obfuscation layer: shim v2 on :28443 (token-gated, de-Ollama'd paths, nginx fingerprint), tailnet-only dashboard :47077 (token gate), secrets staged

This commit is contained in:
Hermes
2026-10-02 02:21:27 -07:00
parent b3c3cec909
commit 1e3aaf3193
5 changed files with 115 additions and 5 deletions

View File

@@ -18,7 +18,8 @@ log = logging.getLogger("mailer")
# ------------------------------------------------------------------ config
def load_config():
defaults = {
"ollama_url": "http://100.103.34.0:11440", # nightmare tailnet via non-chunked shim
"ollama_url": "http://100.103.34.0:28443", # obfuscated shim (token-gated, nonstandard port)
"ollama_token": "", # X-Auth-Token for the shim
"ollama_model": "mgraffam/gemma4-heretic:12b",
"ses_region": "us-east-1",
"send_mode": "smtp", # smtp (works now) | ses (needs AWS keys)
@@ -119,15 +120,22 @@ def init_db():
# ------------------------------------------------------------------ ollama
class OllamaClient:
def __init__(self, url, model, timeout=300):
def __init__(self, url, model, timeout=300, token=""):
self.url = url.rstrip("/")
self.model = model
self.timeout = timeout
self.token = token
self._fail_until = 0
def _headers(self):
h = {}
if self.token:
h["X-Auth-Token"] = self.token
return h
def healthy(self):
try:
r = requests.get(f"{self.url}/api/tags", timeout=5)
r = requests.get(f"{self.url}/tags", headers=self._headers(), timeout=8)
return r.status_code == 200
except Exception:
return False
@@ -136,7 +144,8 @@ class OllamaClient:
if time.time() < self._fail_until:
return None
try:
r = requests.post(f"{self.url}/api/generate",
r = requests.post(f"{self.url}/gen",
headers=self._headers(),
json={"model": self.model, "prompt": prompt, "stream": False,
"options": {"num_predict": 350, "temperature": 0.8}, "keep_alive": "15m"},
timeout=self.timeout)
@@ -326,7 +335,7 @@ class Engine:
"total": len(rows), "started_at": datetime.now().isoformat(timespec='seconds')})
log.info(f"campaign {campaign_id} start: {len(rows)} recipients")
ollama = OllamaClient(cfg["ollama_url"], cfg["ollama_model"]) if cfg.get("personalize") else None
ollama = OllamaClient(cfg["ollama_url"], cfg["ollama_model"], token=cfg.get("ollama_token", "")) if cfg.get("personalize") else None
if ollama:
self.state["current"] = f"checking Ollama at {cfg['ollama_url']}..."
if ollama.healthy():