Add restricted AI worker access with deployment capabilities #1

Hermes · 2026-04-28T15:49:33Z

Hermes commented

2026-04-28 15:49:33 +00:00

Summary

This PR adds restricted SSH access for the AI worker (hermes-agent) to run ollama benchmarks on the host via docker commands.

Security Model

The ai-worker user now has:

Filesystem Access

Home directory: /home/ai-worker (standard user home)
NO bind mount: Cannot access /home/gortium/infra or other host files
Cannot access: Any files outside standard system paths

Sudo Access

NONE: ai-worker has no sudo privileges
Cannot run nh, nixos-rebuild, nixpkgs-fmt, or nix

Docker Access

Member of docker group - can run docker and docker exec commands
Primary use: docker exec ollama ollama ... for benchmarking
Can run docker exec --privileged ollama rocm-smi ... for VRAM monitoring

Workflow: SSH + Docker Benchmarking

Hermes container (cron triggers)
    --> SSH (as ai-worker)
Host (ai-worker user)
    --> docker exec ollama ... (run benchmarks)
Host (ollama container runs tests)
    --> SSH session ends
Hermes container
    --> save results in skill state

Changes

modules/nixos/security/ai-worker-restricted.nix - New module: creates ai-worker user with docker group, no sudo
modules/nixos/security/README-ai-worker.md - Documentation for docker-only workflow
users/ai-worker.nix - User definition for ai-worker
flake.nix - Imports the security module

Testing

After merge, verify with:

# Check ai-worker has no sudo access
sudo -u ai-worker sudo -l

# Check docker group membership
groups ai-worker

# Test docker access
sudo -u ai-worker docker exec ollama ollama list

Known Issues

SSH key access from Hermes container (see issue #32): The ai-worker SSH private key is encrypted via age with recipients that aren't available in the Hermes container. Need to add the Hermes Gitea SSH key as a recipient in secrets.nix to allow decryption from the container.

Issue: #26 (Merge Plan)

## Summary This PR adds restricted SSH access for the AI worker (hermes-agent) to run ollama benchmarks on the host via docker commands. ## Security Model The `ai-worker` user now has: ### Filesystem Access - **Home directory**: `/home/ai-worker` (standard user home) - **NO bind mount**: Cannot access `/home/gortium/infra` or other host files - **Cannot access**: Any files outside standard system paths ### Sudo Access - **NONE**: ai-worker has no sudo privileges - Cannot run `nh`, `nixos-rebuild`, `nixpkgs-fmt`, or `nix` ### Docker Access - Member of `docker` group - can run `docker` and `docker exec` commands - Primary use: `docker exec ollama ollama ...` for benchmarking - Can run `docker exec --privileged ollama rocm-smi ...` for VRAM monitoring ## Workflow: SSH + Docker Benchmarking ``` Hermes container (cron triggers) --> SSH (as ai-worker) Host (ai-worker user) --> docker exec ollama ... (run benchmarks) Host (ollama container runs tests) --> SSH session ends Hermes container --> save results in skill state ``` ## Changes - `modules/nixos/security/ai-worker-restricted.nix` - New module: creates ai-worker user with docker group, no sudo - `modules/nixos/security/README-ai-worker.md` - Documentation for docker-only workflow - `users/ai-worker.nix` - User definition for ai-worker - `flake.nix` - Imports the security module ## Testing After merge, verify with: ```bash # Check ai-worker has no sudo access sudo -u ai-worker sudo -l # Check docker group membership groups ai-worker # Test docker access sudo -u ai-worker docker exec ollama ollama list ``` ## Known Issues - **SSH key access from Hermes container** (see issue #32): The ai-worker SSH private key is encrypted via age with recipients that aren't available in the Hermes container. Need to add the Hermes Gitea SSH key as a recipient in `secrets.nix` to allow decryption from the container. ## Related - Issue: https://code.lazyworkhorse.net/gortium/infra/issues/26 (Merge Plan)

Hermes added 1 commit 2026-04-28 15:49:35 +00:00

Add restricted AI worker access with deployment capabilities 18df45819d

- New module: modules/nixos/security/ai-worker-restricted.nix
  - Bind mount for infra repo access (RW)
  - Whitelisted sudo commands: nh, nixos-rebuild, nixpkgs-fmt, nix
  - Audit logging for infra changes
  - Documentation in README-ai-worker.md

- Updated users/ai-worker.nix:
  - Enable services.aiWorkerAccess
  - Lock password (SSH key only)
  - Security documentation comments

- Updated flake.nix:
  - Include new security module

SECURITY: AI must ask for user confirmation before running nh os switch

Hermes added 1 commit 2026-04-29 19:55:37 +00:00

fix: ai-worker docker-only access for ollama benchmarking f0e21d95e4

Remove infra repo bind mount and sudo access from ai-worker user.
Now ai-worker can only:
- SSH into host from Hermes container
- Run docker commands via docker group membership
- Execute ollama benchmarks via docker exec

Results saved to /opt/data/ai-optimizer/ in Hermes container.

gortium self-assigned this 2026-04-29 23:43:38 +00:00

~~Hermes referenced this pull request 2026-04-30 16:04:13 +00:00~~

Merge Plan - Prioritized for GPU Ollama Access #26

~~Hermes referenced this pull request 2026-04-30 16:09:42 +00:00~~

Merge Plan - Prioritized for GPU Ollama Access #26

Hermes referenced this issue from a commit

2026-04-30 18:37:14 +00:00

docs: add merge priority order with security hardening as #1 priority

Hermes referenced this pull request

2026-04-30 18:37:25 +00:00

docs: add merge priority order with security hardening as #1 #29

Hermes referenced this pull request