Rebuild profile router as secure recoverable v2

deploy/deploy.sh

@@ -9,7 +9,8 @@ SSH_KEY="${SSH_KEY:-$HOME/.ssh/id_ed25519}"
 STAGE="/tmp/ai-profile-router-$$"
 
 mkdir -p "$STAGE"
-cp router/ai_profile_router.py router/image_worker.py router/xtts_worker.py \
+cp router/ai_profile_router.py router/router_support.py router/router_profiles.json \
+   router/image_worker.py router/xtts_worker.py \
    router/stt_worker.py \
    deploy/install.sh deploy/mike-ai-profile-router.service \
    deploy/mike-ai-xtts.service deploy/mike-ai-whisper.service \

deploy/install.sh

@@ -38,7 +38,10 @@ fi
 
 # --- 2. Neue Dateien installieren -------------------------------------------
 mkdir -p "$INSTALL_DIR" "$IMAGE_DIR"
+install -d -m 0700 /etc/mike-ai /var/lib/mike-ai-profile-router
 install -m 0755 "$DIR/ai_profile_router.py" "$INSTALL_DIR/ai_profile_router.py"
+install -m 0644 "$DIR/router_support.py" "$INSTALL_DIR/router_support.py"
+install -m 0644 "$DIR/router_profiles.json" /etc/mike-ai/router-profiles.json
 install -m 0755 "$DIR/image_worker.py" "$INSTALL_DIR/image_worker.py"
 install -m 0755 "$DIR/xtts_worker.py" "$INSTALL_DIR/xtts_worker.py"
 install -m 0755 "$DIR/stt_worker.py" "$INSTALL_DIR/stt_worker.py"
@@ -46,6 +49,14 @@ install -m 0644 "$DIR/${SERVICE}" "/etc/systemd/system/${SERVICE}"
 install -m 0644 "$DIR/${XTTS_SERVICE}" "/etc/systemd/system/${XTTS_SERVICE}"
 install -m 0644 "$DIR/${WHISPER_SERVICE}" "/etc/systemd/system/${WHISPER_SERVICE}"
 
+# Eigener Router-Key. Er wird niemals in Git oder ins Installationslog geschrieben.
+if [ ! -s /etc/mike-ai/router-api-key ]; then
+  umask 077
+  python3 -c 'import secrets; print(secrets.token_urlsafe(48))' \
+    > /etc/mike-ai/router-api-key
+fi
+chmod 0600 /etc/mike-ai/router-api-key
+
 # --- 3. Python-Venv mit Bild-Abhängigkeiten ---------------------------------
 if [ ! -x "$VENV/bin/python" ]; then
   echo "-- Erstelle Python-Venv in $VENV"
@@ -150,5 +161,17 @@ if ! systemctl is-active --quiet "$WHISPER_SERVICE"; then
   exit 1
 fi
 echo "-- Whisper-Service läuft"
-curl -sf "http://127.0.0.1:8081/status" | python3 -m json.tool
+python3 - <<'PY'
+import json
+import pathlib
+import urllib.request
+
+key = pathlib.Path("/etc/mike-ai/router-api-key").read_text().strip()
+request = urllib.request.Request(
+    "http://127.0.0.1:8081/status",
+    headers={"Authorization": f"Bearer {key}"})
+with urllib.request.urlopen(request, timeout=10) as response:
+    print(json.dumps(json.load(response), indent=2))
+PY
+echo "-- Router-API-Key liegt ausschließlich in /etc/mike-ai/router-api-key"
 echo "== Fertig =="

deploy/mike-ai-profile-router.service

@@ -8,8 +8,14 @@ Type=simple
 ExecStart=/opt/mike-ai/ai-profile-router/venv/bin/python /opt/mike-ai/ai-profile-router/ai_profile_router.py
 Restart=on-failure
 RestartSec=3
+EnvironmentFile=-/etc/mike-ai/router.env
 Environment=ROUTER_HOST=0.0.0.0
 Environment=ROUTER_PORT=8081
+Environment=ROUTER_AUTH_MODE=required
+Environment=ROUTER_API_KEY_FILE=/etc/mike-ai/router-api-key
+Environment=ROUTER_STATE_FILE=/var/lib/mike-ai-profile-router/state.json
+Environment=ROUTER_PROFILES_FILE=/etc/mike-ai/router-profiles.json
+Environment=ROUTER_MAX_CONCURRENT_REQUESTS=16
 Environment=UPSTREAM_URL=http://127.0.0.1:8080
 Environment=PROFILE_SCRIPT=/usr/local/bin/llama-profile
 Environment=PROFILE_DIR=/etc/systemd/system/mike-ai-llama-ui.service.d
@@ -22,6 +28,9 @@ Environment=IMAGE_DIR=/opt/mike-ai/ai-profile-router/images
 Environment=IMAGE_WORKER_LOG=/opt/mike-ai/ai-profile-router/worker.log
 Environment=IMAGE_GEN_TIMEOUT=600
 Environment=IMAGE_VRAM_FREE_TIMEOUT=120
+Environment=IMAGE_RETENTION_FILES=100
+Environment=IMAGE_RETENTION_BYTES=5368709120
+Environment=IMAGE_RETENTION_DAYS=30
 Environment=LLAMA_SERVER_BIN=/opt/mike-ai/llama.cpp/build/bin/llama-server
 Environment=VISION_MODEL=/opt/mike-ai/models/qwen3.8-27b/Qwen3.8-27B-Q3_K_M.gguf
 Environment=VISION_MMPROJ=/opt/mike-ai/models/qwen3.8-27b-nvfp4/mmproj-BF16.gguf
@@ -31,9 +40,20 @@ Environment=VISION_LOAD_TIMEOUT=300
 Environment=VISION_INFER_TIMEOUT=300
 Environment=VISION_UNLOAD_TIMEOUT=120
 Environment=VISION_MAX_TOKENS=4096
+Environment=VISION_MAX_IMAGE_BYTES=20971520
+Environment=VISION_ALLOW_REMOTE_URLS=false
 Environment=VISION_LOG=/opt/mike-ai/ai-profile-router/vision_server.log
 NoNewPrivileges=true
 PrivateTmp=true
+ProtectHome=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+UMask=0077
 
 [Install]
 WantedBy=multi-user.target