privatae/privatae-bastion
2
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

bastion 0.55.3
ci / personal-data (push) Successful in 5s
Details
ci / test (push) Successful in 3m51s
Details
ci / fuzz (push) Successful in 2m55s
Details

Browse Source
This commit is contained in:
Privatae
2026-10-25 23:16:45 +00:00
parent 77b7853ae1
commit 8822d5df85
136 changed files with 8638 additions and 1641 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/models.md
+23 -8
View File
@@ -13,11 +13,26 @@ op. A pull is reported available only after a behavioural probe, because a
completed download proves only that bytes arrived.
Note the boundary: those rules govern the `model:*` ops. The host's direct
traffic to the ollama forward inside the tunnel is filtered (store-changing
requests such as `/api/pull` and `/api/delete` refused, model names checked)
only when the pairing is **scoped to named models**, when you have switched
the `models` capability off in the local console, or when a networked
bastion's grant withholds model management. Otherwise, on a local bastion
with an unscoped pairing, that forward is a raw byte-for-byte splice to your
ollama, and the pairing itself is the authorization. Scope the pairing on
your host, or switch `models` off here, if you want the filter.
traffic to the ollama forward inside the tunnel is a separate path, and it is
filtered (store-changing requests such as `/api/pull` and `/api/delete`
refused) in these cases:
- **On an anchored machine**, for every pairing, the anchor included. Changing
which models are there goes through `model:pull` and `model:drop`. A member
host whose grant from the anchor is **scoped to named models** also has
every request's model name checked against that list.
- **On a local machine**, once you switch the `models` capability off for
that host in the local console (`privatae-bastion ui`). On a root install
kept local (`--local`), `sudo -H privatae-bastion switch <host> models off`
does the same. On an install as your own user that command reads root's
state, where your host is not paired, so it switches nothing; use the
console.
Otherwise, on a local machine, that forward is a raw byte-for-byte splice to
your ollama, and the pairing itself is the authorization. A local machine
reads no grant for this, so a scope set on the host does nothing there:
switching `models` off is how you stop a host there changing your models.
The egress lane is no way around that switch: on a local machine it never
reaches this machine's own addresses (see
[the security model](security-model.md)), so ollama on loopback or on this
machine's LAN address cannot be reached through it either.