Yang Yang Xie
69ddc0d88b
Self-hosted Envoy gateway with AI threat analysis, TLS automation, and real-time security dashboard. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2.8 KiB
AI Setup
Aegis has two AI features: Intelligence Review (background IP threat classification) and Owl Chat (conversational assistant).
Both are optional. If no API key is configured, all other Aegis features work normally.
Supported providers
| Provider | Model examples | Notes |
|---|---|---|
| Gemini (Google) | gemini-2.0-flash, gemini-1.5-pro |
Free tier available |
| Claude (Anthropic) | claude-haiku-4-5-20251001, claude-sonnet-4-6 |
Fast haiku models work well |
| OpenAI | gpt-4o-mini, gpt-4o |
GPT-4o-mini is cost-effective |
| DeepSeek | deepseek-chat |
Good value |
| Ollama | qwen2.5:7b, llama3.2:3b |
Fully local, no API key |
Intelligence Review
Runs background sweeps every N minutes. Any IP with enough requests gets sent to the AI for classification:
- Type:
human,bot,crawler,scanner,attacker - Threat score: 0.0–1.0
- Auto-block: IPs above the block threshold are blocked automatically
Configure in Settings → AI → Intelligence Review
- Toggle Enable AI Review
- Select provider and model
- Enter API key
- Set sweep interval (default: 5 min)
- Set alert threshold (default: 0.35) and block threshold (default: 0.65)
- Alert < Block is required
IP Enrichment
Aegis optionally queries external databases before sending data to the AI, improving classification accuracy:
| Source | Data | Cost |
|---|---|---|
| DNS PTR | Reverse DNS, verifies Googlebot etc. | Free |
| ip-api.com | ASN, ISP, VPN/proxy/Tor/datacenter flags | Free, 45 req/min |
| Known bot CIDRs | Google, Bing crawler ranges | Free |
| AbuseIPDB | Community abuse reports, confidence score | Free tier: 1,000/day |
Owl Chat
A conversational assistant that can read your live gateway state and take actions (block IPs, explain traffic, review configs, walk through setup procedures).
Configure in Settings → AI → Owl Chat Agent
- Toggle Enable Owl Chat
- Leave provider/model/key blank to reuse Intelligence Review settings
- Or set a separate provider (e.g. a faster/cheaper model for chat)
What Owl can do
- Answer questions about traffic patterns and security events
- Look up IP profiles, explain threat scores
- Block or unblock IPs
- Review gateway configuration for issues
- Walk you through procedures (add a domain, set up HTTP-01, configure OIDC)
- Analyse patrol sweep results
Custom knowledge
Mount a file at /data/skills/site.md to inject custom context into every Owl conversation — useful for documenting your server layout, special rules, or preferred procedures.
Owl Patrol
Autonomous scheduled sweeps. Owl analyses recent traffic patterns and sends a notification if it finds something concerning.
Configure in Integrations → Owl Patrol (requires at least one notification channel).