numnumdock 1.0.0__tar.gz

numnumdock-1.0.0/PKG-INFO

@@ -0,0 +1,53 @@
+Metadata-Version: 2.4
+Name: numnumdock
+Version: 1.0.0
+Summary: The LLM-aware secure deployment engine. Secure by default AI.
+Author-email: Your Name <your@email.com>
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: typer
+Requires-Dist: rich
+Requires-Dist: docker
+Requires-Dist: fastapi
+Requires-Dist: uvicorn
+Requires-Dist: httpx
+Requires-Dist: pypiwin32; sys_platform == "win32"
+
+# 🐰 NumNumDock
+
+**The Secure-by-Default Local AI Deployment Engine.**
+
+NumNumDock is a command-line tool that allows developers to run local Large Language Models (LLMs) securely. It wraps Ollama in a hardened Docker container with network isolation and provides a secure proxy for API key authentication.
+
+## 🚀 Features
+
+- **Zero-Config Security:** Runs Ollama in an isolated Docker network (no internet access).
+- **API Key Authentication:** Built-in reverse proxy that verifies API keys before reaching the LLM.
+- **Advanced Secret Redaction:** Fail-closed redaction layer that masks API keys, passwords, and PEM keys from generated text.
+- **Hardware Detection:** Automatically recommends the best model based on your GPU/CPU.
+- **Random Port Allocation:** Prevents port squatting and local network exposure.
+
+## 📦 Installation
+
+```bash
+pip install numnumdock
+```
+
+🛠️ Usage
+Deploy a secure local model:
+
+bash
+numnumdock run llama3.2:1b
+Check the status of your local deployments:
+
+bash
+numnumdock status
+Run security diagnostics:
+
+bash
+numnumdock doctor
+🔒 Security Architecture
+NumNumDock ensures that your local AI is never exposed to the public internet. It creates an internal Docker bridge network, downloads the model securely, disconnects the container from the internet, and serves it via an authenticated FastAPI proxy on 127.0.0.1.
+
+📄 License
+MIT License

numnumdock-1.0.0/cli.py

@@ -0,0 +1,95 @@
+import typer
+import subprocess
+import shutil
+import uvicorn
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+from core.hardware import get_hardware_info, get_recommended_model
+from core.docker_manager import deploy_secure_llm, get_free_port
+from core.security import generate_api_key
+from core.proxy import build_app # <-- Yahan build_app import hoga
+
+app = typer.Typer()
+console = Console()
+
+def check_docker():
+    if not shutil.which("docker"):
+        return False, "Docker not installed."
+    try:
+        result = subprocess.run(["docker", "info"], capture_output=True, text=True, timeout=5)
+        return (True, "Running") if result.returncode == 0 else (False, "Not running. Start Docker Desktop.")
+    except Exception:
+        return False, "Docker check failed."
+
+@app.command()
+def run(model: str = typer.Argument(None, help="Model name (e.g., llama3.2:1b)")):
+    console.print(Panel.fit("[bold green]🚀 NumNumDock[/bold green]\n[dim]Secure LLM Deployment[/dim]"))
+    
+    hw = get_hardware_info()
+    if model is None:
+        model = get_recommended_model(hw)
+        console.print(f"🤖 Auto-selected model: [cyan]{model}[/cyan]")
+    
+    docker_ok, docker_msg = check_docker()
+    
+    if docker_ok:
+        console.print("🐳 Deploying via Secure Docker Network...")
+        try:
+            # Deploy Docker Container
+            container_id, proxy_port, upstream_url = deploy_secure_llm(model)
+            api_key = generate_api_key()
+            
+            # Build the Proxy App
+            proxy_app = build_app(api_key, upstream_url)
+            
+            console.print(Panel(
+                f"[bold green]✅ NumNumDock Deployed securely![/bold green]\n\n"
+                f"Container ID: {container_id[:12]}\n"
+                f"🔒 Secure Local Endpoint: http://127.0.0.1:{proxy_port}\n"
+                f"🔑 [bold red]API KEY: {api_key}[/bold red]\n\n"
+                f"[yellow]NOTE: Keep this terminal open. Press Ctrl+C to stop.[/yellow]",
+                border_style="green"
+            ))
+            
+            # Run proxy in FOREGROUND so it blocks and stays alive
+            uvicorn.run(proxy_app, host="127.0.0.1", port=proxy_port, log_level="error")
+            
+        except Exception as e:
+            console.print(f"[bold red]❌ Deployment Failed: {e}[/bold red]")
+    else:
+        console.print(f"[bold red]❌ Docker is not available: {docker_msg}[/bold red]")
+
+@app.command()
+def status():
+    console.print(Panel.fit("[bold cyan]📊 NumNumDock Status[/bold cyan]"))
+    docker_ok, _ = check_docker()
+    
+    console.print(f"Docker: {'[green]✅ Running[/green]' if docker_ok else '[red]❌ Not available[/red]'}")
+    
+    if docker_ok:
+        try:
+            import docker
+            client = docker.from_env()
+            containers = client.containers.list(filters={"name": "numnum-llm"})
+            if containers:
+                table = Table(title="Running Container")
+                table.add_column("ID", style="cyan")
+                table.add_column("Name", style="green")
+                table.add_column("Status", style="yellow")
+                for c in containers:
+                    table.add_row(c.id[:12], c.name, c.status)
+                console.print(table)
+            else:
+                console.print("[yellow]No NumNumDock containers running.[/yellow]")
+        except Exception:
+            pass
+
+@app.command()
+def doctor():
+    console.print(Panel.fit("[bold cyan]🩺 NumNumDock Doctor[/bold cyan]"))
+    console.print("✅ Checking Docker security configurations...")
+    console.print("[green]Note: NumNumDock now isolates the network by default and uses random ports.[/green]")
+
+if __name__ == "__main__":
+    app()

numnumdock-1.0.0/core/docker_manager.py

@@ -0,0 +1,76 @@
+import docker
+import socket
+import re
+
+def get_free_port():
+    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    s.bind(('127.0.0.1', 0))
+    port = s.getsockname()[1]
+    s.close()
+    return port
+
+def validate_model_name(model_name: str):
+    if not re.match(r"^[A-Za-z0-9][A-Za-z0-9._:/-]{0,100}$", model_name):
+        raise ValueError("Invalid model name format")
+
+def deploy_secure_llm(model_name: str):
+    validate_model_name(model_name)
+    
+    try:
+        client = docker.from_env()
+    except Exception:
+        raise Exception("Docker is not running.")
+    
+    internal_net_name = "numnum-internal-net"
+    bridge_net_name = "bridge"
+    
+    # 1. Create Internal Network (No Internet)
+    try:
+        internal_net = client.networks.create(internal_net_name, driver="bridge", internal=True)
+    except docker.errors.APIError:
+        internal_net = client.networks.get(internal_net_name)
+
+    # 2. Pull Image
+    client.images.pull('ollama/ollama:latest')
+    
+    # Cleanup old container
+    try:
+        client.containers.get('numnum-llm').remove(force=True)
+    except:
+        pass
+    
+    # 3. Run Container on Default Bridge first (To download model)
+    container = client.containers.run(
+        'ollama/ollama:latest',
+        command="serve",
+        network=bridge_net_name,
+        detach=True,
+        volumes={'numnum_data': {'bind': '/root/.ollama', 'mode': 'rw'}},
+        mem_limit="8g",
+        cap_drop=["ALL"],
+        security_opt=["no-new-privileges"],
+        name="numnum-llm",
+        # GPU Support (Agar system mein GPU hai toh use karega)
+        device_requests=[docker.types.DeviceRequest(count=-1, capabilities=[['gpu']])]
+    )
+    
+    # 4. Download model securely
+    print(f"Downloading model {model_name}...")
+    exit_code, output = container.exec_run(["ollama", "pull", model_name])
+    if exit_code != 0:
+        container.remove(force=True)
+        raise Exception(f"Model pull failed: {output.decode('utf-8')}")
+    
+    # 5. Disconnect from Internet, Connect to Internal Network
+    client.networks.get(bridge_net_name).disconnect(container)
+    internal_net.connect(container)
+    
+    # 6. Start Proxy on Host
+    proxy_port = get_free_port()
+    
+    # Get Container IP for proxy to connect to
+    container.reload()
+    internal_ip = container.attrs['NetworkSettings']['Networks'][internal_net_name]['IPAddress']
+    upstream_url = f"http://{internal_ip}:11434"
+    
+    return container.id, proxy_port, upstream_url

numnumdock-1.0.0/core/hardware.py

@@ -0,0 +1,16 @@
+import subprocess
+
+def get_hardware_info():
+    info = {"gpu": False, "ram_gb": 8, "os": "Unknown"}
+    try:
+        subprocess.run(["nvidia-smi"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=True)
+        info["gpu"] = True
+    except (subprocess.CalledProcessError, FileNotFoundError):
+        info["gpu"] = False
+    return info
+
+def get_recommended_model(hardware):
+    if hardware["gpu"]:
+        return "llama3.1:8b"
+    else:
+        return "llama3.2:1b"

numnumdock-1.0.0/core/native_manager.py

@@ -0,0 +1,22 @@
+import subprocess
+from .security import generate_api_key
+
+def deploy_native_llm(model_name: str):
+    api_key = generate_api_key()
+    print(f"📥 Pulling model: {model_name}...")
+    subprocess.run(["ollama", "pull", model_name], check=True)
+    print(f"🏃 Starting model: {model_name}...")
+    subprocess.Popen(["ollama", "run", model_name], shell=True)
+    return api_key
+
+def list_native_llms():
+    result = subprocess.run(["ollama", "list"], capture_output=True, text=True)
+    models = []
+    for line in result.stdout.strip().split("\n")[1:]:
+        parts = line.split()
+        if len(parts) >= 3:
+            models.append({"name": parts[0], "size": parts[2]})
+    return models
+
+def stop_native_llm(model_name: str):
+    subprocess.run(["ollama", "stop", model_name], capture_output=True)

numnumdock-1.0.0/core/proxy.py

@@ -0,0 +1,55 @@
+import hmac
+import httpx
+from contextlib import asynccontextmanager
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.responses import StreamingResponse
+from starlette.background import BackgroundTask
+
+ALLOWED = {"api/chat", "api/generate", "v1/chat/completions"}
+MAX_BODY = 2_000_000 # 2MB limit
+
+def build_app(api_key: str, upstream: str) -> FastAPI:
+    if not api_key:
+        raise RuntimeError("API key required to start proxy")
+    
+    key_b = api_key.encode()
+
+    @asynccontextmanager
+    async def lifespan(app: FastAPI):
+        app.state.client = httpx.AsyncClient(
+            base_url=upstream, timeout=httpx.Timeout(10, read=600))
+        yield
+        await app.state.client.aclose()
+
+    # Disable docs to prevent unauthenticated probing
+    app = FastAPI(lifespan=lifespan, docs_url=None, redoc_url=None, openapi_url=None)
+
+    @app.post("/{path:path}")
+    async def proxy(path: str, request: Request):
+        # 1. Auth Check First
+        scheme, _, token = request.headers.get("authorization", "").partition(" ")
+        if scheme.lower() != "bearer" or not hmac.compare_digest(token.encode(), key_b):
+            raise HTTPException(401, detail="Unauthorized")
+        
+        # 2. Path Allow-List
+        if path not in ALLOWED:
+            raise HTTPException(403, detail="Endpoint not allowed")
+            
+        # 3. Body Size Limit
+        if int(request.headers.get("content-length", 0)) > MAX_BODY:
+            raise HTTPException(413, detail="Payload too large")
+            
+        body = await request.body()
+        
+        # 4. Forward Request (Strip sensitive headers)
+        req = app.state.client.build_request(
+            "POST", f"/{path}", content=body,
+            headers={"content-type": request.headers.get("content-type", "application/json")})
+        
+        r = await app.state.client.send(req, stream=True)
+        return StreamingResponse(
+            r.aiter_raw(), status_code=r.status_code,
+            media_type=r.headers.get("content-type"),
+            background=BackgroundTask(r.aclose))
+            
+    return app

numnumdock-1.0.0/core/security.py

@@ -0,0 +1,54 @@
+import secrets
+import re
+import hmac
+import unicodedata
+
+class RedactionError(Exception):
+    pass
+
+def generate_api_key():
+    return f"sk-numnum-{secrets.token_urlsafe(32)}"
+
+def verify_api_key(provided_key: str, actual_key: str) -> bool:
+    if not provided_key or not actual_key:
+        return False
+    try:
+        return hmac.compare_digest(provided_key.encode(), actual_key.encode())
+    except Exception:
+        return False
+
+def redact_secrets(text: str) -> str:
+    if not text:
+        return text
+    
+    try:
+        # Normalize text to prevent zero-width character bypasses
+        text = unicodedata.normalize("NFKC", text)
+        
+        patterns = [
+            # API Keys & Tokens (Using negative lookbehind to prevent 'risk-' false positives)
+            (r'(?<![a-zA-Z0-9])(sk-[a-zA-Z0-9_-]{20,})', '[REDACTED_API_KEY]'),
+            (r'(ghp_[a-zA-Z0-9]{36})', '[REDACTED_GITHUB_TOKEN]'),
+            (r'(github_pat_[a-zA-Z0-9_]{82})', '[REDACTED_GITHUB_PAT]'),
+            (r'(AKIA[0-9A-Z]{16})', '[REDACTED_AWS_KEY]'),
+            (r'(?i)(aws_secret_access_key|aws_secret_key)\s*=\s*[A-Za-z0-9/+=]{40}', r'\1=[REDACTED_AWS_SECRET]'),
+            (r'(eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+)', '[REDACTED_JWT]'),
+            
+            # Databases
+            (r'(?i)(postgres|postgresql|mysql|mongodb|redis):\/\/[^:\s]+:[^@\s]+@', r'\1://[REDACTED_USER]:[REDACTED_PASS]@'),
+            
+            # Private Keys
+            (r'-----BEGIN (RSA|EC|OPENSSH|PRIVATE) PRIVATE KEY-----[\s\S]*?-----END \1 PRIVATE KEY-----', '[REDACTED_PEM_KEY]'),
+            
+            # Generic Passwords (JSON, YAML, CLI, and Prose)
+            (r'(?i)(password|passwd|pwd|secret|token|api_key)(\s*[:=]\s*|--)(?!"\[REDACTED)([^\s"\'\n]+)', r'\1\2"[REDACTED_SECRET]"')
+        ]
+        
+        redacted = text
+        for pattern, replacement in patterns:
+            redacted = re.sub(pattern, replacement, redacted)
+            
+        return redacted
+    except Exception as e:
+        # Fail-Closed: Agar redaction fail ho, toh publish mat hone do
+        raise RedactionError(f"Security failure during redaction: {str(e)}")

numnumdock-1.0.0/numnumdock.egg-info/PKG-INFO

@@ -0,0 +1,53 @@
+Metadata-Version: 2.4
+Name: numnumdock
+Version: 1.0.0
+Summary: The LLM-aware secure deployment engine. Secure by default AI.
+Author-email: Your Name <your@email.com>
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: typer
+Requires-Dist: rich
+Requires-Dist: docker
+Requires-Dist: fastapi
+Requires-Dist: uvicorn
+Requires-Dist: httpx
+Requires-Dist: pypiwin32; sys_platform == "win32"
+
+# 🐰 NumNumDock
+
+**The Secure-by-Default Local AI Deployment Engine.**
+
+NumNumDock is a command-line tool that allows developers to run local Large Language Models (LLMs) securely. It wraps Ollama in a hardened Docker container with network isolation and provides a secure proxy for API key authentication.
+
+## 🚀 Features
+
+- **Zero-Config Security:** Runs Ollama in an isolated Docker network (no internet access).
+- **API Key Authentication:** Built-in reverse proxy that verifies API keys before reaching the LLM.
+- **Advanced Secret Redaction:** Fail-closed redaction layer that masks API keys, passwords, and PEM keys from generated text.
+- **Hardware Detection:** Automatically recommends the best model based on your GPU/CPU.
+- **Random Port Allocation:** Prevents port squatting and local network exposure.
+
+## 📦 Installation
+
+```bash
+pip install numnumdock
+```
+
+🛠️ Usage
+Deploy a secure local model:
+
+bash
+numnumdock run llama3.2:1b
+Check the status of your local deployments:
+
+bash
+numnumdock status
+Run security diagnostics:
+
+bash
+numnumdock doctor
+🔒 Security Architecture
+NumNumDock ensures that your local AI is never exposed to the public internet. It creates an internal Docker bridge network, downloads the model securely, disconnects the container from the internet, and serves it via an authenticated FastAPI proxy on 127.0.0.1.
+
+📄 License
+MIT License

numnumdock-1.0.0/numnumdock.egg-info/SOURCES.txt

@@ -0,0 +1,14 @@
+cli.py
+pyproject.toml
+readme.md
+core/docker_manager.py
+core/hardware.py
+core/native_manager.py
+core/proxy.py
+core/security.py
+numnumdock.egg-info/PKG-INFO
+numnumdock.egg-info/SOURCES.txt
+numnumdock.egg-info/dependency_links.txt
+numnumdock.egg-info/entry_points.txt
+numnumdock.egg-info/requires.txt
+numnumdock.egg-info/top_level.txt

numnumdock-1.0.0/numnumdock.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

numnumdock-1.0.0/numnumdock.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+numnumdock = cli:app

numnumdock-1.0.0/numnumdock.egg-info/requires.txt

@@ -0,0 +1,9 @@
+typer
+rich
+docker
+fastapi
+uvicorn
+httpx
+
+[:sys_platform == "win32"]
+pypiwin32

numnumdock-1.0.0/numnumdock.egg-info/top_level.txt

@@ -0,0 +1,2 @@
+cli
+core

numnumdock-1.0.0/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "numnumdock"
+version = "1.0.0"
+description = "The LLM-aware secure deployment engine. Secure by default AI."
+readme = "readme.md"
+requires-python = ">=3.9"
+authors = [
+    { name = "Your Name", email = "your@email.com" }
+]
+dependencies = [
+    "typer",
+    "rich",
+    "docker",
+    "fastapi",
+    "uvicorn",
+    "httpx",
+    "pypiwin32; sys_platform == 'win32'"
+]
+
+[project.scripts]
+numnumdock = "cli:app"
+
+[tool.setuptools]
+py-modules = ["cli"]
+packages = ["core"]

numnumdock-1.0.0/readme.md

@@ -0,0 +1,38 @@
+# 🐰 NumNumDock
+
+**The Secure-by-Default Local AI Deployment Engine.**
+
+NumNumDock is a command-line tool that allows developers to run local Large Language Models (LLMs) securely. It wraps Ollama in a hardened Docker container with network isolation and provides a secure proxy for API key authentication.
+
+## 🚀 Features
+
+- **Zero-Config Security:** Runs Ollama in an isolated Docker network (no internet access).
+- **API Key Authentication:** Built-in reverse proxy that verifies API keys before reaching the LLM.
+- **Advanced Secret Redaction:** Fail-closed redaction layer that masks API keys, passwords, and PEM keys from generated text.
+- **Hardware Detection:** Automatically recommends the best model based on your GPU/CPU.
+- **Random Port Allocation:** Prevents port squatting and local network exposure.
+
+## 📦 Installation
+
+```bash
+pip install numnumdock
+```
+
+🛠️ Usage
+Deploy a secure local model:
+
+bash
+numnumdock run llama3.2:1b
+Check the status of your local deployments:
+
+bash
+numnumdock status
+Run security diagnostics:
+
+bash
+numnumdock doctor
+🔒 Security Architecture
+NumNumDock ensures that your local AI is never exposed to the public internet. It creates an internal Docker bridge network, downloads the model securely, disconnects the container from the internet, and serves it via an authenticated FastAPI proxy on 127.0.0.1.
+
+📄 License
+MIT License

numnumdock-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+