基于Java + OpenClaw搭建本地大模型私有化的方案

# 拉取Qwen2.5 7B模型，中文场景吊打同体量
ollama pull qwen2.5:7b
# 后台运行，只监听本地（关键！）
OLLAMA_HOST=127.0.0.1:11434 ollama serve

curl http://localhost:11434/api/generate -d '{
"model": "qwen2.5:7b",
"prompt": "你好，请用一句话证明你是本地部署的AI"
}'

npm install -g @openclaw/cli

openclaw init --local-only

llm:
  provider: ollama
  model: qwen2.5:7b
  base_url: http://127.0.0.1:11434
security:
  sandbox_mode: strict  # 严格沙箱，禁止危险操作
  allowed_paths:
    - /opt/data/    # 只允许AI碰这个目录

org.springframework.boot
spring-boot-starter-web
org.springframework.ai
spring-ai-ollama-spring-boot-starter
1.0.0-M3

@Service
public class LocalLLMService {
    private final OllamaChatClient chatClient;
    public LocalLLMService(OllamaChatClient chatClient) {
        this.chatClient = chatClient;
    }
    public String chat(String message) {
        return chatClient.call(message);
    }
}

@RestController
@RequestMapping("/api/ai")
public class AIController {
    @Autowired
    private LocalLLMService llmService;

    @PostMapping("/chat")
    public ResponseEntity chat(@RequestBody ChatRequest request) {
        // 这里可以加企业级逻辑：权限校验、敏感词过滤、日志记录
        String response = llmService.chat(request.getMessage());
        return ResponseEntity.ok(response);
    }
}

@Service
public class OpenClawService {
    private final RestTemplate restTemplate = new RestTemplate();
    private static final String OPENCLAW_URL = "http://127.0.0.1:3000/api/execute";

    public String executeTask(String taskDescription) {
        Map request = new HashMap<>();
        request.put("task", taskDescription);
        request.put("context", "内网环境，只能访问/opt/data目录");
        
        ResponseEntity response = restTemplate.postForEntity(
            OPENCLAW_URL, request, String.class
        );
        
        return response.getBody();
    }
}

@PostMapping("/process-excel")
public String processExcel(@RequestParam String filePath) {
    String task = "读取" + filePath + "，统计第三列销售额总和，生成汇总报告保存到/opt/data/report.txt";
    return openClawService.executeTask(task);
}

@Service
public class PrivateRAGService {
    @Autowired
    private VectorStore vectorStore;

    public String queryWithContext(String question) {
        // 1. 向量化检索本地知识库
        List docs = vectorStore.similaritySearch(question);
        // 2. 组装Prompt
        String context = docs.stream().map(Document::getContent).collect(Collectors.joining("\n"));
        String prompt = "基于以下内部资料回答问题：\n" + context + "\n\n问题：" + question;

        // 3. 调用本地模型
        return llmService.chat(prompt);
    }
}

private String desensitize(String content) {
    return content.replaceAll("\\d{11}", "【手机号】")
           .replaceAll("\\d{18}", "【身份证】");
}

# 只允许特定IP段访问11434端口
iptables -A INPUT -p tcp --dport 11434 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 11434 -j DROP

@Aspect
@Component
public class AIAuditAspect {
    @AfterReturning(value = "@annotation(Auditable)", returning = "result")
    public void logAIInteraction(JoinPoint jp, Object result) {
        // 记录到数据库，留着查账
        auditLogService.save(new AIInteractionLog(jp.getArgs(), result));
    }
}

sandbox:
  type: chroot    # 类似Docker的隔离，但更轻量
  readonly_paths:
    - /etc/passwd # 想看用户列表？没门
    - /var/log    # 日志也不给看

ollama pull qwen2.5:7b-q4_K_M

@GetMapping("/stream-chat")
public Flux streamChat(String message) {
    return chatClient.stream(message)
           .flatMap(content -> Flux.just(content))
           .subscribeOn(Schedulers.boundedElastic());
}

@Cacheable(value = "aiResponse", key = "#message.hashCode()")
public String chat(String message) {
    return chatClient.call(message);
}

System.setProperty("file.encoding", "UTF-8");