Build a private self-hosted bot with Ollama

{
  "name": "private-ollama-operator-bot",
  "private": true,
  "type": "module",
  "engines": { "node": "22.22.2" },
  "scripts": {
    "start": "tsx src/server.ts",
    "test": "node --import tsx --test test/*.test.ts",
    "check": "tsc --noEmit"
  },
  "dependencies": {
    "openai": "7.1.0",
    "zod": "4.4.3"
  },
  "devDependencies": {
    "@types/node": "22.19.19",
    "tsx": "4.23.1",
    "typescript": "5.9.3"
  }
}

import { spawn } from "node:child_process";
import { z } from "zod";

const tools = {
  host_uptime: { executable: "/usr/bin/uptime", args: [] },
  disk_usage: { executable: "/usr/bin/df", args: ["-P", "-k"] },
  listening_tcp: { executable: "/usr/bin/ss", args: ["-lnt"] }
} as const;

export type ToolName = keyof typeof tools;

export const toolRequest = z.object({
  name: z.enum(["host_uptime", "disk_usage", "listening_tcp"])
}).strict();

export async function runReadOnlyTool(
  name: ToolName
): Promise<{ name: ToolName; exitCode: number; stdout: string; stderr: string }> {
  const definition = tools[name];
  return await new Promise((resolve, reject) => {
    const child = spawn(definition.executable, definition.args, {
      shell: false,
      env: { PATH: "/usr/bin:/bin", LANG: "C.UTF-8" },
      cwd: "/var/empty",
      stdio: ["ignore", "pipe", "pipe"]
    });
    const limit = 65_536;
    let stdout = Buffer.alloc(0);
    let stderr = Buffer.alloc(0);
    let exceeded = false;
    const append = (current: Buffer, chunk: Buffer) => {
      const next = Buffer.concat([current, chunk]);
      if (next.length > limit) {
        exceeded = true;
        child.kill("SIGKILL");
        return next.subarray(0, limit);
      }
      return next;
    };
    child.stdout.on("data", (chunk: Buffer) => { stdout = append(stdout, chunk); });
    child.stderr.on("data", (chunk: Buffer) => { stderr = append(stderr, chunk); });
    const timer = setTimeout(() => child.kill("SIGKILL"), 10_000);
    child.once("error", reject);
    child.once("close", (code, signal) => {
      clearTimeout(timer);
      if (signal || exceeded) {
        reject(new Error(exceeded ? "tool_output_limit" : "tool_timeout"));
        return;
      }
      resolve({
        name,
        exitCode: code ?? 1,
        stdout: stdout.toString("utf8"),
        stderr: stderr.toString("utf8")
      });
    });
  });
}

export const openAiToolDefinitions = [
  {
    type: "function" as const,
    function: {
      name: "host_uptime",
      description: "Read the host uptime and load averages.",
      parameters: { type: "object", properties: {}, additionalProperties: false }
    }
  },
  {
    type: "function" as const,
    function: {
      name: "disk_usage",
      description: "Read POSIX filesystem capacity in fixed kilobyte units.",
      parameters: { type: "object", properties: {}, additionalProperties: false }
    }
  },
  {
    type: "function" as const,
    function: {
      name: "listening_tcp",
      description: "Read listening TCP socket addresses without process details.",
      parameters: { type: "object", properties: {}, additionalProperties: false }
    }
  }
];

import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
import { createServer } from "node:http";
import { appendFile } from "node:fs/promises";
import OpenAI from "openai";
import { z } from "zod";
import { openAiToolDefinitions, runReadOnlyTool, toolRequest } from "./tools.js";

const env = z.object({
  BOT_HOST: z.literal("127.0.0.1").default("127.0.0.1"),
  BOT_PORT: z.coerce.number().int().min(1024).max(65535).default(8088),
  BOT_TOKEN_SHA256: z.string().regex(/^[a-f0-9]{64}$/),
  OLLAMA_MODEL: z.string().min(1).max(120),
  OLLAMA_BASE_URL: z.literal("http://127.0.0.1:11434/v1").default("http://127.0.0.1:11434/v1"),
  AUDIT_FILE: z.string().default("/var/lib/ollama-operator/audit.ndjson")
}).parse(process.env);

const openai = new OpenAI({ baseURL: env.OLLAMA_BASE_URL, apiKey: "ollama" });
const requestSchema = z.object({
  messages: z.array(z.object({
    role: z.enum(["user", "assistant"]),
    content: z.string().min(1).max(16_384)
  })).min(1).max(20),
  allowReadOnlyTools: z.boolean().default(false)
}).strict();

const counters = { requests: 0, rejected: 0, tools: 0, failures: 0 };

function authenticate(header: string | undefined): boolean {
  if (!header?.startsWith("Bearer ")) return false;
  const actual = Buffer.from(createHash("sha256").update(header.slice(7)).digest("hex"));
  const expected = Buffer.from(env.BOT_TOKEN_SHA256);
  return actual.length === expected.length && timingSafeEqual(actual, expected);
}

async function audit(event: Record<string, unknown>): Promise<void> {
  await appendFile(env.AUDIT_FILE, JSON.stringify({
    timestamp: new Date().toISOString(),
    ...event
  }) + "\n", { encoding: "utf8", mode: 0o600 });
}

async function readBody(request: import("node:http").IncomingMessage): Promise<unknown> {
  const chunks: Buffer[] = [];
  let size = 0;
  for await (const chunk of request) {
    const bytes = Buffer.from(chunk);
    size += bytes.length;
    if (size > 65_536) throw new Error("request_too_large");
    chunks.push(bytes);
  }
  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
}

const server = createServer(async (request, response) => {
  const requestId = randomUUID();
  if (request.url === "/healthz" && request.method === "GET") {
    response.writeHead(200, { "content-type": "application/json" });
    response.end(JSON.stringify({ status: "ok", model: env.OLLAMA_MODEL }));
    return;
  }
  if (request.url === "/metrics" && request.method === "GET") {
    response.writeHead(200, { "content-type": "text/plain; version=0.0.4" });
    response.end(Object.entries(counters)
      .map(([name, value]) => "ollama_operator_" + name + "_total " + value)
      .join("\n") + "\n");
    return;
  }
  if (request.url !== "/v1/chat" || request.method !== "POST") {
    response.writeHead(404).end();
    return;
  }
  if (!authenticate(request.headers.authorization)) {
    counters.rejected++;
    response.writeHead(401, { "content-type": "application/json" });
    response.end(JSON.stringify({ error: "unauthorized", requestId }));
    return;
  }
  counters.requests++;
  try {
    const input = requestSchema.parse(await readBody(request));
    const completion = await openai.chat.completions.create({
      model: env.OLLAMA_MODEL,
      messages: [
        {
          role: "system",
          content: "You are a private operations assistant. Use only supplied read-only tools. Never claim to execute writes. Explain uncertainty."
        },
        ...input.messages
      ],
      tools: input.allowReadOnlyTools ? openAiToolDefinitions : undefined,
      tool_choice: input.allowReadOnlyTools ? "auto" : "none",
      temperature: 0.2
    });
    const message = completion.choices[0]?.message;
    const toolResults: Array<Record<string, unknown>> = [];
    for (const call of message?.tool_calls ?? []) {
      if (call.type !== "function") continue;
      const parsed = toolRequest.parse({
        name: call.function.name,
        ...JSON.parse(call.function.arguments || "{}")
      });
      const result = await runReadOnlyTool(parsed.name);
      counters.tools++;
      toolResults.push({
        toolCallId: call.id,
        name: result.name,
        exitCode: result.exitCode,
        stdout: result.stdout,
        stderr: result.stderr
      });
    }
    await audit({
      requestId,
      outcome: "ok",
      toolNames: toolResults.map((item) => item.name),
      messageCount: input.messages.length
    });
    response.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
    response.end(JSON.stringify({
      requestId,
      draft: message?.content ?? "",
      toolResults,
      notice: "Model output is unverified. No write action was executed."
    }));
  } catch (error) {
    counters.failures++;
    await audit({ requestId, outcome: "error", errorClass: error instanceof z.ZodError ? "validation" : "runtime" });
    response.writeHead(400, { "content-type": "application/json" });
    response.end(JSON.stringify({ error: "request_failed", requestId }));
  }
});

server.listen(env.BOT_PORT, env.BOT_HOST, () => {
  console.log(JSON.stringify({ event: "listening", host: env.BOT_HOST, port: env.BOT_PORT }));
});

[Unit]
Description=Private Ollama operator bot
After=network-online.target ollama.service
Requires=ollama.service

[Service]
Type=simple
User=ollama-bot
Group=ollama-bot
WorkingDirectory=/opt/ollama-operator
EnvironmentFile=/etc/ollama-operator/environment
ExecStart=/usr/bin/node --enable-source-maps /opt/ollama-operator/dist/server.js
Restart=on-failure
RestartSec=5
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/ollama-operator
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
UMask=0077

[Install]
WantedBy=multi-user.target

import assert from "node:assert/strict";
import test from "node:test";
import { toolRequest, runReadOnlyTool } from "../src/tools.js";

test("rejects every tool outside the compiled allowlist", () => {
  assert.throws(() => toolRequest.parse({ name: "shell", command: "id" }));
  assert.throws(() => toolRequest.parse({ name: "disk_usage", path: "/" }));
});

test("runs the disk probe with fixed executable and argv", async () => {
  const result = await runReadOnlyTool("disk_usage");
  assert.equal(result.name, "disk_usage");
  assert.equal(result.exitCode, 0);
  assert.match(result.stdout, /Filesystem/);
  assert.ok(result.stdout.length <= 65_536);
});