New version

.gitignore

@@ -1,5 +1,8 @@
 # Secrets
 compose/.env
+certs/*.crt
+certs/*.key
+certs/*.pem
 
 # Claude Code
 .claude/

Makefile

@@ -3,7 +3,8 @@ COMMAND := docker
 
 COMPOSE_FILE := compose/docker-compose.yml
 ENV_FILE     := compose/.env
-API_URL      := http://localhost:4000
+API_URL      := https://llm.sttlab.pc:8443
+MCP_URL      := https://mcp.sttlab.pc:8443
 
 # ─── Docker Compose ───────────────────────────────────────────────────────────
 
@@ -21,24 +22,35 @@ docker-logs: ## Tail logs
 docker-ps: ## Show container status
 	$(COMMAND) compose -f $(COMPOSE_FILE) ps
 
-docker-test: ## Send a test request to each configured model
+docker-test: test-llm test-mcp ## Run all tests
-	@echo "→ claude-sonnet-4-6 (Anthropic)"
+
-	@curl -sf $(API_URL)/v1/chat/completions \
+test-llm: test-llm-claude-sonnet-4-6 ## Test all LLM endpoints
+
+test-llm-claude-sonnet-4-6: ## Test claude-sonnet-4-6 via Anthropic
+	@echo "→ LLM: claude-sonnet-4-6"
+	@curl -sk $(API_URL)/claude-sonnet-4-6/v1/chat/completions \
 	  -H "Content-Type: application/json" \
 	  -d '{"model":"claude-sonnet-4-6","messages":[{"role":"user","content":"ping"}]}' \
 	  | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['choices'][0]['message']['content'])"
-	@echo "→ or-gpt-5.5 (OpenRouter)"
+
-	@curl -sf $(API_URL)/v1/chat/completions \
+test-mcp-jira: ## Test MCP Jira endpoint via Traefik
+	@echo "→ MCP: /jira"
+	@curl -sk $(MCP_URL)/jira \
+	  -X POST \
 	  -H "Content-Type: application/json" \
-	  -d '{"model":"or-gpt-5.5","messages":[{"role":"user","content":"ping"}]}' \
+	  -H "Accept: application/json, text/event-stream" \
-	  | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['choices'][0]['message']['content'])"
+	  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"make-test","version":"1.0"}}}' \
+	  | grep -o '"name":"[^"]*"' | head -1
+
+test-mcp: test-mcp-jira ## Test all MCP endpoints
 
 docker-ui: ## Open the agentgateway UI in the browser
 	open http://localhost:15000/ui
 
 # ─── Help ─────────────────────────────────────────────────────────────────────
 
-.PHONY: docker-up docker-down docker-restart docker-logs docker-ps docker-test docker-ui help
+.PHONY: docker-up docker-down docker-restart docker-logs docker-ps docker-test docker-ui help \
+        test-llm test-llm-claude-sonnet-4-6 test-mcp test-mcp-jira
 
 help: ## Show this help
 	@grep -E '^[a-zA-Z_-]+:.*##' $(MAKEFILE_LIST) \

compose/docker-compose.yml

@@ -2,12 +2,38 @@ services:
   agentgateway:
     image: ghcr.io/agentgateway/agentgateway:v1.1.0
     ports:
-      - "4000:4000"   # OpenAI-compatible API
+      - "4000:4000"     # OpenAI-compatible API
-      - "15000:15000" # UI
+      - "9001:9001"     # MCP gateway
+      - "15000:15000"   # UI
     volumes:
       - ../config:/etc/agentgateway:ro
+      - ../certs:/etc/ssl/agentgateway:ro
     command: ["-f", "/etc/agentgateway/config-binds.yaml"]
     environment:
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+    labels:
+      - "traefik.enable=true"
+      # TCP passthrough — TLS terminé par agentgateway (nécessaire pour SSE)
+      - "traefik.tcp.routers.agentgateway-mcp.rule=HostSNI(`mcp.sttlab.pc`)"
+      - "traefik.tcp.routers.agentgateway-mcp.entrypoints=websecure"
+      - "traefik.tcp.routers.agentgateway-mcp.tls.passthrough=true"
+      - "traefik.tcp.routers.agentgateway-mcp.service=agentgateway-mcp"
+      - "traefik.tcp.services.agentgateway-mcp.loadbalancer.server.port=9001"
+      # LLM proxy
+      - "traefik.tcp.routers.agentgateway-llm.rule=HostSNI(`llm.sttlab.pc`)"
+      - "traefik.tcp.routers.agentgateway-llm.entrypoints=websecure"
+      - "traefik.tcp.routers.agentgateway-llm.tls.passthrough=true"
+      - "traefik.tcp.routers.agentgateway-llm.service=agentgateway-llm"
+      - "traefik.tcp.services.agentgateway-llm.loadbalancer.server.port=4000"
+    networks:
+      - default
+      - pm-tools
+      - reverse
     restart: unless-stopped
+
+networks:
+  pm-tools:
+    external: true
+  reverse:
+    external: true

config/config-binds.yaml

@@ -8,8 +8,16 @@ config:
 binds:
   - port: 4000
     listeners:
-      - routes:
+      - protocol: HTTPS
-          - backends:
+        tls:
+          cert: /etc/ssl/agentgateway/server.crt
+          key: /etc/ssl/agentgateway/server.key
+          minTLSVersion: TLS_V1_2
+        routes:
+          - matches:
+              - path:
+                  pathPrefix: /claude-sonnet-4-6
+            backends:
               - ai:
                   name: claude-sonnet-4-6
                   provider:
@@ -18,3 +26,23 @@ binds:
             policies:
               backendAuth:
                 key: "$ANTHROPIC_API_KEY"
+
+  - port: 9001
+    listeners:
+      - protocol: HTTPS
+        tls:
+          cert: /etc/ssl/agentgateway/server.crt
+          key: /etc/ssl/agentgateway/server.key
+          minTLSVersion: TLS_V1_2
+        routes:
+          - matches:
+              - path:
+                  pathPrefix: /jira
+            backends:
+              - mcp:
+                  targets:
+                    - name: jira
+                      mcp:
+                        host: mcp-jira
+                        port: 9000
+                        path: /mcp