@ollamawg/cli 0.2.2 → 0.4.0

package/README.md

@@ -6,7 +6,7 @@ Reach your Ollama server from your laptop and phone without exposing it to the i
 
 It is a single Go binary. WireGuard runs in user space through [wireguard-go](https://git.zx2c4.com/wireguard-go) and gVisor's network stack, so the server needs no root, no kernel module and no TUN device. Computers connect with `ollamawg connect`, which needs no admin rights either. Phones use the official WireGuard app, because the keys and protocol are standard WireGuard.
 
-![Dashboard](https://raw.githubusercontent.com/himanshu-mamgain/ollamawg/v0.2.2/docs/images/dashboard.png)
+![Dashboard](https://raw.githubusercontent.com/himanshu-mamgain/ollamawg/v0.4.0/docs/images/dashboard.png)
 
 <sub>Screenshot taken with simulated devices and traffic.</sub>
 
@@ -43,7 +43,7 @@ Ollama itself stays on `127.0.0.1`. Nothing outside the tunnel can talk to it.
   - ask your ISP for a public IP;
   - or relay through a small VPS.
 
-  See [Troubleshooting](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/getting-started.md#troubleshooting).
+  See [Troubleshooting](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/getting-started.md#troubleshooting).
 
 ## Install
 
@@ -53,7 +53,7 @@ npx @ollamawg/cli version           # or run it without installing
 go install github.com/himanshu-mamgain/ollamawg/cmd/ollamawg@latest
 ```
 
-Standalone binaries are attached to every [GitHub Release](https://github.com/himanshu-mamgain/ollamawg/releases). A `Dockerfile` is included; see [Running as a service](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/deploy.md#docker).
+Standalone binaries are attached to every [GitHub Release](https://github.com/himanshu-mamgain/ollamawg/releases). A `Dockerfile` is included; see [Running as a service](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/deploy.md#docker).
 
 ## Quickstart
 
@@ -95,11 +95,43 @@ You can also use **Add device** in the dashboard, then **Phone**.
 
 Ollama apps such as Enchanted or Reins work too: point them at `http://10.77.0.1:11434`.
 
-<img src="https://raw.githubusercontent.com/himanshu-mamgain/ollamawg/v0.2.2/docs/images/chat.png" alt="The chat page on a phone" width="300">
+**Missed the QR code, lost a config, or got a new phone?** The server never stores device private keys, so a config can't be shown twice. Issue a new one instead: `ollamawg reissue --name phone --qr`, or **New config** on the device in the dashboard. The device keeps its name, address and policy, and the old config stops working.
+
+<img src="https://raw.githubusercontent.com/himanshu-mamgain/ollamawg/v0.4.0/docs/images/chat.png" alt="The chat page on a phone" width="300">
 
 <sub>Chat page on a phone, with a simulated model reply.</sub>
 
-See [Getting started](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/getting-started.md) for the full walkthrough.
+See [Getting started](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/getting-started.md) for the full walkthrough.
+
+## Dashboard login
+
+The dashboard runs on the server at `http://127.0.0.1:8088`. The browser asks for a username and password.
+
+**Username and password.** `init` creates the user `admin` with a random password, which it prints and saves in `server.yaml` under `admin.password`. To choose your own:
+
+```sh
+ollamawg passwd                    # asks for a new password twice
+ollamawg passwd --user himanshu    # also change the username
+ollamawg init --endpoint ... --user himanshu --set-password    # or choose both at setup
+```
+
+Passwords you choose are stored as a bcrypt hash (`admin.password_hash`), never in plain text. A running server picks up the change within 2 seconds.
+
+**Two-factor login (2FA).** This adds a 6-digit code from an authenticator app, such as Google Authenticator, Authy, 1Password or Microsoft Authenticator.
+
+```sh
+ollamawg 2fa enable     # shows a QR code: scan it, then type the code to confirm
+ollamawg 2fa status
+ollamawg 2fa disable    # also the way back in if you lose your phone
+```
+
+You can also turn it on from the **2FA** button in the dashboard.
+
+With 2FA on:
+- The dashboard opens on a login form that asks for the username, password and code.
+- Scripts and Prometheus use the API token (`admin.api_token`) as `Authorization: Bearer <token>`.
+
+See [Dashboard and admin API](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/dashboard.md).
 
 ## Features
 
@@ -134,11 +166,13 @@ See [Getting started](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/d
 Server
   init         create server.yaml with keys and a dashboard password
   add-peer     register a device; --qr prints a QR code for the WireGuard app
+  reissue      new key and config (or --qr) for an existing device
   remove-peer  delete a device
   list-peers   show devices and rules
   block        block --device or --ip
   unblock      undo a block
   serve        run the tunnel, proxy, chat page and dashboard
+  passwd       set your own dashboard username and password
   2fa          enable, disable or check two-factor dashboard login
 
 Client
@@ -156,19 +190,19 @@ Run `ollamawg <command> -h` for a command's flags.
 
 | Guide | What's in it |
 |---|---|
-| [Getting started](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/getting-started.md) | Install, set up a server, add laptops and phones, connect |
-| [Configuration](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/configuration.md) | Every field in `server.yaml` and client configs, roles, model rules |
-| [Dashboard and admin API](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/dashboard.md) | The UI, two-factor login, the HTTP API behind it, Prometheus metrics |
-| [Security model](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/security.md) | What is protected, how, and what is not |
-| [Running as a service](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/deploy.md) | systemd, launchd, Windows, Docker, port forwarding |
-| [Go library](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/library.md) | Embedding the server and client in your own programs |
+| [Getting started](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/getting-started.md) | Install, set up a server, add laptops and phones, connect |
+| [Configuration](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/configuration.md) | Every field in `server.yaml` and client configs, roles, model rules |
+| [Dashboard and admin API](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/dashboard.md) | The UI, two-factor login, the HTTP API behind it, Prometheus metrics |
+| [Security model](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/security.md) | What is protected, how, and what is not |
+| [Running as a service](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/deploy.md) | systemd, launchd, Windows, Docker, port forwarding |
+| [Go library](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/library.md) | Embedding the server and client in your own programs |
 
 ## Limitations
 
 - **Devices need to reach one UDP port on the server.** There is no relay or NAT traversal. CGNAT connections need one of the workarounds in [Requirements](#requirements).
 - **The dashboard has one admin account.** Put a reverse proxy with SSO in front if several people manage it.
 - **Chat history lives in each device's browser.** It is not synced between devices or stored on the server.
-- **No independent security audit yet.** The cryptography comes from wireguard-go and gVisor. The policy layer is small and covered by end-to-end tests. See the [Security model](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/docs/security.md).
+- **No independent security audit yet.** The cryptography comes from wireguard-go and gVisor. The policy layer is small and covered by end-to-end tests. See the [Security model](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/docs/security.md).
 
 ## Building from source
 
@@ -182,7 +216,7 @@ Go 1.24 or newer is required. Cross-compiling works out of the box, for example
 
 ## Releasing
 
-Releases are cut from `main` by [`.github/workflows/publish.yml`](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/.github/workflows/publish.yml):
+Releases are cut from `main` by [`.github/workflows/publish.yml`](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/.github/workflows/publish.yml):
 
 1. In a PR, bump `version` (and its `optionalDependencies`) in `npm/cli/package.json` and `Version` in `server.go`. A test fails if they differ.
 2. Merge the PR. The workflow publishes every npm package that's missing that version, using trusted publishing with provenance, then creates the GitHub Release with binaries.
@@ -191,4 +225,4 @@ A re-run finishes a release that stopped halfway.
 
 ## License
 
-[MIT](https://github.com/himanshu-mamgain/ollamawg/blob/v0.2.2/LICENSE)
+[MIT](https://github.com/himanshu-mamgain/ollamawg/blob/v0.4.0/LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ollamawg/cli",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "description": "Reach your Ollama server from anywhere through a user-space WireGuard tunnel, with per-device access control and a dashboard.",
   "keywords": [
     "ollama",
@@ -28,11 +28,11 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@ollamawg/darwin-arm64": "0.2.2",
-    "@ollamawg/darwin-x64": "0.2.2",
-    "@ollamawg/freebsd-x64": "0.2.2",
-    "@ollamawg/linux-arm64": "0.2.2",
-    "@ollamawg/linux-x64": "0.2.2",
-    "@ollamawg/win32-x64": "0.2.2"
+    "@ollamawg/darwin-arm64": "0.4.0",
+    "@ollamawg/darwin-x64": "0.4.0",
+    "@ollamawg/freebsd-x64": "0.4.0",
+    "@ollamawg/linux-arm64": "0.4.0",
+    "@ollamawg/linux-x64": "0.4.0",
+    "@ollamawg/win32-x64": "0.4.0"
   }
 }