From 9f82c136e999552b13951936ca0244b25d13deb4 Mon Sep 17 00:00:00 2001
From: Hyperling <me@hyperling.com>
Date: Sat, 17 Oct 2026 13:08:50 -0700
Subject: [PATCH] llm, add open-terminal as a test bed for Open WebUI LLMs, so
 that they can read/write files and execute commands in a safe way.

---
 tasks/workstation/linux/software/llm.yml | 97 +++++++++++++++++++++++-
 1 file changed, 96 insertions(+), 1 deletion(-)

diff --git a/tasks/workstation/linux/software/llm.yml b/tasks/workstation/linux/software/llm.yml
index e1b4f4b..4bdf581 100644
--- a/tasks/workstation/linux/software/llm.yml
+++ b/tasks/workstation/linux/software/llm.yml
@@ -45,6 +45,10 @@
         - open_webui_key
         - codium_config
         - qwen_code_enabled
+        - qwen_code_key
+        - open_terminal_enabled
+        - open_terminal_port
+        - open_terminal_key
 
     - name: Workstation | Linux | Software | LLMs | Facts 01
       ansible.builtin.set_fact:
@@ -443,7 +447,6 @@
                 {{ ("-e HF_TOKEN=" ~ hf_token) if hf_token else '' }} \
                 -e WEBUI_SECRET_KEY={{ open_webui_key }} \
                 -v open-webui:/app/backend/data \
-                -v {{ user_user.home }}/Code:{{ user_user.home }}/Code \
                 ghcr.io/open-webui/open-webui:main
 
                 # Unsure why this was not working on Artix with runit.
@@ -498,6 +501,96 @@
 
         # Open WebUI - End #
 
+        # Open Terminal - Start #
+
+        - name: Workstation | Linux | Software | LLMs | runit | open-terminal | Dir | /etc/sv
+          ansible.builtin.file:
+            name: "/etc/sv/open-terminal/log"
+            state: directory
+            owner: root
+            mode: "0755"
+
+        - name: Workstation | Linux | Software | LLMs | runit | open-terminal | Dir | /var/log
+          ansible.builtin.file:
+            name: "/var/log/open-terminal"
+            state: directory
+            owner: "{{ user }}"
+            mode: "0755"
+
+        - name: Workstation | Linux | Software | LLMs | runit | open-terminal | Script | Run
+          ansible.builtin.copy:
+            dest: /etc/sv/open-terminal/run
+            content: |
+              #!/bin/sh
+              exec 2>&1
+
+              # Wait for Docker to start up.
+
+              while [ ! -S /var/run/docker.sock ]; do sleep 1; done
+
+              # Ensure the old container is gone.
+
+              echo "RUN: Stopping..."
+              docker stop open-terminal &&
+                echo "RUN: Container stopped" ||
+                echo "RUN: Container already stopped."
+
+              echo "RUN: Deleting..."
+              docker rm -f open-terminal &&
+                echo "RUN: Container deleted" ||
+                echo "RUN: Container already deleted."
+
+              # Start the open-terminal program.
+
+              set -e
+              exec docker run \
+                --pull=always \
+                --name open-terminal \
+                --network=host -p {{ open_terminal_port }}:8000 \
+                -v open-terminal:/home/user \
+                -v {{ user_user.home }}/Code:/home/user/Code \
+                -e OPEN_TERMINAL_API_KEY={{ open_terminal_key }} \
+                ghcr.io/open-webui/open-terminal
+            mode: "0755"
+
+        - name: Workstation | Linux | Software | LLMs | runit | open-terminal | Script | Finish
+          ansible.builtin.copy:
+            dest: /etc/sv/open-terminal/finish
+            content: |
+              {{ runit_finish_sleep }}
+
+              echo "FINISH: Stopping..."
+              docker stop open-terminal &&
+                echo "FINISH: Container stopped" ||
+                echo "FINISH: Container already stopped."
+
+              echo "FINISH: Deleting..."
+              docker rm -f open-terminal &&
+                echo "FINISH: Container deleted" ||
+                echo "FINISH: Container already deleted."
+
+              echo "FINISH: Done!"
+            mode: "0755"
+
+        - name: Workstation | Linux | Software | LLMs | runit | open-terminal | Script | Log
+          ansible.builtin.copy:
+            dest: /etc/sv/open-terminal/log/run
+            content: |
+              #!/bin/sh -e
+              exec svlogd -tt /var/log/open-terminal
+            mode: "0755"
+
+        - name: Workstation | Linux | Software | LLMs | runit | open-terminal | Script | Log Config
+          ansible.builtin.copy:
+            dest: /var/log/open-terminal/config
+            content: |
+              s1000000                     # rotate at 1 MB
+              n5                           # keep 5 old files
+              dateformat %Y-%m-%d_%H-%M-%S # each run gets its own file.
+            mode: "0755"
+
+        # Open Terminal - End #
+
         # Swap Stopper - Start #
 
         - name: Workstation | Linux | Software | LLMs | runit | swap-stopper | Script | Executable
@@ -621,6 +714,7 @@
         - { 'name': "{{ zeroclaw }}" , 'status': "{{ zeroclaw_enabled }}"   }
         - { 'name': 'docker'         , 'status': true                       }
         - { 'name': 'open-webui'     , 'status': "{{ open_webui_enabled }}" }
+        - { 'name': 'open-terminal'  , 'status': "{{ open_terminal_enabled }}" }
         - { 'name': 'swap-stopper'   , 'status': true                       }
         - { 'name': '{{ qwen_code }}', 'status': "{{ qwen_code_enabled }}"  }
 
@@ -648,6 +742,7 @@
       loop:
         - "{{ 'http://127.0.0.1:42617/health' if zeroclaw_enabled else dummy_website }}"
         - "{{ 'http://127.0.0.1:' ~ open_webui_port ~ '/health' if open_webui_enabled else dummy_website }}"
+        - "{{ 'http://127.0.0.1:' ~ open_terminal_port ~ '/health' if open_terminal_enabled else dummy_website }}"
         - "{{ 'http://127.0.0.1:4170' if qwen_code_enabled else dummy_website }}"
       ignore_errors: true