# Connexion initiale (remplace par ton IP)
ssh root@203.0.113.42

# Mise à jour du système
apt update && apt upgrade -y

# Créer l'utilisateur admin (remplace "umbra" par ton nom)
adduser umbra
usermod -aG sudo umbra

# Copier ta clé SSH publique vers le nouvel utilisateur
rsync --archive --chown=umbra:umbra ~/.ssh /home/umbra

# Durcir SSH
sudo nano /etc/ssh/sshd_config
# Modifier ces paramètres :
Port                    50222    # Port non-standard
PermitRootLogin         no
PasswordAuthentication  no       # Clés uniquement
PubkeyAuthentication    yes

sudo systemctl restart sshd

# Configurer le pare-feu (dans un SECOND terminal, AVANT de fermer)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 50222/tcp  comment 'SSH'
sudo ufw allow 80/tcp     comment 'HTTP'
sudo ufw allow 443/tcp    comment 'HTTPS'
sudo ufw allow 51820/udp  comment 'WireGuard'
sudo ufw enable

# Installer Docker
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker umbra
newgrp docker && docker --version
Docker version 26.x.x ← attendu

mkdir -p /opt/headscale/{config,data} && cd /opt/headscale

# docker-compose.yml
cat > docker-compose.yml << 'EOF'
version: "3.9"
services:
  headscale:
    image: headscale/headscale:latest
    restart: unless-stopped
    volumes:
      - ./config:/etc/headscale
      - ./data:/var/lib/headscale
    ports:
      - "443:8080"
      - "51820:51820/udp"
    command: headscale serve
EOF

# config/config.yaml (minimal)
cat > config/config.yaml << 'EOF'
server_url: https://vpn.tondomaine.io
listen_addr: 0.0.0.0:8080
ip_prefixes:
  - 100.64.0.0/10
database:
  type: sqlite
  sqlite:
    path: /var/lib/headscale/db.sqlite
tls_letsencrypt_hostname: vpn.tondomaine.io
tls_letsencrypt_cache_dir: /var/lib/headscale/cache
EOF

docker compose up -d
# Créer namespace + clé pré-auth
docker exec headscale headscale namespaces create umbra
docker exec headscale headscale preauthkeys create --namespace umbra --expiration 24h
# Output : mkey:xxxx  ← copie cette clé

# Sur ta machine locale
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up \
  --login-server=https://vpn.tondomaine.io \
  --authkey=mkey:xxxx \
  --hostname=local-worker

# Vérification
ping 100.64.0.1 -c 3
64 bytes from 100.64.0.1: time=12ms  ← tunnel actif

version: "3.9"
services:

  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: umbra
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: umbralabs
    volumes: [postgres_data:/var/lib/postgresql/data]

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    ports: ["127.0.0.1:6379:6379"]  # Accessible uniquement en local/VPN

  n8n:
    image: n8nio/n8n:latest
    restart: unless-stopped
    ports: ["5678:5678"]
    environment:
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_DATABASE: umbralabs
      DB_POSTGRESDB_USER: umbra
      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}
      QUEUE_BULL_REDIS_HOST: redis
      EXECUTIONS_MODE: queue
      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
      N8N_HOST: n8n.tondomaine.io
      WEBHOOK_URL: https://n8n.tondomaine.io
    depends_on: [postgres, redis]

volumes:
  postgres_data:

# Créer le .env
echo "POSTGRES_PASSWORD=$(openssl rand -hex 16)" > .env
echo "N8N_ENCRYPTION_KEY=$(openssl rand -hex 32)" >> .env

docker compose -f docker-compose.n8n.yml up -d

# Vérifier que n8n répond
curl https://n8n.tondomaine.io/healthz
{"status":"ok"}  ← attendu

# Install Ollama (VPS and local machine)
curl -fsSL https://ollama.com/install.sh | sh

# On VPS, fast model for support/social agents
ollama pull deepseek-v2:16b

# On local machine, heavy model for dev/marketing agents
ollama pull qwen2.5-coder:32b

# Test (no internet required)
ollama run deepseek-v2:16b "What is digital sovereignty?"

# Installer Ollama (VPS ET machine locale, même commande)
curl -fsSL https://ollama.com/install.sh | sh

# === VPS === télécharger le modèle rapide (léger)
ollama pull deepseek-v2:16b
pulling manifest... ✓  (~10 Go, ~5-10min)

# === Machine locale === télécharger le modèle de raisonnement
ollama pull qwen2.5-coder:32b
pulling manifest... ✓  (~20 Go, ~10-20min selon connexion)

# Tester la réponse (doit fonctionner sans Internet)
ollama run deepseek-v2:16b "Réponds en français : qu'est-ce qu'un agent IA ?"
Un agent IA est un programme capable de percevoir son environnement...

# Test Python, même API que OpenAI, serveur différent
from openai import OpenAI

client = OpenAI(
    base_url="http://localhost:11434/v1",  # Ollama local
    api_key="ollama",                    # ignoré, mais requis
)

response = client.chat.completions.create(
    model="deepseek-v2:16b",
    messages=[{"role": "user", "content": "Dis 'Souveraineté numérique!'"}]
)
print(response.choices[0].message.content)
Souveraineté numérique!  ← réponse sans API commerciale

# Add gVisor repository
curl -fsSL https://gvisor.dev/archive.key | \
  sudo gpg --dearmor -o /usr/share/keyrings/gvisor-archive-keyring.gpg
sudo apt update && sudo apt install -y runsc
sudo runsc install && sudo systemctl restart docker

# Test isolation
docker run --rm --runtime=runsc \
  --network=none --read-only \
  python:3.12-slim \
  python -c "print('gVisor sandbox OK, isolation active')"
gVisor sandbox OK, isolation active  ← expected

# Ajouter le dépôt gVisor
curl -fsSL https://gvisor.dev/archive.key | \
  sudo gpg --dearmor -o /usr/share/keyrings/gvisor-archive-keyring.gpg

echo "deb [arch=$(dpkg --print-architecture) \
  signed-by=/usr/share/keyrings/gvisor-archive-keyring.gpg] \
  https://gvisor.dev/apt stable main" | \
  sudo tee /etc/apt/sources.list.d/gvisor.list

sudo apt update && sudo apt install -y runsc
sudo runsc install  # Configure Docker pour utiliser runsc
sudo systemctl restart docker

# Tester l'isolation
docker run --rm --runtime=runsc \
  --network=none --read-only \
  python:3.12-slim \
  python -c "print('Sandbox gVisor OK, isolation active')"
Sandbox gVisor OK, isolation active  ← attendu

// ECHO Pattern v2, Umbra Labs
// Ce script s'exécute dans un nœud "Code" de n8n
// AVANT tout appel à l'AI Gateway

const RISK_RULES = {
  HIGH:   ['merge', 'delete', 'bulk_email', 'drop_table'],
  MEDIUM: ['create_pr', 'exec', 'send_email', 'push'],
  LOW:    ['read', 'search', 'analyse', 'draft'],
};

function evaluateRisk(payload) {
  const text = JSON.stringify(payload).toLowerCase();
  for (const kw of RISK_RULES.HIGH)   if (text.includes(kw)) return 'HIGH';
  for (const kw of RISK_RULES.MEDIUM) if (text.includes(kw)) return 'MEDIUM';
  return 'LOW';
}

const input = $input.first().json;
const level = evaluateRisk(input.payload);
const routing = {
  HIGH:   'HUMAN_GATE',     // Bloqué → notification Slack/email
  MEDIUM: 'ISOLATED_SANDBOX', // Exécuté dans gVisor
  LOW:    'AUTO_RUN',        // Exécuté directement
}[level];

return [{ json: { ...input, risk_level: level, routing, approved: routing === 'AUTO_RUN' }}];

# On VPS, clone and deploy
git clone https://github.com/umbralabs/ai-agents /opt/umbra
cd /opt/umbra && cp .env.example .env
nano .env  # fill in API keys, Redis URL, etc.
docker compose -f docker/docker-compose.vps.yml up -d --build

# On local machine, start the orchestrator
cd /opt/umbra
python -m agents.orchestrator.router

# Test: trigger the dev agent
curl -X POST http://localhost:8080/task \
  -H "x-api-key: $API_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"dev","payload":{"task":"fix bug in cart.js"}}'
{"task_id":"uuid","status":"queued"}

# Sur le VPS, cloner et déployer
git clone https://github.com/umbralabs/ai-agents /opt/umbra
cd /opt/umbra && cp .env.example .env
nano .env  # Remplir REDIS_URL, API_SECRET_KEY, credentials APIs

docker compose -f docker/docker-compose.vps.yml up -d --build
curl http://localhost:8080/health
{"status":"online","agent":"umbra-labs-gateway"}  ← attendu

# Sur la machine locale, lancer l'orchestrateur
cd /opt/umbra
docker compose -f docker/docker-compose.local.yml up -d --build
docker logs umbra_orchestrator --tail=5
Orchestrateur Umbra Labs démarré, en écoute sur les queues Redis

# Déclencher l'agent Social pour un post Twitter
curl -X POST http://localhost:8080/task \
  -H "Content-Type: application/json" \
  -H "x-api-key: $API_SECRET_KEY" \
  -d '{
    "type": "social",
    "payload": {
      "topic": "Pourquoi auto-héberger son IA en 2026",
      "platforms": ["twitter", "linkedin"],
      "format": "thread",
      "tone": "educatif"
    },
    "risk_level": "LOW"
  }'

{"task_id":"uuid","status":"queued","message":"Routé vers agent [social]"}

# Vérifier le résultat
curl http://localhost:8080/task/uuid
{"task_id":"uuid","status":"completed","result":{"output":"Thread créé..."}}

#!/bin/bash
# Save as verify.sh and run: bash verify.sh

echo "=== OS-NEXUS INFRA VERIFICATION ==="

ping -c 1 100.64.0.1 &>/dev/null && echo "✓ WireGuard VPN active" || echo "✗ VPN DOWN"
curl -sf https://vpn.yourdomain.io/health &>/dev/null && echo "✓ Headscale OK" || echo "✗ Headscale DOWN"
curl -sf https://n8n.yourdomain.io/healthz &>/dev/null && echo "✓ n8n OK" || echo "✗ n8n DOWN"
curl -sf http://100.64.0.1:8080/health &>/dev/null && echo "✓ AI Gateway OK" || echo "✗ Gateway DOWN"
curl -sf http://100.64.0.1:11434/api/tags &>/dev/null && echo "✓ Ollama VPS OK" || echo "✗ Ollama VPS DOWN"
curl -sf http://localhost:11434/api/tags &>/dev/null && echo "✓ Ollama Local OK" || echo "✗ Ollama Local DOWN"
docker run --rm --runtime=runsc alpine echo "ok" &>/dev/null && echo "✓ gVisor OK" || echo "✗ gVisor DOWN"

echo "=== END ==="

#!/bin/bash
# Coller dans verify.sh et lancer : bash verify.sh

echo "=== VÉRIFICATION INFRA OS-NEXUS ==="

# 1. VPN
ping -c 1 100.64.0.1 &>/dev/null && echo "✓ VPN WireGuard actif" || echo "✗ VPN DOWN"

# 2. Headscale
curl -sf https://vpn.tondomaine.io/health &>/dev/null && echo "✓ Headscale OK" || echo "✗ Headscale DOWN"

# 3. n8n
curl -sf https://n8n.tondomaine.io/healthz &>/dev/null && echo "✓ n8n OK" || echo "✗ n8n DOWN"

# 4. AI Gateway
curl -sf http://100.64.0.1:8080/health &>/dev/null && echo "✓ AI Gateway OK" || echo "✗ Gateway DOWN"

# 5. Ollama VPS
curl -sf http://100.64.0.1:11434/api/tags &>/dev/null && echo "✓ Ollama VPS OK" || echo "✗ Ollama VPS DOWN"

# 6. Ollama Local
curl -sf http://localhost:11434/api/tags &>/dev/null && echo "✓ Ollama Local OK" || echo "✗ Ollama Local DOWN"

# 7. gVisor
docker run --rm --runtime=runsc alpine echo "ok" &>/dev/null && echo "✓ gVisor OK" || echo "✗ gVisor DOWN"

echo "=== FIN ==="