qiuruiandClaude Opus 4.6
ec464e3d9e
Rust replacement for the Python mitmproxy-based Privacy Gateway. Uses hudsucker for transparent HTTPS proxying and axum for the REST management API. Modules: - proxy.rs: hudsucker HttpHandler — intercepts file uploads to AI service domains, scans for PII via info-privacy-rs, and optionally redacts content before forwarding - interceptor.rs: manual multipart/form-data parsing and rebuilding - scanner.rs: PII scanning via info-privacy-rs /api/v1/analyze + redact - llm_verifier.rs: RKLLM false-positive verification for uncertain entity detections - audit.rs: MariaDB audit logging (sqlx) + KVM backend event posting - domains.rs: AI domain whitelist (file or built-in defaults) - state.rs: privacy mode state.json reading/writing (off/audit/redact) - rest_api.rs: axum REST API on port 8889 (mode, stats, audit, cert) - config.rs: environment variable configuration with CLI overrides - main.rs: clap CLI + dual-server startup (proxy 8888 + API 8889) Degradation rules: - info-privacy unreachable + audit mode: log scan_failed, allow through - info-privacy unreachable + redact mode: log scan_failed, BLOCK request - RKLLM unreachable: use original detection results - MariaDB unreachable: skip logging, continue processing Tests: 39 unit tests covering state, domains, multipart parsing, config, scanner utilities, and LLM verdict parsing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
KVM-Privacy Hub
在 KVM-over-IP 系统基础上叠加两层隐私保护能力（视频遮蔽 + 网络拦截），运行于 NanoPC-T6 (RK3588)。所有防护完全在 KVM 设备端完成，无需在被控机器上部署任何软件。
架构概览
┌───────────────────────────────────────────────────────────┐
│ KVM WebUI (React) │
│ http://localhost:8080 │
└────────────────────────┬──────────────────────────────────┘
│
┌────────────────────────▼──────────────────────────────────┐
│ KVM Server (Go, port 8080) │
│ 视频管道(MPP) | HID | WebRTC | RBAC | 审计 | 隐私遮蔽 │
└──┬──────────┬──────────┬──────────────────────┬───────────┘
│ │ │ │
┌──▼────┐ ┌──▼──────┐ ┌─▼───────────┐ ┌───────▼──────────┐
│隐私网关│ │KVM Agent│ │info-privacy │ │ mem-bridge │
│mitmproxy│ │Python │ │Rust/RKNN │ │Memory:8001 │
│ :8888 │ │ :8890 │ │ :8000 │ │Router:8002 │
└────────┘ └─────────┘ └────────────┘ └──────────────────┘
端口规划
| 服务 | 端口 | 包名 | 说明 |
|---|---|---|---|
| KVM Server | 8080 | kvm-server | Go 主服务 + React WebUI + WebRTC |
| info-privacy-rs | 8000 | kvm-privacy | Rust/RKNN PII 检测与脱敏 |
| mem-bridge memory | 8001 | kvm-bridge | FAISS 向量搜索 + 会话存储 |
| mem-bridge router | 8002 | kvm-bridge | AI 路由 (OpenAI/Gemini/本地) |
| Privacy Gateway | 8888 | kvm-mitm | mitmproxy 代理网关 |
| KVM Agent | 8890 | kvm-agent | Python AI Agent daemon |
Debian 包
| 包名 | 架构 | 说明 |
|---|---|---|
| kvm-server | arm64 | Go KVM 核心 + C 视频管道 |
| kvm-agent | all | Python AI Agent |
| kvm-privacy | arm64 | Rust PII 检测 |
| kvm-bridge | all | mem-bridge 记忆服务 |
| kvm-mitm | all | mitmproxy 隐私网关 |
| kvm-meta | all | 元包 (依赖全部) |
依赖项目 (submodule)
| 路径 | 说明 |
|---|---|
deps/KVM |
KVM-over-IP 核心 (Go + React + C 视频管道) |
deps/embedding |
mem-bridge 记忆服务与 AI 路由 (Python) |
deps/info-privacy-rs |
Rust/RKNN PII 检测脱敏引擎 |
快速部署
# 克隆
git clone --recurse-submodules http://edge-stack.synology.me:3000/qiurui/KVM-privacy.git
cd KVM-privacy
# 构建 kvm-server deb 包
cd deps/KVM && PATH="/usr/local/go/bin:$PATH" bash scripts/build-deb.sh
# 构建 Python deb 包
bash scripts/build-python-debs.sh
# 部署到目标设备
scp build/deb/*.deb pi@192.168.123.181:/tmp/
ssh pi@192.168.123.181 'sudo dpkg -i /tmp/kvm-*.deb && sudo apt-get install -f'
# 查看服务状态
ssh pi@192.168.123.181 'systemctl status kvm-server kvm-agent info-privacy'