kyle
099b94979c
Block 6to4/Teredo/NAT64-local/site-local/benchmarking/reserved ranges from the IANA registries (families, not decoded embeds). Guard.DenyPrefixes / -deny-prefix covers hairpin WAN /32s; home addresses stay on-box, not in git. Control is tcp/tcp4/tcp6 only.
sift
LLM-oriented fetch and search for the Hermes fleet: fetch a resource and get it back cleaned, compact, and with useful context attached — using local models (Dixie), SearXNG and Brave on orion, and Honcho for retrieval.
Status: P0 skeleton (guard, /healthz, flake, NixOS module, Makefile). See docs/PLAN.md.
Build
Makefile is the source of truth for flags (CGO_ENABLED=0, -trimpath, -s -w -X main.version=).
make build # bin/sift
make test # go test -race ./...
make lint # go vet, and staticcheck if installed
make install # PREFIX=/usr/local; example config in /etc/sift/
nix build # packages.sift, same ldflags
nix flake check # make test lint
The service does not assume Nix store paths. Non-Nix hosts: make install plus dist/sift.service.