arch_agent
f015092b1f
Server: - config: server.scan_only flag (default: false) - /api/build returns scan_only=true without building when enabled - /api/status reports scan_only mode Client (safe-yay): - Detects server scan_only from API response - Scan-only server: builds locally with yay/paru after clean scan - Full server: installs from pacman repo as before - --noinstall flag for scan-only without build (was --scan-only) - Suspicious: prompts for local build or repo install depending on server mode
36 lines
768 B
YAML
36 lines
768 B
YAML
ollama:
|
|
url: http://localhost:11434
|
|
model: qwen2.5:latest
|
|
timeout: 120
|
|
|
|
server:
|
|
host: 0.0.0.0
|
|
port: 8443
|
|
repo_dir: /var/cache/aur-shield/repo
|
|
work_dir: /var/cache/aur-shield/build
|
|
build_user: nobody # never build as root
|
|
scan_only: true # if true, /api/build returns scan result without building
|
|
|
|
security:
|
|
block_patterns:
|
|
- "curl.*\\|.*bash"
|
|
- "wget.*/tmp/.*\\|.*sh"
|
|
- "eval.*base64"
|
|
- "nc\\s+-.*\\d+"
|
|
- "/dev/tcp/"
|
|
- "systemctl.*enable.*--now"
|
|
max_pkg_size_mb: 500
|
|
allowed_source_schemes:
|
|
- "https"
|
|
- "http"
|
|
- "git"
|
|
- "ftp"
|
|
- "file"
|
|
|
|
cache:
|
|
ttl_hours: 168 # 7 days
|
|
max_cache_gb: 10
|
|
|
|
build:
|
|
use_devtools: true # use extra-x86_64-build chroot if available
|
|
timeout: 600 # 10 min per build |