chore: expose open-webui to sentinel

hosts/sire/guests/ai.nix

@@ -4,11 +4,9 @@ in {
   microvm.mem = 1024 * 16;
   microvm.vcpu = 20;
 
-  wireguard.proxy-home = {
-    client.via = "ward";
-    firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
-      config.services.open-webui.port
-    ];
+  wireguard.proxy-sentinel = {
+    client.via = "sentinel";
+    firewallRuleForNode.sentinel.allowedTCPPorts = [config.services.open-webui.port];
   };
 
   networking.firewall.allowedTCPPorts = [config.services.ollama.port];
@@ -42,7 +40,7 @@ in {
       WEBUI_AUTH = "False";
       ENABLE_SIGNUP = "False";
 
-      OLLAMA_BASE_URL = "http://localhgost:11434";
+      OLLAMA_BASE_URL = "http://localhost:11434";
       TRANSFORMERS_CACHE = "/var/lib/open-webui/.cache/huggingface";
 
       WEBUI_AUTH_TRUSTED_EMAIL_HEADER = "X-Email";
@@ -65,7 +63,7 @@ in {
         oauth2 = {
           enable = true;
           allowedGroups = ["access_openwebui"];
-          X-Email = "\${upstream_http_x_auth_request_email}@local";
+          X-Email = "\${upstream_http_x_auth_request_email}@${config.repo.secrets.global.domains.personal}";
         };
         # FIXME: refer to lan 192.168... and fd10:: via globals
         extraConfig = ''

hosts/ward/guests/adguardhome.nix

@@ -92,7 +92,6 @@ in {
           globals.services.influxdb.domain
           globals.services.loki.domain
           globals.services.paperless.domain
-          globals.services.open-webui.domain
           "home.${config.repo.secrets.global.domains.me}"
           "fritzbox.${config.repo.secrets.global.domains.me}"
         ];

secrets/rekeyed/sentinel/4cff83edc1d2b2ca516f8cb63fb06782-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA dgbLVhH6YDLeLmrOOasvIhuknfgfLOS+akmDka/tlC0
+Xjire4VON0/X6hdkBlGE0ithtaE5R+nV/O+wF7QHgrw
+-> rM_"d!6-grease ( Lrm6}R$' p-;N
+Wz7nuz35agyIS+Br7snkV3nmUAYT3bgwPTZTHBDHXeAwfvNSdaPovC9o8jNNrhuM
+zdPqY5p9E3ytlaosQ8Tqwff/GrrGb9TUUQ
+--- NgSDbER4QRFN2lbic7IuZKrcvi1ffJBuQrgcut6fsDc
+¨)`S9w˜˜Œ8ÛgJÃsvÐiâilî§Ïƒ	
+aŠÜ&©ãlª‚ßm*ÓÚ¶³$\“EÚÑ´ÇÁ?»ó72)ѹ*åòø˜9W

secrets/rekeyed/sire-ai/89b98207bb1577a81049b4ce319739bf-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 vhmDsA KWeO3Be+gkSPD9LfWvmcdlaYDAbFyRN4K7F7EfwqIgg
+cAFnWvJJ/G6dme0dl02J894/qArsqS0beqU+AzwD1+o
+-> #1V}iM=x-grease aa},EP2g
+WqXnjOoLDNOeW4gTnEvipyPvOA2/2PnDjf6vw13ReOlCSCgGYETdFJ5hrWyVhPbG
+zH/NWp8G21UgKUo
+--- EM6RpMXpWmiosw/Plq3LAYBeVMpcs9dsuufL/4buhGk
+�eÜ!IÃ
üDò¼€ÁS �b†]õ¹­î}Á”ŽÈj!µýö‹z®üã#{¸ö£ã¿{B@…öV܃“ÉÏÕjUÖŽƒªu¥Nˆ

secrets/rekeyed/sire-ai/b106bbbb9f3c987e555b49df7263512d-wireguard-proxy-sentinel-priv-sire-ai.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 vhmDsA BuD+lFk4AT6HbasiK2B/s548l/084zHr2TVfTOr/HxM
+hrDRQLYsv/2rMbHD7devlax1KPMooNtQXzm8O1L91FU
+-> @*7:rQ}e-grease n2 gUD +it{\z# M!{:.W-)
+HOSZdaDG5UrpLYhL0/w
+--- dzhayN6ZYK73imRCl22mEQlmKZig2RAfbRPECcQkLAg
+‰˜ÒGêgP '´ZÊ›W…à:.à—°Äl‘ž'”:)šä‹×*Z=Ú+!‹½è;ðKVäü溯‘=	Yþn)hI�cÈS=‡åccÒt