115 lines
3.9 KiB
Bash
Executable File
115 lines
3.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Install a user LaunchAgent that keeps the 111 Ollama LAN entrypoint behind
|
|
# scripts/ops/ollama111_allow_proxy.py. This avoids sudo/pfctl and keeps the
|
|
# real Ollama process bound to localhost while exposing an allowlisted LAN port.
|
|
|
|
PROJECT_DIR="${PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
|
|
LABEL="${OLLAMA111_PROXY_LABEL:-com.momo.ollama111-allow-proxy}"
|
|
PLIST_DIR="${HOME}/Library/LaunchAgents"
|
|
PLIST_PATH="${PLIST_DIR}/${LABEL}.plist"
|
|
LOG_DIR="${HOME}/Library/Logs"
|
|
PID_FILE="${HOME}/.ollama/ollama111-allow-proxy.pid"
|
|
INSTALL_DIR="${OLLAMA111_PROXY_INSTALL_DIR:-${HOME}/.local/share/momo-pro-system}"
|
|
INSTALL_SCRIPT_PATH="${INSTALL_DIR}/ollama111_allow_proxy.py"
|
|
PYTHON_BIN="${PYTHON_BIN:-/usr/bin/python3}"
|
|
OLLAMA_APP="${OLLAMA_APP:-/Applications/Ollama.app}"
|
|
OLLAMA_HOST_VALUE="${OLLAMA_HOST_VALUE:-127.0.0.1:11434}"
|
|
ALLOWED_CIDRS="${OLLAMA111_PROXY_ALLOWED_CIDRS:-127.0.0.1/32,192.168.0.111/32,192.168.0.188/32}"
|
|
GUI_DOMAIN="gui/$(id -u)"
|
|
|
|
if [[ ! -f "${PROJECT_DIR}/scripts/ops/ollama111_allow_proxy.py" ]]; then
|
|
echo "missing proxy script under PROJECT_DIR=${PROJECT_DIR}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "${PLIST_DIR}" "${LOG_DIR}" "${HOME}/.ollama" "${INSTALL_DIR}"
|
|
cp "${PROJECT_DIR}/scripts/ops/ollama111_allow_proxy.py" "${INSTALL_SCRIPT_PATH}"
|
|
chmod 0755 "${INSTALL_SCRIPT_PATH}"
|
|
|
|
launchctl setenv OLLAMA_HOST "${OLLAMA_HOST_VALUE}"
|
|
|
|
# Stop the ad-hoc nohup proxy from the initial incident response, if present.
|
|
if [[ -f "${PID_FILE}" ]]; then
|
|
old_pid="$(cat "${PID_FILE}" 2>/dev/null || true)"
|
|
if [[ -n "${old_pid}" ]]; then
|
|
kill "${old_pid}" >/dev/null 2>&1 || true
|
|
fi
|
|
rm -f "${PID_FILE}"
|
|
fi
|
|
while IFS= read -r old_proxy_pid; do
|
|
[[ -n "${old_proxy_pid}" ]] && kill "${old_proxy_pid}" >/dev/null 2>&1 || true
|
|
done < <(pgrep -f '[o]llama111_allow_proxy.py' || true)
|
|
|
|
# Restart Ollama so it observes the launchd user environment. The pgrep pattern
|
|
# intentionally avoids matching this installer command.
|
|
osascript -e 'quit app "Ollama"' >/dev/null 2>&1 || true
|
|
while IFS= read -r old_ollama_pid; do
|
|
[[ -n "${old_ollama_pid}" ]] && kill "${old_ollama_pid}" >/dev/null 2>&1 || true
|
|
done < <(pgrep -f '[o]llama serve' || true)
|
|
sleep 2
|
|
open "${OLLAMA_APP}"
|
|
|
|
for _ in $(seq 1 20); do
|
|
if curl -fsS --max-time 2 "http://${OLLAMA_HOST_VALUE}/api/version" >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
|
|
cat > "${PLIST_PATH}" <<PLIST
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
|
|
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>Label</key>
|
|
<string>${LABEL}</string>
|
|
<key>ProgramArguments</key>
|
|
<array>
|
|
<string>${PYTHON_BIN}</string>
|
|
<string>${INSTALL_SCRIPT_PATH}</string>
|
|
</array>
|
|
<key>WorkingDirectory</key>
|
|
<string>${INSTALL_DIR}</string>
|
|
<key>EnvironmentVariables</key>
|
|
<dict>
|
|
<key>OLLAMA111_PROXY_ALLOWED_CIDRS</key>
|
|
<string>${ALLOWED_CIDRS}</string>
|
|
<key>OLLAMA111_PROXY_LISTEN_HOST</key>
|
|
<string>192.168.0.111</string>
|
|
<key>OLLAMA111_PROXY_LISTEN_PORT</key>
|
|
<string>11434</string>
|
|
<key>OLLAMA111_PROXY_TARGET_HOST</key>
|
|
<string>127.0.0.1</string>
|
|
<key>OLLAMA111_PROXY_TARGET_PORT</key>
|
|
<string>11434</string>
|
|
<key>PYTHONUNBUFFERED</key>
|
|
<string>1</string>
|
|
</dict>
|
|
<key>RunAtLoad</key>
|
|
<true/>
|
|
<key>KeepAlive</key>
|
|
<true/>
|
|
<key>StandardOutPath</key>
|
|
<string>${LOG_DIR}/ollama111-allow-proxy.log</string>
|
|
<key>StandardErrorPath</key>
|
|
<string>${LOG_DIR}/ollama111-allow-proxy.err.log</string>
|
|
</dict>
|
|
</plist>
|
|
PLIST
|
|
|
|
launchctl bootout "${GUI_DOMAIN}" "${PLIST_PATH}" >/dev/null 2>&1 || true
|
|
: > "${LOG_DIR}/ollama111-allow-proxy.err.log"
|
|
launchctl bootstrap "${GUI_DOMAIN}" "${PLIST_PATH}"
|
|
launchctl kickstart -k "${GUI_DOMAIN}/${LABEL}"
|
|
|
|
sleep 2
|
|
echo "installed ${LABEL}"
|
|
echo "plist=${PLIST_PATH}"
|
|
echo "script=${INSTALL_SCRIPT_PATH}"
|
|
echo "allowed=${ALLOWED_CIDRS}"
|
|
launchctl print "${GUI_DOMAIN}/${LABEL}" | head -40 || true
|
|
tail -20 "${LOG_DIR}/ollama111-allow-proxy.log" || true
|