@ollamawg/cli 0.0.0-stage → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +113 -2
- package/bin/ollamawg.js +33 -0
- package/package.json +36 -4
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Himanshu Mamgain
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
CHANGED
|
@@ -1,3 +1,114 @@
|
|
|
1
|
-
#
|
|
1
|
+
# ollamawg
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Reach your Ollama server from anywhere without exposing it to the internet.
|
|
4
|
+
|
|
5
|
+
`ollamawg` puts a WireGuard tunnel in front of Ollama, adds per-device access control, and gives you a dashboard on the host that shows who is connected, what they run, and who is knocking on the port. You can block a device or an IP with one click.
|
|
6
|
+
|
|
7
|
+
It is a single Go binary. WireGuard runs in user space through [wireguard-go](https://git.zx2c4.com/wireguard-go) and gVisor's network stack, so it needs no root, no kernel module and no TUN device, on the server or on clients. Keys are standard WireGuard keys.
|
|
8
|
+
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
<sub>Screenshot taken with simulated devices and traffic.</sub>
|
|
12
|
+
|
|
13
|
+
## How it works
|
|
14
|
+
|
|
15
|
+
```
|
|
16
|
+
device machine running Ollama
|
|
17
|
+
┌──────────────────────────┐ UDP 51820 ┌────────────────────────────────────────────────┐
|
|
18
|
+
│ app → 127.0.0.1:11434 │ WireGuard │ firewall → WireGuard → proxy → 127.0.0.1:11434 │
|
|
19
|
+
│ ollamawg connect ─┼──(encrypted)──►│ (IP rules) (keys) (roles, Ollama │
|
|
20
|
+
└──────────────────────────┘ │ models, │
|
|
21
|
+
│ rate, log) │
|
|
22
|
+
│ dashboard on 127.0.0.1:8088 │
|
|
23
|
+
└────────────────────────────────────────────────┘
|
|
24
|
+
```
|
|
25
|
+
|
|
26
|
+
1. **Firewall.** Every UDP packet hitting the WireGuard port is checked against your IP and CIDR rules before WireGuard sees it. Every source is counted, including scanners that never complete a handshake.
|
|
27
|
+
2. **WireGuard.** Only devices whose public key you registered can complete a handshake. Each device gets one tunnel IP, and WireGuard guarantees that traffic from that IP really comes from that key.
|
|
28
|
+
3. **Proxy.** Inside the tunnel, a reverse proxy enforces each device's role, model allowlist and rate limit. It logs every request with its token counts, then streams the request to Ollama on loopback.
|
|
29
|
+
|
|
30
|
+
Ollama itself stays on `127.0.0.1`. Nothing outside the tunnel can talk to it.
|
|
31
|
+
|
|
32
|
+
## Quickstart
|
|
33
|
+
|
|
34
|
+
On the machine running Ollama:
|
|
35
|
+
|
|
36
|
+
```sh
|
|
37
|
+
npm install -g @ollamawg/cli # prebuilt binary, or:
|
|
38
|
+
go install github.com/himanshu-mamgain/ollamawg/cmd/ollamawg@latest
|
|
39
|
+
|
|
40
|
+
ollamawg init --endpoint your-public-ip-or-dns:51820
|
|
41
|
+
ollamawg add-peer --name laptop
|
|
42
|
+
ollamawg serve
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
`init` prints the dashboard password. Open `http://127.0.0.1:8088` on the server, or reach it over SSH with `ssh -L 8088:127.0.0.1:8088 server`. Forward UDP port 51820 on your router or cloud firewall.
|
|
46
|
+
|
|
47
|
+
Copy `laptop.yaml` to the laptop, then run:
|
|
48
|
+
|
|
49
|
+
```sh
|
|
50
|
+
ollamawg connect --config laptop.yaml
|
|
51
|
+
curl http://127.0.0.1:11434/api/tags # any Ollama client works unchanged
|
|
52
|
+
```
|
|
53
|
+
|
|
54
|
+
See [Getting started](docs/getting-started.md) for the full walkthrough.
|
|
55
|
+
|
|
56
|
+
## Features
|
|
57
|
+
|
|
58
|
+
- **Userspace WireGuard** on Linux, macOS, Windows and the BSDs, with no admin rights needed on clients.
|
|
59
|
+
- **Per-device policy:**
|
|
60
|
+
- Roles: `user` for inference, `readonly`, `admin` for pull and delete, or custom path rules.
|
|
61
|
+
- A model allowlist, such as `llama3.2,qwen3:*`.
|
|
62
|
+
- A requests-per-minute limit.
|
|
63
|
+
- **Blocking:**
|
|
64
|
+
- **By device ID.** The session is cut immediately and new handshakes are refused.
|
|
65
|
+
- **By IP or CIDR.** Packets are dropped before WireGuard.
|
|
66
|
+
- **Default-deny mode,** which admits only allowlisted networks.
|
|
67
|
+
- **Observability:**
|
|
68
|
+
- Access log with device, public IP, model, status, latency and prompt/generated token counts. It can also be written to a JSON Lines file.
|
|
69
|
+
- Security events: connects, roaming, policy denials, firewall drops and admin actions.
|
|
70
|
+
- Traffic graphs per device for 1, 6 or 24 hours, plus token usage per model.
|
|
71
|
+
- Prometheus `/metrics`.
|
|
72
|
+
- **Dashboard:** add devices and download their config, edit policy, block and unblock, and manage firewall rules. It is one embedded page with no CDN, so it works offline.
|
|
73
|
+
- **Hot reload.** `add-peer`, `block` or a hand edit of `server.yaml` applies within 2 seconds without dropping sessions.
|
|
74
|
+
- **Safety checks.** The server warns if Ollama is also reachable outside the tunnel or if the config file is world-readable. Configs are written with mode 0600.
|
|
75
|
+
- **Go library.** You can embed the server, or call Ollama from Go code through the tunnel without opening a local port.
|
|
76
|
+
|
|
77
|
+
## Documentation
|
|
78
|
+
|
|
79
|
+
| Guide | What's in it |
|
|
80
|
+
|---|---|
|
|
81
|
+
| [Getting started](docs/getting-started.md) | Install, set up a server, add devices, connect |
|
|
82
|
+
| [Configuration](docs/configuration.md) | Every field in `server.yaml` and client configs, roles, model rules |
|
|
83
|
+
| [Dashboard and admin API](docs/dashboard.md) | The UI, the HTTP API behind it, Prometheus metrics |
|
|
84
|
+
| [Security model](docs/security.md) | What is protected, how, and what is not |
|
|
85
|
+
| [Running as a service](docs/deploy.md) | systemd, launchd, Windows, Docker, port forwarding |
|
|
86
|
+
| [Go library](docs/library.md) | Embedding the server and client in your own programs |
|
|
87
|
+
|
|
88
|
+
## Commands
|
|
89
|
+
|
|
90
|
+
```
|
|
91
|
+
Server Client
|
|
92
|
+
init create server.yaml connect tunnel + local Ollama port
|
|
93
|
+
add-peer register a device status check handshake and policy
|
|
94
|
+
remove-peer delete a device
|
|
95
|
+
list-peers show devices and rules Other
|
|
96
|
+
block block --device / --ip keygen print a key pair
|
|
97
|
+
unblock undo a block version
|
|
98
|
+
serve run tunnel, proxy, dashboard
|
|
99
|
+
```
|
|
100
|
+
|
|
101
|
+
## Building from source
|
|
102
|
+
|
|
103
|
+
```sh
|
|
104
|
+
git clone https://github.com/himanshu-mamgain/ollamawg && cd ollamawg
|
|
105
|
+
go mod tidy # first time only: records dependency checksums in go.sum
|
|
106
|
+
go test -race ./...
|
|
107
|
+
go build -o ollamawg ./cmd/ollamawg
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
Go 1.24 or newer is required. Cross-compiling works out of the box, for example `GOOS=windows GOARCH=amd64 go build ./cmd/ollamawg`.
|
|
111
|
+
|
|
112
|
+
## License
|
|
113
|
+
|
|
114
|
+
[MIT](LICENSE)
|
package/bin/ollamawg.js
ADDED
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
// Runs the prebuilt ollamawg binary from the platform package npm installed
|
|
3
|
+
// alongside this one (see optionalDependencies).
|
|
4
|
+
"use strict";
|
|
5
|
+
|
|
6
|
+
const { spawnSync } = require("child_process");
|
|
7
|
+
const path = require("path");
|
|
8
|
+
|
|
9
|
+
const pkg = `@ollamawg/${process.platform}-${process.arch}`;
|
|
10
|
+
const exe = process.platform === "win32" ? "ollamawg.exe" : "ollamawg";
|
|
11
|
+
|
|
12
|
+
let bin;
|
|
13
|
+
try {
|
|
14
|
+
bin = require.resolve(`${pkg}/bin/${exe}`);
|
|
15
|
+
} catch {
|
|
16
|
+
console.error(
|
|
17
|
+
`ollamawg: no prebuilt binary for ${process.platform}-${process.arch}.\n` +
|
|
18
|
+
`Expected the optional package ${pkg} to be installed. If you installed with\n` +
|
|
19
|
+
`--no-optional or --omit=optional, reinstall without it. Otherwise build from source:\n` +
|
|
20
|
+
` go install github.com/himanshu-mamgain/ollamawg/cmd/ollamawg@latest`
|
|
21
|
+
);
|
|
22
|
+
process.exit(1);
|
|
23
|
+
}
|
|
24
|
+
|
|
25
|
+
const result = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
|
|
26
|
+
if (result.error) {
|
|
27
|
+
console.error(`ollamawg: failed to run ${path.basename(bin)}: ${result.error.message}`);
|
|
28
|
+
process.exit(1);
|
|
29
|
+
}
|
|
30
|
+
if (result.signal) {
|
|
31
|
+
process.kill(process.pid, result.signal);
|
|
32
|
+
}
|
|
33
|
+
process.exit(result.status ?? 1);
|
package/package.json
CHANGED
|
@@ -1,6 +1,38 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ollamawg/cli",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"
|
|
5
|
-
"
|
|
6
|
-
|
|
3
|
+
"version": "0.1.0",
|
|
4
|
+
"description": "Reach your Ollama server from anywhere through a user-space WireGuard tunnel, with per-device access control and a dashboard.",
|
|
5
|
+
"keywords": [
|
|
6
|
+
"ollama",
|
|
7
|
+
"wireguard",
|
|
8
|
+
"tunnel",
|
|
9
|
+
"llm",
|
|
10
|
+
"proxy",
|
|
11
|
+
"vpn"
|
|
12
|
+
],
|
|
13
|
+
"homepage": "https://github.com/himanshu-mamgain/ollamawg#readme",
|
|
14
|
+
"bugs": "https://github.com/himanshu-mamgain/ollamawg/issues",
|
|
15
|
+
"repository": {
|
|
16
|
+
"type": "git",
|
|
17
|
+
"url": "git+https://github.com/himanshu-mamgain/ollamawg.git"
|
|
18
|
+
},
|
|
19
|
+
"license": "MIT",
|
|
20
|
+
"author": "Himanshu Mamgain",
|
|
21
|
+
"bin": {
|
|
22
|
+
"ollamawg": "bin/ollamawg.js"
|
|
23
|
+
},
|
|
24
|
+
"files": [
|
|
25
|
+
"bin"
|
|
26
|
+
],
|
|
27
|
+
"engines": {
|
|
28
|
+
"node": ">=16"
|
|
29
|
+
},
|
|
30
|
+
"optionalDependencies": {
|
|
31
|
+
"@ollamawg/darwin-arm64": "0.1.0",
|
|
32
|
+
"@ollamawg/darwin-x64": "0.1.0",
|
|
33
|
+
"@ollamawg/freebsd-x64": "0.1.0",
|
|
34
|
+
"@ollamawg/linux-arm64": "0.1.0",
|
|
35
|
+
"@ollamawg/linux-x64": "0.1.0",
|
|
36
|
+
"@ollamawg/win32-x64": "0.1.0"
|
|
37
|
+
}
|
|
38
|
+
}
|