mc/mcdsl/grpcserver"
 )
 
 // methodMap builds the mcdsl grpcserver.MethodMap for MCNS.

internal/grpcserver/records.go

@@ -10,8 +10,8 @@ import (
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
-	pb "git.wntrmute.dev/kyle/mcns/gen/mcns/v1"
+	pb "git.wntrmute.dev/mc/mcns/gen/mcns/v1"
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 type recordService struct {

internal/grpcserver/server.go

@@ -4,11 +4,11 @@ import (
 	"log/slog"
 	"net"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
-	mcdslgrpc "git.wntrmute.dev/kyle/mcdsl/grpcserver"
+	mcdslgrpc "git.wntrmute.dev/mc/mcdsl/grpcserver"
 
-	pb "git.wntrmute.dev/kyle/mcns/gen/mcns/v1"
+	pb "git.wntrmute.dev/mc/mcns/gen/mcns/v1"
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 // Deps holds the dependencies injected into the gRPC server.
@@ -24,7 +24,7 @@ type Server struct {
 
 // New creates a configured gRPC server with MCNS services registered.
 func New(certFile, keyFile string, deps Deps, logger *slog.Logger) (*Server, error) {
-	srv, err := mcdslgrpc.New(certFile, keyFile, deps.Authenticator, methodMap(), logger)
+	srv, err := mcdslgrpc.New(certFile, keyFile, deps.Authenticator, methodMap(), logger, nil)
 	if err != nil {
 		return nil, err
 	}

internal/grpcserver/zones.go

@@ -9,8 +9,8 @@ import (
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
-	pb "git.wntrmute.dev/kyle/mcns/gen/mcns/v1"
+	pb "git.wntrmute.dev/mc/mcns/gen/mcns/v1"
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 type zoneService struct {

internal/server/auth.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"net/http"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 )
 
 type loginRequest struct {

internal/server/handlers_test.go

@@ -12,8 +12,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 // openTestDB creates a temporary SQLite database with all migrations applied.

internal/server/middleware.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
 )
 
 type contextKey string

internal/server/records.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 type createRecordRequest struct {

internal/server/routes.go

@@ -7,10 +7,10 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	mcdslauth "git.wntrmute.dev/kyle/mcdsl/auth"
+	mcdslauth "git.wntrmute.dev/mc/mcdsl/auth"
-	"git.wntrmute.dev/kyle/mcdsl/health"
+	"git.wntrmute.dev/mc/mcdsl/health"
 
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 // Deps holds dependencies injected into the REST handlers.

internal/server/zones.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcns/internal/db"
+	"git.wntrmute.dev/mc/mcns/internal/db"
 )
 
 type createZoneRequest struct {

proto/mcns/v1/admin.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcns.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcns/gen/mcns/v1;mcnsv1";
+option go_package = "git.wntrmute.dev/mc/mcns/gen/mcns/v1;mcnsv1";
 
 // AdminService exposes server health and administrative operations.
 service AdminService {

proto/mcns/v1/auth.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcns.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcns/gen/mcns/v1;mcnsv1";
+option go_package = "git.wntrmute.dev/mc/mcns/gen/mcns/v1;mcnsv1";
 
 // AuthService handles authentication by delegating to MCIAS.
 service AuthService {

proto/mcns/v1/record.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcns.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcns/gen/mcns/v1;mcnsv1";
+option go_package = "git.wntrmute.dev/mc/mcns/gen/mcns/v1;mcnsv1";
 
 import "google/protobuf/timestamp.proto";
 

proto/mcns/v1/zone.proto

@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package mcns.v1;
 
-option go_package = "git.wntrmute.dev/kyle/mcns/gen/mcns/v1;mcnsv1";
+option go_package = "git.wntrmute.dev/mc/mcns/gen/mcns/v1;mcnsv1";
 
 import "google/protobuf/timestamp.proto";