2.1 KiB
Security — Matty AI Chat Agent
Ollama Network Exposure
Matty connects to an Ollama server to run LLM inference. Ollama does not natively support authentication, TLS, or access control. If exposed to the public internet, anyone who knows your Ollama URL can:
- Run inference on your models (costly and potentially abusive)
- Access any model you have pulled
- Potentially execute arbitrary code through model exploits
Recommendations
DO NOT expose your Ollama server directly to the public internet.
Instead, access it through one of these methods:
-
Private network — Run Ollama on the same LAN/VLAN as your Mattermost server. No public exposure needed.
-
WireGuard / Tailscale tunnel — If Mattermost and Ollama are on different networks, use a WireGuard or Tailscale tunnel between them. No public ports required.
-
Reverse proxy with IP allowlist — If a tunnel isn't possible, put Ollama behind a reverse proxy (nginx, Caddy, HAProxy) that:
- Restricts access to the Mattermost server's IP address only
- Terminates TLS (Ollama doesn't support HTTPS natively)
- Logs all access for auditing
-
SSH tunnel — For temporary access:
ssh -L 11434:localhost:11434 user@ollama-host
Plugin Configuration
The OllamaURL setting in the System Console accepts http:// or https://
URLs. The plugin validates the scheme at config load and rejects invalid URLs.
TLS verification is enabled by default.
Other Security Considerations
- User access: Restrict bot usage to specific Mattermost user IDs via
the
AllowedUserIDssetting in the System Console (empty = all users). - Rate limiting: Set
RateLimitPerMinuteto prevent abuse (0 = unlimited). - Stop words: The bot disengages on configurable stop words ("thanks", "bye", "stop") to prevent unintended continued conversation.
- Logging: Enable Debug Logging only during troubleshooting — it logs full conversation content and Ollama API requests.
- Plugin updates: Upload plugin bundles from trusted sources. Verify integrity via your Gitea release artifacts.