# Security And Remote Access

Omnius is local-first by default. Remote access should be explicit, authenticated, and scoped.

## Local Binding

Default daemon URL:

```text
http://127.0.0.1:11435
```

Bind to a network interface only when you also configure auth:

```bash
OMNIUS_HOST=0.0.0.0:11435 \
OMNIUS_REST_API_KEYS="read-key:read:grafana,run-key:run:ci:60:100000:3,admin-key:admin:ops" \
omnius serve
```

## Scopes

- `read`: inspect state, usage, models, events, skills, memory search, and metadata.
- `run`: submit tasks and execute permitted run-scope tools.
- `admin`: mutate config, keys, high-risk controls, and admin-only tools.

Tool policy still applies after auth scope is accepted.

## Sponsor Safety

Sponsor providers should expose model and media capacity without exposing raw upstream URLs or provider secrets. Consumers should see sponsor models and telemetry, not implementation credentials.

## Telegram Public Contexts

Public Telegram contexts must use scoped tools and scoped memory. No arbitrary shell, local filesystem access, or unscoped private memory should be exposed to public users.

## Secret Handling

Secrets should be redacted before requests reach untrusted inference peers. Runtime API keys live under `~/.omnius/keys.json` when minted through the daemon.

## Hardening Checklist

| Area | Required Control |
| --- | --- |
| Binding | keep `127.0.0.1` unless remote access is intentional |
| Auth | require API keys before binding to LAN or public interfaces |
| Scopes | issue separate `read`, `run`, and `admin` keys per caller |
| Tool policy | attach restricted profiles for CI, public Telegram, and remote peers |
| Secrets | redact provider keys before sponsor, COHERE, Telegram, or remote model calls |
| Logs | avoid storing raw secrets in `.omnius/`, audit logs, or crash output |
| Sponsors | enforce concurrency, RPM, daily tokens, and model/media allowlists server-side |
| Telegram | verify group permissions and public/private policy before enabling group mode |
| Updates | treat `/update full` as installer code; preserve password prompts outside the TUI frame |
| Reverse proxy | use TLS, preserve WebSocket upgrades, and forward only intended paths |

## Remote Daemon Exposure

For a LAN daemon, prefer a scoped key set:

```bash
OMNIUS_HOST=0.0.0.0:11435 \
OMNIUS_REST_API_KEYS="dash:read:grafana:600::,ci:run:ci:60:100000:3,ops:admin:ops:120:500000:10" \
omnius serve
```

For internet exposure, put Omnius behind a reverse proxy with TLS and a narrow route allowlist. Expose `/v1/chat`, `/v1/chat/completions`, `/v1/run`, `/v1/events`, and `/v1/voicechat/ws` only when the caller and tool profile need them.

## Public Tool Profiles

Public or group-facing agents should run with a profile that denies shell, arbitrary file writes outside scoped creative directories, project destruction, sponsor/provider mutation, key mutation, and raw secret access. Creative media paths should be rooted under chat/session directories, not user-provided absolute paths.