feat: add ollama-webui, disable fucking dnssec until it works (never)

hosts/sire/guests/ai.nix

@@ -1,18 +1,80 @@
-{
+{config, ...}: let
+  openWebuiDomain = "chat.${config.repo.secrets.global.domains.me}";
+in {
   microvm.mem = 1024 * 16;
   microvm.vcpu = 20;
 
-  networking.firewall.allowedTCPPorts = [11434];
+  wireguard.proxy-home = {
+    client.via = "ward";
+    firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [
+      config.services.open-webui.port
+    ];
+  };
+
+  networking.firewall.allowedTCPPorts = [config.services.ollama.port];
 
   environment.persistence."/state".directories = [
     {
       directory = "/var/lib/private/ollama";
       mode = "0700";
     }
+    {
+      directory = "/var/lib/private/open-webui";
+      mode = "0700";
+    }
   ];
 
   services.ollama = {
     enable = true;
-    listenAddress = "0.0.0.0:11434";
+    host = "0.0.0.0";
+    port = 11434;
+  };
+
+  services.open-webui = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 11222;
+    environment = {
+      SCARF_NO_ANALYTICS = "True";
+      DO_NOT_TRACK = "True";
+      ANONYMIZED_TELEMETRY = "False";
+
+      WEBUI_AUTH = "False";
+      ENABLE_SIGNUP = "False";
+
+      OLLAMA_BASE_URL = "http://localhgost:11434";
+      TRANSFORMERS_CACHE = "/var/lib/open-webui/.cache/huggingface";
+    };
+  };
+
+  globals.services.open-webui.domain = openWebuiDomain;
+  nodes.ward-web-proxy = {
+    services.nginx = {
+      upstreams.open-webui = {
+        servers."${config.wireguard.proxy-home.ipv4}:${toString config.services.open-webui.port}" = {};
+        extraConfig = ''
+          zone open-webui 64k;
+          keepalive 2;
+        '';
+      };
+      virtualHosts.${openWebuiDomain} = {
+        forceSSL = true;
+        useACMEWildcardHost = true;
+        oauth2.enable = true;
+        oauth2.allowedGroups = ["access_openwebui"];
+        # FIXME: refer to lan 192.168... and fd10:: via globals
+        extraConfig = ''
+          client_max_body_size 512M;
+          allow 192.168.1.0/24;
+          allow fd10::/64;
+          deny all;
+        '';
+        locations."/" = {
+          proxyPass = "http://open-webui";
+          proxyWebsockets = true;
+          X-Frame-Options = "SAMEORIGIN";
+        };
+      };
+    };
   };
 }

hosts/ward/guests/adguardhome.nix

@@ -92,6 +92,7 @@ in {
           globals.services.influxdb.domain
           globals.services.loki.domain
           globals.services.paperless.domain
+          globals.services.open-webui.domain
           "home.${config.repo.secrets.global.domains.me}"
           "fritzbox.${config.repo.secrets.global.domains.me}"
         ];

hosts/ward/guests/kanidm.nix

@@ -174,7 +174,7 @@ in {
       # Web Sentinel
       groups."web-sentinel.access" = {};
       groups."web-sentinel.adguardhome" = {};
-      groups."web-sentinel.influxdb" = {};
+      groups."web-sentinel.openwebui" = {};
       systems.oauth2.web-sentinel = {
         displayName = "Web Sentinel";
         originUrl = "https://oauth2.${domains.me}/";
@@ -184,7 +184,7 @@ in {
         claimMaps.groups = {
           joinType = "array";
           valuesByGroup."web-sentinel.adguardhome" = ["access_adguardhome"];
-          valuesByGroup."web-sentinel.influxdb" = ["access_influxdb"];
+          valuesByGroup."web-sentinel.openwebui" = ["access_openwebui"];
         };
       };
     };

hosts/ward/kea.nix

@@ -41,6 +41,7 @@ in {
       ];
       subnet4 = [
         {
+          id = 1;
           interface = "lan-self";
           subnet = lanCidrv4;
           pools = [

hosts/zackbiene/kea.nix

@@ -29,6 +29,7 @@ in {
       };
       subnet4 = [
         {
+          id = 1;
           interface = "wlan1";
           subnet = iotCidrv4;
           pools = [