# Security — Matty AI Chat Agent

## Ollama Network Exposure

Matty connects to an Ollama server to run LLM inference. **Ollama does not
natively support authentication, TLS, or access control.** If exposed to the
public internet, anyone who knows your Ollama URL can:

- Run inference on your models (costly and potentially abusive)
- Access any model you have pulled
- Potentially execute arbitrary code through model exploits

### Recommendations

**DO NOT expose your Ollama server directly to the public internet.**

Instead, access it through one of these methods:

1. **Private network** — Run Ollama on the same LAN/VLAN as your Mattermost
   server. No public exposure needed.

2. **WireGuard / Tailscale tunnel** — If Mattermost and Ollama are on
   different networks, use a WireGuard or Tailscale tunnel between them.
   No public ports required.

3. **Reverse proxy with IP allowlist** — If a tunnel isn't possible,
   put Ollama behind a reverse proxy (nginx, Caddy, HAProxy) that:
   - Restricts access to the Mattermost server's IP address only
   - Terminates TLS (Ollama doesn't support HTTPS natively)
   - Logs all access for auditing

4. **SSH tunnel** — For temporary access: `ssh -L 11434:localhost:11434 user@ollama-host`

### Plugin Configuration

The `OllamaURL` setting in the System Console accepts `http://` or `https://`
URLs. The plugin validates the scheme at config load and rejects invalid URLs.
TLS verification is enabled by default.

## Other Security Considerations

- **User access**: Restrict bot usage to specific Mattermost user IDs via
  the `AllowedUserIDs` setting in the System Console (empty = all users).
- **Rate limiting**: Set `RateLimitPerMinute` to prevent abuse (0 = unlimited).
- **Stop words**: The bot disengages on configurable stop words ("thanks",
  "bye", "stop") to prevent unintended continued conversation.
- **Logging**: Enable Debug Logging only during troubleshooting — it logs
  full conversation content and Ollama API requests.
- **Plugin updates**: Upload plugin bundles from trusted sources. Verify
  integrity via your Gitea release artifacts.