Converge Ollama as a least-privilege tailnet service #647

New issue

Open

opened 2026-07-26 02:00:08 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-26 02:00:08 +00:00

Member

Decision

Keep Ollama on the GPU tower as a raw machine-plane service reachable over the tailnet. Agent Proxy and LiteLLM remain the normal authenticated client boundary. Ollama gets no public or general LAN exposure, and tailnet membership is not treated as application authentication.

Current state

The serving path already exists:

Agent Proxy and LiteLLM on ser8 call the tower on port 11434.
Open WebUI reaches the same endpoint through tag:svc-open-webui.
Docker Desktop ward carries reach it through the tag:proxy SOCKS5 sidecar added by #400.
scripts/converge-ollama-windows.ps1 sets OLLAMA_HOST=0.0.0.0:11434.
scripts/ollama-expose-tailnet.ps1 disables Ollama application block rules and permits the full Tailscale CGNAT range through Windows Firewall.
terraform/tailscale/main.tf contains narrow grants for tag:proxy and tag:svc-open-webui, but the broader autogroup:member -> *:* and tag:physical -> *:* rules mean those narrow grants are not an exclusive caller boundary.

The endpoint works, but the desired least-privilege posture is not fully converged or proven.

Ownership

Infrastructure owns the tower listener, Windows Firewall posture, Tailscale policy, reboot convergence, and live verification. coilyco-bridge/deploy remains a consumer and should not acquire tower host configuration.

Related work:

#356 tracks the broader Windows tower convergence foundation.
#400 added the tag:proxy Ollama grant.

Work

Inventory every required raw Ollama caller. The known set is tower-local loopback, ser8 for Agent Proxy and LiteLLM, tag:svc-open-webui, and tag:proxy.
Converge the Windows listener and firewall as one idempotent contract. Preserve tower-local loopback access while making LAN and public ingress fail closed.
Prefer a listener bound to the Tailscale interface when that can coexist reliably with local clients and reboot ordering. If Windows or Ollama requires an all-interface listener, retain it only with an explicit, tested firewall boundary that permits the intended tailnet path and denies other remote interfaces.
Keep opaque tailnet addresses out of tracked files. Resolve the current interface or address at converge time.
Refactor the tailnet policy enough that port 11434 is reachable only by the accepted caller identities. A narrow grant does not count while a broader wildcard rule still grants the same path.
Add policy tests for each accepted source and at least one denied member, denied tagged physical device, and denied service identity.
Document the final listener, caller set, rollback, and verification contract next to the Windows Ollama convergence path.

Safety boundary

Changing the Windows listener or firewall can interrupt local model work. Applying the Tailscale policy changes live fleet connectivity. The engineer authors and validates the repository change. An interactive operator performs the host converge and Terraform apply, with rollback ready.

Do not use Tailscale Funnel. Do not add a public reverse proxy. Do not add a reusable bearer secret to Ollama merely to compensate for an over-broad network policy.

Acceptance

A reboot and repeated converge restore the same Ollama listener and firewall state without hand edits.
Tower-local clients can still reach Ollama.
Agent Proxy and LiteLLM on ser8, Open WebUI, and the tag:proxy carry path can reach port 11434.
An unapproved tailnet member, an unrelated tagged physical device, an unrelated service tag, and a LAN-only peer cannot reach port 11434.
No listener is reachable from the public internet.
Tailscale policy tests encode the accepted and denied paths.
The Windows firewall contract has a deterministic validation path for allowed tailnet traffic and denied LAN traffic.
Agent Proxy direct fallback, LiteLLM model discovery, Open WebUI model discovery, and local tower harnesses retain their existing behavior.
Documentation states that raw Ollama is an unauthenticated backend and clients should prefer Agent Proxy or LiteLLM.
Repository validation passes.
The operator records post-apply evidence without printing opaque addresses or secrets.

## Decision Keep Ollama on the GPU tower as a raw machine-plane service reachable over the tailnet. Agent Proxy and LiteLLM remain the normal authenticated client boundary. Ollama gets no public or general LAN exposure, and tailnet membership is not treated as application authentication. ## Current state The serving path already exists: * Agent Proxy and LiteLLM on ser8 call the tower on port `11434`. * Open WebUI reaches the same endpoint through `tag:svc-open-webui`. * Docker Desktop ward carries reach it through the `tag:proxy` SOCKS5 sidecar added by #400. * `scripts/converge-ollama-windows.ps1` sets `OLLAMA_HOST=0.0.0.0:11434`. * `scripts/ollama-expose-tailnet.ps1` disables Ollama application block rules and permits the full Tailscale CGNAT range through Windows Firewall. * `terraform/tailscale/main.tf` contains narrow grants for `tag:proxy` and `tag:svc-open-webui`, but the broader `autogroup:member -> *:*` and `tag:physical -> *:*` rules mean those narrow grants are not an exclusive caller boundary. The endpoint works, but the desired least-privilege posture is not fully converged or proven. ## Ownership Infrastructure owns the tower listener, Windows Firewall posture, Tailscale policy, reboot convergence, and live verification. `coilyco-bridge/deploy` remains a consumer and should not acquire tower host configuration. Related work: * #356 tracks the broader Windows tower convergence foundation. * #400 added the `tag:proxy` Ollama grant. ## Work * Inventory every required raw Ollama caller. The known set is tower-local loopback, ser8 for Agent Proxy and LiteLLM, `tag:svc-open-webui`, and `tag:proxy`. * Converge the Windows listener and firewall as one idempotent contract. Preserve tower-local loopback access while making LAN and public ingress fail closed. * Prefer a listener bound to the Tailscale interface when that can coexist reliably with local clients and reboot ordering. If Windows or Ollama requires an all-interface listener, retain it only with an explicit, tested firewall boundary that permits the intended tailnet path and denies other remote interfaces. * Keep opaque tailnet addresses out of tracked files. Resolve the current interface or address at converge time. * Refactor the tailnet policy enough that port `11434` is reachable only by the accepted caller identities. A narrow grant does not count while a broader wildcard rule still grants the same path. * Add policy tests for each accepted source and at least one denied member, denied tagged physical device, and denied service identity. * Document the final listener, caller set, rollback, and verification contract next to the Windows Ollama convergence path. ## Safety boundary Changing the Windows listener or firewall can interrupt local model work. Applying the Tailscale policy changes live fleet connectivity. The engineer authors and validates the repository change. An interactive operator performs the host converge and Terraform apply, with rollback ready. Do not use Tailscale Funnel. Do not add a public reverse proxy. Do not add a reusable bearer secret to Ollama merely to compensate for an over-broad network policy. ## Acceptance * A reboot and repeated converge restore the same Ollama listener and firewall state without hand edits. * Tower-local clients can still reach Ollama. * Agent Proxy and LiteLLM on ser8, Open WebUI, and the `tag:proxy` carry path can reach port `11434`. * An unapproved tailnet member, an unrelated tagged physical device, an unrelated service tag, and a LAN-only peer cannot reach port `11434`. * No listener is reachable from the public internet. * Tailscale policy tests encode the accepted and denied paths. * The Windows firewall contract has a deterministic validation path for allowed tailnet traffic and denied LAN traffic. * Agent Proxy direct fallback, LiteLLM model discovery, Open WebUI model discovery, and local tower harnesses retain their existing behavior. * Documentation states that raw Ollama is an unauthenticated backend and clients should prefer Agent Proxy or LiteLLM. * Repository validation passes. * The operator records post-apply evidence without printing opaque addresses or secrets.

coilyco-ops added the

autonomy

live-collab

label

2026-07-26 02:00:11 +00:00

coilyco-ops added the

priority

label

2026-07-29 03:46:32 +00:00