From 3072389561f580d8327bb547b840442e25aff44b Mon Sep 17 00:00:00 2001 From: Patrick Date: Sun, 9 Jun 2024 20:58:27 +0200 Subject: [PATCH] feat: open-webui host --- config/services/kanidm.nix | 3 ++ config/services/ollama.nix | 28 ++++++++++++++++-- .../elisabeth/secrets/kanidm/secrets.nix.age | Bin 2080 -> 2094 bytes .../elisabeth/keys/elisabeth-ollama.age | 16 ++++++++++ .../elisabeth/keys/elisabeth-ollama.pub | 1 + .../psks/elisabeth+elisabeth-ollama.age | 15 ++++++++++ 6 files changed, 60 insertions(+), 3 deletions(-) create mode 100644 secrets/wireguard/elisabeth/keys/elisabeth-ollama.age create mode 100644 secrets/wireguard/elisabeth/keys/elisabeth-ollama.pub create mode 100644 secrets/wireguard/elisabeth/psks/elisabeth+elisabeth-ollama.age diff --git a/config/services/kanidm.nix b/config/services/kanidm.nix index 408a38f..a491141 100644 --- a/config/services/kanidm.nix +++ b/config/services/kanidm.nix @@ -122,6 +122,7 @@ in { groups."rss.access" = {}; groups."firefly.access" = {}; + groups."ollama.access" = {}; groups."adguardhome.access" = { }; systems.oauth2.oauth2-proxy = { @@ -131,12 +132,14 @@ in { scopeMaps."adguardhome.access" = ["openid" "email" "profile"]; scopeMaps."rss.access" = ["openid" "email" "profile"]; scopeMaps."firefly.access" = ["openid" "email" "profile"]; + scopeMaps."ollama.access" = ["openid" "email" "profile"]; preferShortUsername = true; claimMaps.groups = { joinType = "array"; valuesByGroup."adguardhome.access" = ["adguardhome_access"]; valuesByGroup."rss.access" = ["ttrss_access"]; valuesByGroup."firefly.access" = ["firefly_access"]; + valuesByGroup."ollama.access" = ["ollama_access"]; }; }; diff --git a/config/services/ollama.nix b/config/services/ollama.nix index eafdf7b..006a2c9 100644 --- a/config/services/ollama.nix +++ b/config/services/ollama.nix @@ -1,10 +1,32 @@ -{ - networking.firewall.allowedTCPPorts = [11434]; +{config, ...}: { + wireguard.elisabeth = { + client.via = "elisabeth"; + firewallRuleForNode.elisabeth.allowedTCPPorts = [config.services.open-webui.port]; + }; + networking.firewall.allowedTCPPorts = [config.services.open-webui.port]; services.ollama = { - listenAddress = "0.0.0.0:11434"; + host = "localhost"; + port = 3001; enable = true; }; + services.open-webui = { + host = "0.0.0.0"; + port = 3000; + enable = true; + environment = { + OLLAMA_BASE_URL = "http://localhost:3001"; + ANONYMIZED_TELEMETRY = "False"; + DO_NOT_TRACK = "True"; + SCARF_NO_ANALYTICS = "True"; + TRANSFORMERS_CACHE = "/var/lib/open-webui/cache/huggingface"; + WEBUI_AUTH_TRUSTED_EMAIL_HEADER = "X-Email"; + }; + }; environment.persistence."/state".directories = [ + { + directory = "/var/lib/private/open-webui"; + mode = "0700"; + } { directory = "/var/lib/private/ollama"; mode = "0700"; diff --git a/hosts/elisabeth/secrets/kanidm/secrets.nix.age b/hosts/elisabeth/secrets/kanidm/secrets.nix.age index 8144c569a82404713c84688730c620d6a74fae43..9ed0d2b78ad0fe0207b545a0ea88a8e30ffde2e3 100644 GIT binary patch delta 2068 zcmY+<`9Bnh0s!z-tVTtSY88!;5ObOtD>SDWa~O=dWHa}ed&XR*G@`JSqYII3S44~L z+R(1vqehAjN72el$LJ}wAE_m)?C1UPe%Qa@`}v-6YjrCFT48h~3PU2&RV=h#q@tMd z$qcbLMT#V=VKNpA9-k5^V=^MOU=lPFkU&*P^vNir0nLKxBUOAU0hB0C;FA&(_(G0B z&P65DlHx^BC4vqHgv9_g8OAUTGy(zS5+oTU6A-O67{LrGn1M3z41A=PDrLZ}aeNhVNrx6jE)b`Vk3kQt|gHrkxO*GW+6?E<*3<2 z9)}A)(WOMF z%AyaI7&S66feOe_A-Q6_Mt~BDBSJ~~II>bK0a48wsxZ@}HVI5|U>$@kGm+!i@c%{j z7;s?{orsqy0-9vNfLI`b8iWN(0lX|02yPG~vAjr{6`>O)X-rrP6h$ z(9lejh6S+*(eX4g6{_MT#$k=BNTUX$RD%fseHPY4AxpVLUZRjGIS6KCK*{Oh3Jt z+G9V_%L`Uw&xYzH*0E3sP_f8}0=j#7WQl-Be%+f9jV_-%XfXd=z^nu_s)$e zmMRQ$V%Lc;L+EoyKx-tb%&wmz-nLAD<~G=uPFtp2o7}e0zPZC2*yE--`k%8wYH8U( zyL#!S+l*~0B?^;0FDt6>-dHp%KkGhHT)+{>V#sg&Jg#ggY`A${HLqLxg?Nsh zb0&v>1l3qQ_;PpfduH!o<15~!4VoKk8W`t)+}04Bza8Sp)4Z zJ6COu;vL|Od4JrdYVwK$tsm-K`$P6RUEaN&pA#glcdbRyb|-ib!-A;J*;bHVTb-R1 z;^Q88>}r))L))J5pl0{cS?}?(kO#%P8OxL*`&{OJQM?{l*HlyLgpF;i>n&PvTz;qe z5#A@f+;6+%4y@nIHNiN0Q7PPWGBw11o)A3WUHI+ZZ_t5ncOY~2!y9=S^12J3!A%!m z{FwcP5dOv*Giq0Sc-%g8-ZLlE{kDsL(f;c`6V0od8d|TGj6n@2PPjGZxXUicXop|# zZ+<+Zqvm>;=vux$Ks1%#^t5OG%GY^MnpXQMa`TXHYW-tv z0T-sNN%J1f=;7N};{3>QnmY`VP_s_+{TrTT0z;j{M{Y z;$IJ(Y4PtUoBy+Gw(h|F(M_Wu?-KKe=k@mf7h71g-?djqo*+!O91czRXI`yGRdk;W z-T97*IpCDrK7GZSeYi6fHaWQD>h4GCUAJ()R228q=qDnA;8FtrbAR#u&(aGqx1wttyaU~T`+0>s z$apgNEO+H2QQ8^*^2*CL;^&(En}c4Jw)x^et@YY_aE&Wo6gPtEW~DC<_1)*%NrN9g zUE?fRk>ba@YX9Y1lBh8qgG4{u`Z@D1*eE!(qQ0>8NpFip$lJ;ZPM-bH$YQ>I?6Yvh z^Ny$XR%gcG!b9IEDmT3a@HJ#0aPB?3##6p7`ks7qy_55#<1+S#Y3xl~5iq3;*f*5) zM{}R+=#Gf@55B)ox%KsMTA2E>0{uRuI=K{!lkJ1$OZ40Zm(tY!ud>qKv7Jv#H_ppr zI!8P{7N5wK4L;hyX+<9GX9b){rgq6NQ$M3CyvWOa?6Gm@p`)o%!_EE-dPkume5)yH k0x`MPUNy;?`J-pcwSCUZ+Wclm?b}h6hPi?YpyT_$0oJ~TIsgCw delta 2037 zcmVnNlP?mW?D`-aW7(dVrDO7S8Q=naaVFi zZ(>O>V+u8HXI5@hOjj>XS#DNPHBnV{ZbCRwcQ$xZSxZM%dPGioPdGPoMMG0FYYHts zAaH4REpRe5HXvA3QEOE}AVGFyFHmJ;bw@)*c1d|dGb?sYD@1QMR%2#ZI6`wsD|1j{ zQ)N|ALo0P~M`H?Fbxkj6QA2o7T1YT8F*S2jbWnL%WJhO7b}=<2 zOGT4U0Tq8UICgb8b5eIzadsDpK}>m6OG{=?a&bXPPD4csEj}P6A!;pWa%Ew2WgvD; zO)4N{FCb%fQ(|sS3RpBjMNKkIHFrvXHfwKUaCb;Dcv*8uSyD-JOGt7^QBPxaD>F-Z zOh!|AQ)W=cT!AvMngGRQe{qbV=qNbbWsW|EiE8PH(E+kWl(2$PGN6q5;D|1z4a%5sFZe=fQcQ-aqHFs4CE;_#ejd(F)Eu}1t@(>69$qFMr+Bu!^ z+p)m_T{Tvn$_-#1S8Ikt&vWtSUt_K*0+HomDbnMzaPz)_<{4I!<2PH03K^uVnVD?S z10FW7?0p0^V4^X35=_yzODCd#35tFVMFiK~9ND%K6SSo}e}(Q0KG={Y$1ASrsEj~} z|MRfYw$W9@xActa5Z&3^bstCRDF`Br`1!24*gJDq<{?W(%? zzk@z^?JkLQhbh$f(JV6zAm3r@12C#SZo-{Tn#ZrqfyLl#@Fo)5w7{K>maM77nhvo>A5$Z&TD&a`?-#M&F`)fXy%a0Iaq__q%}hvhN` zaFZFbL*3#v-^L@y&IQ$;)GUwJPQ_#0;PTO!K>K!O|}X;Dfj1!-15y{vxhAi*Jmc_@vS^TUlRe-uxaij?8C8FT_EYV zD)O$K$7uM;6BtN;!;7uHoTTv7z5fC_vNB`>6hr0`N=Mzz*&?aI_S;VquZ9a{-+g>_ zq@NvJ27ZIQ*QWGDnLT!}L!p3w(7OmH*Z0AXyGMx6aIq@b(;bZ$lNdfnOd1Cu{*v}? z9^2T(*smD6t6&;S4g%&yD%B7MJ^GRfdw4F|?UMl+TL>zD&@Ww&27LqRO^y5G^o&P< z0?0Vye)pHu99vp{5llaXEIMtdGLZcgb<|?DlnN1UXnkP>M0~Gs+fm=CtrKB=nP!7N=X5IKJHToj5nH7 z0zAOkfNsx*V@e=3Pys<(if|kL%&mE5^C>^ew|~t{%X`_g<9#zs*U%^k1NL zn7p@=kv26$KT2 zSzx(;LAp3M-CdCIMX!-I`j; T!)72yQ@C=&9oN5j4*h7 diff --git a/secrets/wireguard/elisabeth/keys/elisabeth-ollama.age b/secrets/wireguard/elisabeth/keys/elisabeth-ollama.age new file mode 100644 index 0000000..042fc85 --- /dev/null +++ b/secrets/wireguard/elisabeth/keys/elisabeth-ollama.age @@ -0,0 +1,16 @@ +age-encryption.org/v1 +-> X25519 Fpotjtu7lksK7LzYZTkTP7OXF2etf6k/jAs3qT63pyg +Az3CTRHiYmqI9mVSvt61WgbQa1Sw7tTI/GwuwGNm2Rk +-> piv-p256 ZFgiIw AwwKW8KYhA3dsUgANUxvffEiFLOadwllahNrchfzQTfq +AO08XTSUINWT5eY1EgPqHHSY/y0gsgszz3psNnGSauA +-> piv-p256 XTQkUA AuxujxLf1wM1siHqnkbayQ6C4KZbsAzdUO/8dsiTRohe +1AUfKkOngKRI4jPG820VihSIP5ms9jH8MvHlEBiwVAE +-> piv-p256 ZFgiIw AqLEvSEzM5D4K/W67DVz7icte3mw5+FqFtBiv4Ba2xua +mbrEOcAnkiXq1Phh1SlnTjDuhLma+4hqv8FMceymOzQ +-> piv-p256 5vmPtQ AzENFlgqOyGbU/FXskgenHamZs/H+78mS9PWsYoXXqae +pyx2IlIw+p+7dAUg5Ohj1cKxW/9S51LjR2A47aNgH0c +-> AJ/nN^^b-grease P%To4qn; llf1 (\|f~06 +ROV54+I9IMrCY2DvOXDRsY4otebllTMp6ddWYA +--- PGvDf7ZhjEQzcNDXVlDw4Qehrs/lg7hi22vu/2lo0N8 +{ryԝ_{f#ß`M}є<id=pbnE- +$th:;.9w \ No newline at end of file diff --git a/secrets/wireguard/elisabeth/keys/elisabeth-ollama.pub b/secrets/wireguard/elisabeth/keys/elisabeth-ollama.pub new file mode 100644 index 0000000..9010873 --- /dev/null +++ b/secrets/wireguard/elisabeth/keys/elisabeth-ollama.pub @@ -0,0 +1 @@ +wODUgMHl+qSCB8O1purynIY/AaPyIJ4kCFCEHmRedEk= diff --git a/secrets/wireguard/elisabeth/psks/elisabeth+elisabeth-ollama.age b/secrets/wireguard/elisabeth/psks/elisabeth+elisabeth-ollama.age new file mode 100644 index 0000000..8c7e563 --- /dev/null +++ b/secrets/wireguard/elisabeth/psks/elisabeth+elisabeth-ollama.age @@ -0,0 +1,15 @@ +age-encryption.org/v1 +-> X25519 809OJmSe9sRVNlpr7tsymq+N/N3RLwBggFHdew4p5lU +ef/ZzFm1aqytRapx0iZilQyT9O/xuA97plZbz5LL5O4 +-> piv-p256 ZFgiIw Aowpy6rEm9eHFxEmwJ35I10linQONgIS13H/Nm0fi+j9 +rRiW2Y2V5kpmdqGjN72EyKe9nf5fQS4UrUqZAtshkx8 +-> piv-p256 XTQkUA AtkeDTc+jaagxDYjzJrSsHZTCF3KxpSTMU2ZMxuoawDG +YDRFtbrl8QH5YHlTcBLBdxHzx+pqMXLtSSvd/FokSE4 +-> piv-p256 ZFgiIw ArgQyaNwkuKD1GVVGKmwcHq11pzcgGK9uJpvWFkQ1Zqy +Jvue35/d/2CKV6qcVZIW2Q+LUp67CpcMUapfJQGqh84 +-> piv-p256 5vmPtQ AjMLgWeCMKLwl3205anSTdwYfQ5HG2pmZH5UOU8fnhi5 +BL+6ZYMBuakv2PZCzcb/W8+UCgGryY/uA3Z0NdMxcc8 +-> :`n-grease Iq:z[/t( c6Ca. j FSx5@D? +uH1pwc6u0ytrAqS9cTXoD64rJBuosYo +--- 5BCa7IK4dbXfsXiqMnBHBmLR/qAXbbyqaVRiWun5KJ4 +eFsfBh`%8C;Qnَz$߅̻R$5sKlT \ No newline at end of file