v1.0

homey-mcp/UBUNTU_SETUP.md

@@ -23,7 +23,8 @@ Required fields:
 Optional for LAN mode:
 - `HOMEY_MCP_AUTH_MODE` - `none` for trusted-LAN compatibility, or `bearer`
 - `HOMEY_MCP_AUTH_TOKEN` - Protects REST and, in `bearer` mode, MCP requests
-- `HOMEY_MCP_ADVERTISED_HOST` - Set this to your server's LAN IP (e.g., `10.10.10.50`). Required if using `HOMEY_MCP_HOST=0.0.0.0`.
+- `HOMEY_MCP_ADVERTISED_HOST` - Set this to your server's LAN IP (e.g., `10.10.10.50`). Required if using `HOMEY_MCP_HOST=0.0.0.0`: only requests whose `Host` header is this name, `localhost` or `127.0.0.1` are accepted (DNS-rebinding protection).
+- `HOMEY_MCP_ALLOWED_HOSTS` - Extra comma-separated host names clients may use (e.g. a DNS name); `*` disables the check.
 
 ### 3. Start the server
 
@@ -69,8 +70,8 @@ HOMEY_MCP_TRANSPORT=streamable-http HOMEY_MCP_HOST=0.0.0.0 HOMEY_MCP_PORT=8080 \
 Install the service file for automatic startup:
 
 ```bash
-# Copy service file
-sudo cp homey-mcp.service /etc/systemd/system/
+# Copy service file (it is a template: one instance per user)
+sudo cp homey-mcp.service /etc/systemd/system/homey-mcp@.service
 
 # Reload systemd
 sudo systemctl daemon-reload
@@ -95,7 +96,7 @@ To connect Odysseus as an MCP client, use the streamable-http transport:
    Authentication: none
    ```
 
-If you see a "421 Misdirected Request" error, your `HOMEY_MCP_ADVERTISED_HOST` is not set correctly; it must match the IP that Odysseus uses to connect.
+If you see a "421 Misdirected Request" error, the `Host` the client uses is not allowed: set `HOMEY_MCP_ADVERTISED_HOST` to the IP Odysseus connects to, or add the name to `HOMEY_MCP_ALLOWED_HOSTS`.
 
 Use `HOMEY_MCP_AUTH_MODE=none` only on a trusted, firewall-restricted LAN.
 This avoids an OAuth discovery flow, which homey-mcp does not implement. If