Recipe: Airgapped Deployment · rousseau-agent docs

Overview

Run rousseau on a network with no outbound access to Anthropic, OpenAI, Bedrock, or Vertex. Use a locally hosted OpenAI-compatible endpoint (Ollama or vLLM) and one of the fully self-hosted transports (Matrix on your own Synapse, Signal via signal-cli, or email via your own SMTP host).

Prerequisites

A machine capable of running the target model (GPU or lots of RAM).
Ollama or vLLM installed and serving a model.
All outbound firewall rules blocked except to the LLM endpoint and, if used, your Matrix homeserver / signal-cli / IMAP+SMTP host.

Config

provider: ollama

ollama:
  model: llama3.1:70b-instruct
  base_url: http://ollama.internal:11434/v1
  api_key: not-required

state:
  path: /var/lib/rousseau/sessions.db

agent:
  max_iterations: 24
  approver:
    mode: pattern
    default: deny
    allow:
      - {tool: read, match: ".*"}
      - {tool: grep, match: ".*"}
      - {tool: edit, match: "^/workspace/.*"}
    deny:
      - {tool: bash, match: ".*"}   # extra strict for high-assurance deployment

For vLLM, swap:

provider: openai

openai:
  api_key: sk-anything-vllm-ignores
  model: mistralai/Mistral-Large-Latest
  base_url: http://vllm.internal:8000/v1

Network egress

Combine with the nftables recipe:

# /etc/nftables.d/rousseau.nft
table inet rousseau {
  chain output {
    type filter hook output priority 0; policy drop;
    ct state established,related accept
    ip daddr { 10.42.0.10 } tcp dport { 11434 } accept  # ollama
    ip daddr { 10.42.0.20 } tcp dport { 8448 } accept   # matrix homeserver
    ip daddr { 10.42.0.30 } tcp dport { 993, 465 } accept  # imap + smtp
    log prefix "[rousseau blocked] " counter drop
  }
}

See Best Practices: Network egress.

Verification

Checkbox curl https://api.anthropic.com from the rousseau host fails / times out.
Checkbox curl http://ollama.internal:11434/api/tags returns the served models.
Checkbox rousseau doctor shows provider.selected: ollama.
Checkbox rousseau chat responds — potentially slower than cloud providers.

Failure modes

Tool-use quality plummets — small models fail structured tool inputs. Use a 70B-scale model minimum, or accept degraded tool use and rely on read/grep only.
Latency spikes — GPU memory pressure. Monitor VRAM; smaller batch sizes.
context length exceeded — enable agent.compression.enabled: true to trim session length before token overflow.
DNS leaks — the container inherits host DNS. Point at an internal DNS resolver only.