From 37cf85693a4fedc9ec8513e9f1a22ea583cf14e7 Mon Sep 17 00:00:00 2001 From: MODELBEAST Date: Mon, 13 Jul 2026 12:31:27 +1000 Subject: [PATCH] docs: auth + dashboard + public hosting (README, AGENTS.md) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit README: accounts & sharing section (owner/guest, local-only guests, dashboard). AGENTS.md: auth now required — MB_TOKEN bearer, guest local-only, token minting. Co-Authored-By: Claude Opus 4.8 --- AGENTS.md | 10 ++++++---- README.md | 9 +++++++-- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 77571c6..bac2e75 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -8,10 +8,11 @@ files and job requests; it returns finished assets. ## 1. Reaching it -- **Base URL (tailnet):** `http://100.89.131.57:8777` — from the machine itself, `http://localhost:8777`. -- **No auth.** The tailnet is the security boundary. Do not expose this port publicly. -- Web UI at the same URL (humans). Agents use the REST API or the `mb` CLI. -- If the server is down (connection refused): on the M3 run `~/Documents/MODELBEAST/scripts/serve.sh` (or ask the owner to run `scripts/install_launchagent.sh` once for boot persistence). +- **Base URL (tailnet):** `http://100.89.131.57:8777` — from the machine itself, `http://localhost:8777`. Public (once the VPS is up): `https://modelbeast.digalot.fyi`. +- **AUTH REQUIRED.** Every `/api/*` call needs a session cookie (browser login) or a bearer token (agents/CLI). Only `/api/health` and the static UI are public. Get a token from the owner: in the UI ⚙ Settings → Users → **token**, or `scripts/users.py`. Then `export MB_TOKEN=mbt_...`. +- **Guests are LOCAL-ONLY** by hard rule: a guest account can run only local operators (no fal/OpenRouter — those are owner-only and blocked server-side), sees only its own assets/jobs, and has a per-user concurrent-job cap. If you're acting as a guest, the cloud operators simply won't appear and will 403 if forced. +- Web UI at the same URL (humans log in). Agents use the REST API or the `mb` CLI with `MB_TOKEN`. +- If the server is down (connection refused): on the M3 run `~/Documents/MODELBEAST/scripts/serve.sh` (first run prints a one-time owner password to `data/server.log`). ## 2. The `mb` CLI (recommended) @@ -19,6 +20,7 @@ One stdlib-only python3 file at repo root — copy it anywhere (`scp m3ultra:~/D ```bash export MB_HOST=http://100.89.131.57:8777 +export MB_TOKEN=mbt_... # from the owner (⚙ Settings → Users → token). Required — every call is authed. ./mb ops -v # operator catalog + every parameter (LIVE truth — trust this over any doc) ./mb upload photo.jpg # -> prints asset id diff --git a/README.md b/README.md index e67993f..ab180da 100644 --- a/README.md +++ b/README.md @@ -8,15 +8,20 @@ Local-first web app that turns videos, images, and 3D files into meshes, splats, /opt/homebrew/bin/uv run uvicorn server.main:app --host 0.0.0.0 --port 8777 ``` -Open http://localhost:8777 (or `http://:8777` from any device on the tailnet). +Open http://localhost:8777 (or `http://:8777` from any device on the tailnet). Prefer `scripts/serve.sh` — it runs headless and prints the one-time owner password on first start. -Drag/drop/paste any video, image, or 3D file; or drop files into `data/inbox/` for auto-ingest. Pick an operator, tune its parameters, run. Add API keys / HuggingFace token under ⚙ Settings. Use ⊞ Compare to view several outputs side by side. +Drag/drop/paste any video, image, or 3D file; or drop files into `data/inbox/` for auto-ingest. Pick an operator, tune its parameters, run. Add API keys / HuggingFace token under ⚙ Settings. Use ⊞ Compare to view several outputs side by side, and **📊 Dashboard** for a live CPU/RAM/GPU/queue snapshot. + +## Accounts & sharing + +Login is required. The first `scripts/serve.sh` creates an **owner** (`monster`) and prints a one-time password to `data/server.log` — change it in ⚙ Settings → Users (or `uv run python scripts/users.py passwd monster`). The owner can add **guest** accounts for friends: guests are **local-only** — they can run only on-device operators (never the owner's paid fal/OpenRouter keys, enforced server-side), see only their own assets/jobs, and have a per-user concurrent-job cap. So mates cost you electricity, nothing else. Public hosting via a VPS + Caddy is in [docs/VPS.md](docs/VPS.md); the CUDA-worker offload plan is in [docs/CUDA-WORKER.md](docs/CUDA-WORKER.md). ## Headless / agents Everything is driveable without the UI via the zero-dependency [`mb`](mb) CLI (works from any tailnet machine with `MB_HOST=http://100.89.131.57:8777`) or raw REST. **[AGENTS.md](AGENTS.md) is the complete handover brief** — endpoints, `mb` reference, operator catalog, recipes, job semantics, etiquette. Server ops: `scripts/serve.sh` (start/restart headless), `scripts/install_launchagent.sh` (optional boot persistence, owner-run). ```bash +export MB_HOST=http://100.89.131.57:8777 MB_TOKEN=mbt_... # token from ⚙ Settings → Users ./mb run fal_trellis2 --file photo.jpg -p resolution=1024 --wait --download out/ ```