feat(glyph): Use MCPJungle as gateway

hosts/glyph/services/default.nix

@@ -59,4 +59,6 @@
     enable = true;
     extraUpFlags = ["--ssh"];
   };
+
+  services.mcpjungle.enable = true;
 }

modules/home/development.nix

@@ -56,6 +56,7 @@ in {
               "Bash(git show *)"
               "Bash(git add *)"
               "Bash(git branch *)"
+              "Bash(gh api:*)"
               "Bash(mkdir *)"
               "Bash(* --version)"
               "Bash(* --help *)"

modules/nixos/default.nix

@@ -1,6 +1,7 @@
 # NixOS-specific configuration modules
 {
   imports = [
+    ./llm
     ./web
     ./filebrowser-quantum.nix
     ./users.nix

modules/nixos/llm/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./mcpjungle.nix
+  ];
+}

modules/nixos/llm/mcpjungle.nix

@@ -0,0 +1,60 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.services.mcpjungle;
+in {
+  options.services.mcpjungle = {
+    enable = lib.mkEnableOption "MCPJungle MCP Gateway";
+
+    package = lib.mkPackageOption pkgs "mcpjungle" {};
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8090;
+      description = "Port for the HTTP server to listen on.";
+    };
+
+    openFirewall = lib.mkEnableOption "opening firewall ports for MCPJungle";
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.mcpjungle = {
+      isSystemUser = true;
+      group = "mcpjungle";
+    };
+    users.groups.mcpjungle = {};
+
+    systemd.services.mcpjungle = {
+      description = "MCPJungle MCP Gateway";
+      after = ["network.target"];
+      wantedBy = ["multi-user.target"];
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} start --port ${toString cfg.port}";
+        User = "mcpjungle";
+        Group = "mcpjungle";
+        WorkingDirectory = "/var/lib/mcpjungle";
+        StateDirectory = "mcpjungle";
+        Restart = "on-failure";
+        RestartSec = 5;
+
+        # Hardening
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectHome = true;
+        ProtectSystem = "strict";
+        ReadWritePaths = ["/var/lib/mcpjungle"];
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictSUIDSGID = true;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [cfg.port];
+  };
+}

overlays/custom-packages.nix

@@ -13,6 +13,9 @@ self: super: {
   # FileBrowser quantum fork
   filebrowser-quantum = super.callPackage ./../packages/filebrowser-quantum/package.nix {};
 
+  # MCP Gateway
+  mcpjungle = super.callPackage ./../packages/mcpjungle/package.nix {};
+
   # Mochi spaced repetition software
   mochi = super.callPackage ./../packages/mochi/package.nix {};
 

packages/mcpjungle/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+buildGoModule rec {
+  pname = "mcpjungle";
+  version = "0.3.5";
+
+  src = fetchFromGitHub {
+    owner = "mcpjungle";
+    repo = "mcpjungle";
+    rev = version;
+    hash = "sha256-Q/ASyI6DygmYa284wk2pmYgVtPKRummnyh60v+Ri7bU=";
+  };
+
+  vendorHash = "sha256-pvCDf7Y+LiIOiZ0O/bJMzkf75o7HQbYpF01yFY4J9Yg=";
+
+  # Tests require HOME to exist (tilde expansion); skip in sandbox
+  doCheck = false;
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/mcpjungle/mcpjungle/pkg/version.Version=${version}"
+  ];
+
+  meta = with lib; {
+    description = "Self-hosted MCP Gateway";
+    homepage = "https://github.com/mcpjungle/mcpjungle";
+    license = licenses.mit;
+    mainProgram = "mcpjungle";
+  };
+}