59 lines
1.9 KiB
Bash
Executable File
59 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# 188 Ollama 緊急封口。
|
||
# 不需要 root：把目前對外開放的 ollama serve 換成只綁 127.0.0.1:11434 的同使用者進程。
|
||
# 這是臨時手段；永久修法仍必須用 root 修改 systemd override。
|
||
|
||
set -euo pipefail
|
||
|
||
LEGACY_SSH="${LEGACY_SSH:-ollama@192.168.0.188}"
|
||
|
||
ssh -o BatchMode=yes -o ConnectTimeout=5 "$LEGACY_SSH" 'cat > ~/awoooi-ops/ollama-localhost-containment.sh <<'"'"'REMOTE_SH'"'"'
|
||
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
|
||
LOG="$HOME/awoooi-ops/ollama-localhost-containment.log"
|
||
SERVE_LOG="$HOME/awoooi-ops/ollama-localhost-serve.log"
|
||
|
||
{
|
||
echo "=== containment start $(date) ==="
|
||
echo "before:"
|
||
ss -lntp | grep 11434 || true
|
||
|
||
for i in $(seq 1 20); do
|
||
pkill -u ollama -f "/usr/local/bin/ollama serve" 2>/dev/null || true
|
||
sleep 0.2
|
||
nohup env \
|
||
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin" \
|
||
OLLAMA_HOST="127.0.0.1:11434" \
|
||
OLLAMA_KEEP_ALIVE="30m" \
|
||
OLLAMA_MAX_LOADED_MODELS="2" \
|
||
OLLAMA_NUM_THREAD="14" \
|
||
OLLAMA_NUM_PARALLEL="4" \
|
||
OLLAMA_FLASH_ATTENTION="1" \
|
||
OLLAMA_RUNNERS_DIR="/tmp/ollama_runners" \
|
||
/usr/local/bin/ollama serve >> "$SERVE_LOG" 2>&1 &
|
||
sleep 1
|
||
if ss -lntp | grep -q "127.0.0.1:11434"; then
|
||
echo "contained on attempt $i"
|
||
break
|
||
fi
|
||
done
|
||
|
||
echo "after:"
|
||
ss -lntp | grep 11434 || true
|
||
echo "local test:"
|
||
curl -sS --max-time 3 http://127.0.0.1:11434/api/tags >/dev/null && echo LOCAL_OK || echo LOCAL_FAIL
|
||
echo "=== containment end $(date) ==="
|
||
} | tee -a "$LOG"
|
||
REMOTE_SH
|
||
chmod +x ~/awoooi-ops/ollama-localhost-containment.sh
|
||
~/awoooi-ops/ollama-localhost-containment.sh'
|
||
|
||
echo "=== 驗證 LAN 入口 ==="
|
||
if curl -sS --max-time 3 http://192.168.0.188:11434/api/tags >/dev/null 2>&1; then
|
||
echo "FAIL: 192.168.0.188:11434 仍可從 LAN 連線"
|
||
exit 1
|
||
fi
|
||
|
||
echo "PASS: 192.168.0.188:11434 已拒絕 LAN 連線"
|