LLM-Box Secure — Hardened Private AI (Qwen3-8B, 152-FZ ready)

LLM-Box Secure is a private AI server with hardened security for organizations with elevated data-protection requirements (152-FZ, public sector, finance, healthcare). The ready-to-run image deploys in minutes; the model and your data stay inside your perimeter and run fully offline.

What’s inside:
— Qwen3-8B model (multilingual, strong Russian), an OpenAI-compatible API (/v1) and a web chat (Open WebUI);
— HTTPS by default (TLS): web chat and API are available only over an encrypted connection;
— audit log (auditd): logins, sudo actions and configuration changes are recorded;
— SSH brute-force protection (fail2ban), key-only access;
— firewall (ufw): only the required ports are open;
— network hardening (sysctl) and disabled web-interface telemetry.

Note: the image helps meet 152-FZ data-protection requirements but is not a certified information-security tool. If certification is required, use it as part of an attested infrastructure.

1. In Compute Cloud, create a VM from this image on an NVIDIA T4 platform (8 vCPU, 32 GB RAM), 60 GB boot disk.
2. Assign a static public IP (the HTTPS certificate is bound to it on first boot).
3. In the security group, open inbound ports: 22/TCP (SSH), 80/TCP and 443/TCP (HTTPS).
4. Add your SSH key when creating the VM.
5. After start, wait 2-5 minutes while the model loads into the GPU. Until then the web chat shows “No models” — this is normal.
6. Open https://<public IP>/ (self-signed certificate — confirm the warning in your browser). The first login creates the administrator.
   The web chat URL, API URL and the generated API key are shown in the SSH login banner (MOTD).

— Internal AI assistant for employees with no data sent to external services;
— processing of personal data inside a protected perimeter (helps meet 152-FZ);
— integration into corporate apps and bots via an OpenAI-compatible API;
— private work with documents, correspondence and drafts;
— a replacement for public cloud LLMs where data must not leave the perimeter.

Technical support: info@papadata.ru (replies on business days).
We help with deployment, configuring a trusted HTTPS certificate on your own domain, and API integration.