Transcription
This new AI agent amassed over 60,000 stars on GitHub in only three days. The internet is going crazy over cloudbots and everybody seems to be buying Mac minis, probably because you can easily run local AI models on the neural engine in the Apple silicon chips.
But as home labbers, of course, we already have a server sitting at home. So I looked into what it takes to set up Cloudbot on Proxmox. But first, what makes Cloudbot different? I have to be honest, I was a bit skeptical at first because nowadays you read about new AI tools and agents [music] and chatbots every other week, but I think I can show you with an example.
So, if I were to ask Chat GPT [music] to check my disk space, it's just going to come back to us with some random commands. It doesn't even know what system we're running on or what environment it's running in. But as you will see in a minute, Cloudbot is not only aware of that, but can do much more. All right. Yeah, this is awesome.
Cloudbot has shell access on your system. It has [music] access to your file system. It has persistent memories between sessions. [music] You can connect it with many different chat applications or voice agents or web interfaces. You can even [music] extend it with many skills and plugins. So yeah, it's very powerful and that's exactly why we need to be careful. This security researcher found hundreds of Cloudbot gateways exposed to the internet without any form of authentication. And yes, these are AI agents with shell access open to anyone. Let's not be one of those people.
I'm going to go through this step by step and I will explain every security decision that I've made along the way. I'm going to create a new virtual machine and I'll call it cloudbot. For the operating system, [music] I'm choosing Ubuntu 24. Now, this is our first security decision. I'm choosing to create a virtual machine and not an LXC container. So typically I like to use LXC containers because they're very lightweight and one of the reasons that they are lightweight is that they share the kernel with the host system. Now, in the event if Cloudbot might get compromised in an LXC container, they might be able to reach the host system Proxmox and if that happens, we'll be in a bad place. Virtual machines have hypervisor isolation, which means that if an attacker gets through and [music] owns the VM, we can just delete it and move on. In this way, our Proxmox host stays safe.
So I'll mostly be [music] using the defaults here, but I do want a modern chipset. We need the QEMU agent. 32 gigs is fine. Let's do a couple of cores. And I want the host type, which means we'll get all the CPU features. We can use a bit more memory. And definitely don't want to balloon this since Cloudbot is a node package. Um, you never know what it's going to pull in and how much memory it's going to use. So, let's just be safe here. And this is all good. Great. We have our installer here. Just going to go ahead.
Now, I'm using pretty much all of the uh defaults for Ubuntu. Now, this is the only thing that's noteworthy. Actually, I'm installing the OpenSSH server because, well, the console in this browser is not ideal and I want to be able to use my own terminal later. Great. Our system is running, which means I should be able to connect to it from my terminal. So I managed to SSH into my machine. And first things first, let's perform some updates, especially uh those juicy security packages.
Our next security decision is to create a dedicated Cloudbot user on the system. We definitely do not want to use the root user here. If something goes wrong, the attacker will essentially be stuck in this user sandbox environment. So, let's switch to the cloudbot user. And there was one gotcha that I found when I tried this first, and that is that the service didn't start without exporting the current user ID [music] into this environment variable.
Now, Cloudbot is indeed a node package and it pulls in all its dependencies and the skills that you add and the plugins as node dependencies as well. So, in order to give the node compiler a bit more breathing room, I will add a swap file just to make sure that the compilation succeeds. All right, that looks good. Time to install Cloudbot. But first, we need to install Node. I'm just adding the repository here and then going to install NodeJS. That was quick. Now, time to install Cloudbot globally. So we have Cloudbot installed and I will be using Telegram to interact with it. So before I start the Cloudbot configuration, I need to set up a bot for Telegram, which will only take a minute. Cloudbot. All right. And so we have our um API token here. Of course, we need to copy that for the configuration later. We also need to set the privacy settings um and disable the group privacy, and this will allow the bot to read all the messages and not just mentions to us. We also need your user ID from Telegram, and for that we can use the user info bot. So I'm just copying that one as well. Cloudbot is installed and our Telegram bot is ready. So now we can configure everything. And thankfully Cloudbot comes with a really nice onboarding wizard.
I'm choosing the manual configuration and I'll be using my Anthropic API key. Of course, we're using Opus 4.5. And this is another key security decision. The loopback option for the gateway binds will make sure it's only accessible from within the virtual machine. [music] So, no ports opened to the network nor the internet. H without open ports to the internet, how does Cloudbot actually receive messages? Well, that's a good question. Cloudbot doesn't exactly sit and wait for new messages to come in. Instead, it polls the services of the clients, or Telegram in our case, every few seconds for new messages. So every few seconds, it will reach out to the Telegram servers to ask for new messages. So whenever I send a message through the Telegram app, the Telegram app will send it to the Telegram server, and instead of having the server send it to our Cloudbot instance, Cloudbot actually keeps asking for messages. So it's all outgoing requests instead of incoming.
So at this point, I'll only be using this server locally. Um, so I'm not going to be adding Tailscale. Yes, we want the Telegram app. Now, this is taking a minute. I assume it's pulling in some packages and compiling them. Right. So, this is the [music] token that we saved from before. I'm not setting any up. Um, I'm not setting up any others right now. And we do want a default of pairing. I'll actually skip the skills and hooks for now. And it seems to report that the system user services are unavailable. I guess we can do that ourselves. Cool. The onboarding completed and Cloudbot is configured. But I did get a weird message about the service not being available at the end. And without this, I don't think Cloudbot will be available once we log out or reboot the server. So I will set up that service manually. So this should keep the service running after log out and this should create the system daemon. Yep. Now, just let's just enable them and let's see the current status. Whoops. Yeah, looks great.
Cloudbot comes with a built-in security audit. So, that's pretty cool. I'm going to run that now. All right. So, all right. This one is not important to me at this point since we're only using it locally. But I had this earlier, too. I think there is a bug in the install script since the token was not created. Um, actually, let me configure that manually. Yeah. Um, this is what we did initially, right? And it used to be blank. Um, but clearly it didn't generate anything. Now it does. So that seems [music] better. Let's try that audit again. Right. So, we fixed one. There's something about the permissions. Actually, Cloudbot should be able to fix that itself. Great. So, I think we're in a good place.
One more layer of security is the pairing mechanism that the Cloudbot uses with integrations such as Telegram. And by default, a Telegram bot, if you know the username, anybody can essentially message it. But thankfully, Cloudbot won't immediately respond to them or allow them to take any actions. Instead, they'll be sent a pairing code, and we'll use that pairing code and enter it in our terminal on our server to approve them. Okay, so I found my bot, and all right, immediately we got our pairing code right here. Okay, let's see if this works. Hi there. Um, Who are you? Okay. Okay. Um, okay. Great. Yeah, I'm not used to this.
Typically, when you ask an AI agent what the current date is, it will come up with some weird date from like last year or January 24 or something, I suppose, when the model was created. But this actually proves that Cloudbot knows the environment it's operating in, [music] which is a Linux server in the UTC time zone. But yeah, let's try something more interesting. Give me a nicely formatted overview of this server. Think CPU, memory, and disk usage. Well, I meant to say server, but let's see what it's all right. Yeah, that seems uh pretty cool. So, what are the largest files since the disk is getting up there? So, it knows what server we are talking about. And yeah, this is pretty cool. So it actually retains [music] the context of the uh like the previous messages. It knows what what I'm referring to. And yeah, of course, the npm cache is quite large, but I guess I messed up something with the swap files in the installation. Okay, let's try something dangerous. Yes, clean up the npm cache. All right. Yeah, this is awesome. Uh, let's try to access the internet. This is so much fun. All right. Um, I guess I'm making a video about Cloudbot, but it's called Moldbot now. Um, I found out just in time. Oh, man. This is hilarious.
So, yeah, this is I'm so excited. This is what makes um Moldbot, I suppose I should say, so different from other AI chatbots. We built an AI agent that's hosted on our own server and it's an actual agent. It can do things. It's not an AI chatbot, and we can access it from anywhere on our phone, and we did it securely. We have a virtual machine that's isolated by the hypervisor instead of an LXC. We have a dedicated user sandbox. The gateway is bound to the localhost, so only outgoing connections. And we [music] have a pairing process for new users. So with all of this, we're not one of those hundreds of users that expose their instance to the internet.
So I've worked with AI tools intensively over the past few years, and there have been these instances where I feel like, okay, this is different. Something is going on here. And this definitely feels like one of those moments. I mean, just the fact that it's able to figure out that itself rebranded by reading the Hackernews headlines is pretty funny. But apart from that, there are so many interfaces to this tool already. You can use [music] any chat app imaginable to connect with it. I'm just using Telegram because it's quite easy to set up. And right now I am using my Anthropic API key, but with Ollama, you can actually use your own local model, and that just sounds perfect to me. So I'll be exploring that and I can't wait to try out these skills to build cool home automations and other crazy workflows. So do subscribe if you want to see more. Thanks for watching.