From 8b8e23602eaf5dc470dfd93c53c571d23a253694 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Wed, 21 Oct 2026 16:57:17 +0200
Subject: [PATCH] add upstream Ollama and Open WebUI Argo apps

---
 apps/ollama/values.yaml      |  73 ++++++++++++++++
 apps/open-webui/values.yaml  | 163 +++++++++++++++++++++++++++++++++++
 bootstrap/genai-project.yaml |  30 +++++++
 bootstrap/kustomization.yaml |   3 +
 bootstrap/ollama.yaml        |  30 +++++++
 bootstrap/open-webui.yaml    |  30 +++++++
 6 files changed, 329 insertions(+)
 create mode 100644 apps/ollama/values.yaml
 create mode 100644 apps/open-webui/values.yaml
 create mode 100644 bootstrap/genai-project.yaml
 create mode 100644 bootstrap/ollama.yaml
 create mode 100644 bootstrap/open-webui.yaml

diff --git a/apps/ollama/values.yaml b/apps/ollama/values.yaml
new file mode 100644
index 0000000..6db37d0
--- /dev/null
+++ b/apps/ollama/values.yaml
@@ -0,0 +1,73 @@
+fullnameOverride: ollama
+
+replicaCount: 1
+updateStrategy:
+  type: Recreate
+terminationGracePeriodSeconds: 60
+
+ollama:
+  port: 11434
+
+extraEnv:
+  - name: OLLAMA_KEEP_ALIVE
+    value: "-1"
+  - name: OLLAMA_LOAD_TIMEOUT
+    value: 20m
+  - name: OLLAMA_CONTEXT_LENGTH
+    value: "8192"
+  - name: OLLAMA_MAX_LOADED_MODELS
+    value: "2"
+  - name: OLLAMA_NUM_PARALLEL
+    value: "1"
+
+resources:
+  requests:
+    cpu: "2"
+    memory: 8Gi
+  limits:
+    memory: 96Gi
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault
+
+livenessProbe:
+  path: /api/tags
+  initialDelaySeconds: 0
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+readinessProbe:
+  path: /api/tags
+  initialDelaySeconds: 0
+  periodSeconds: 10
+  timeoutSeconds: 3
+  failureThreshold: 3
+
+persistentVolume:
+  enabled: true
+  existingClaim: ollama-models
+
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+affinity:
+  nodeAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        preference:
+          matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - arschrock
diff --git a/apps/open-webui/values.yaml b/apps/open-webui/values.yaml
new file mode 100644
index 0000000..b15129e
--- /dev/null
+++ b/apps/open-webui/values.yaml
@@ -0,0 +1,163 @@
+fullnameOverride: open-webui
+
+replicaCount: 1
+strategy:
+  type: Recreate
+workload:
+  kind: Deployment
+
+image:
+  # The newest upstream chart currently trails the already-running image.
+  # Remove this tag override when a chart includes Open WebUI 0.12.3 or newer.
+  tag: v0.12.3
+
+ollama:
+  enabled: false
+ollamaUrlsFromExtraEnv: true
+pipelines:
+  enabled: false
+tika:
+  enabled: false
+terminals:
+  enabled: false
+websocket:
+  enabled: true
+  manager: ""
+  redis:
+    enabled: false
+
+enableOpenaiApi: false
+
+sso:
+  enabled: true
+  enableSignup: true
+  mergeAccountsByEmail: false
+  oidc:
+    enabled: true
+    clientExistingSecret: open-webui-secrets
+    clientIdExistingSecretKey: OAUTH_CLIENT_ID
+    clientExistingSecretKey: OAUTH_CLIENT_SECRET
+    providerUrl: https://auth.brunner.ninja/application/o/ollama-chat/.well-known/openid-configuration
+    providerName: brunner.ninja Auth
+    scopes: openid email profile
+
+service:
+  type: ClusterIP
+  port: 80
+  containerPort: 8080
+
+ingress:
+  enabled: false
+
+persistence:
+  enabled: true
+  existingClaim: open-webui-data
+
+resources:
+  requests:
+    cpu: 250m
+    memory: 1Gi
+  limits:
+    cpu: "2"
+    memory: 4Gi
+
+startupProbe:
+  httpGet:
+    path: /health
+    port: http
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 60
+
+readinessProbe:
+  httpGet:
+    path: /health/db
+    port: http
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 6
+
+livenessProbe:
+  httpGet:
+    path: /health
+    port: http
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 3
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault
+
+extraEnvVars:
+  - name: WEBUI_SECRET_KEY
+    valueFrom:
+      secretKeyRef:
+        name: open-webui-secrets
+        key: WEBUI_SECRET_KEY
+  - name: WEBUI_NAME
+    value: brunner.ninja Chat
+  - name: WEBUI_URL
+    value: https://chat.brunner.ninja
+  - name: DEFAULT_MODEL_METADATA
+    value: '{"capabilities":{"builtin_tools":true,"web_search":true},"defaultFeatureIds":["web_search"]}'
+  - name: DEFAULT_MODEL_PARAMS
+    value: '{"function_calling":"native"}'
+  - name: CORS_ALLOW_ORIGIN
+    value: https://chat.brunner.ninja
+  - name: OLLAMA_BASE_URL
+    value: http://ollama:11434
+  - name: BYPASS_MODEL_ACCESS_CONTROL
+    value: "True"
+  - name: RAG_EMBEDDING_ENGINE
+    value: ollama
+  - name: RAG_EMBEDDING_MODEL
+    value: qwen3-embedding:0.6b
+  - name: RAG_EMBEDDING_BATCH_SIZE
+    value: "8"
+  - name: RAG_EMBEDDING_CONCURRENT_REQUESTS
+    value: "2"
+  - name: RAG_EMBEDDING_CONTENT_PREFIX
+    value: "search_document: "
+  - name: RAG_EMBEDDING_QUERY_PREFIX
+    value: "search_query: "
+  - name: RAG_FILE_MAX_SIZE
+    value: "100"
+  - name: RAG_FILE_MAX_COUNT
+    value: "20"
+  - name: ENABLE_KB_EXEC
+    value: "True"
+  - name: ENABLE_WEB_SEARCH
+    value: "True"
+  - name: WEB_SEARCH_ENGINE
+    value: duckduckgo
+  - name: WEB_SEARCH_RESULT_COUNT
+    value: "3"
+  - name: WEB_LOADER_CONCURRENT_REQUESTS
+    value: "3"
+  - name: WEB_FETCH_MAX_CONTENT_LENGTH
+    value: "30000"
+  - name: ENABLE_TITLE_GENERATION
+    value: "False"
+  - name: ENABLE_TAGS_GENERATION
+    value: "False"
+  - name: ENABLE_FOLLOW_UP_GENERATION
+    value: "False"
+  - name: ENABLE_LOGIN_FORM
+    value: "False"
+  - name: ENABLE_SIGNUP
+    value: "False"
+  - name: DEFAULT_USER_ROLE
+    value: user
+  - name: OPENID_REDIRECT_URI
+    value: https://chat.brunner.ninja/oauth/oidc/callback
+  - name: SCARF_NO_ANALYTICS
+    value: "true"
+  - name: DO_NOT_TRACK
+    value: "true"
+  - name: ANONYMIZED_TELEMETRY
+    value: "false"
diff --git a/bootstrap/genai-project.yaml b/bootstrap/genai-project.yaml
new file mode 100644
index 0000000..e36f030
--- /dev/null
+++ b/bootstrap/genai-project.yaml
@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: genai
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  description: Local Ollama, Open WebUI, and ComfyUI applications
+  sourceRepos:
+    - https://helm.otwld.com
+    - https://helm.openwebui.com
+    - https://brunner.ninja/charts
+    - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  destinations:
+    - namespace: ollama
+      server: https://kubernetes.default.svc
+  namespaceResourceWhitelist:
+    - group: ""
+      kind: ConfigMap
+    - group: ""
+      kind: PersistentVolumeClaim
+    - group: ""
+      kind: Pod
+    - group: ""
+      kind: Service
+    - group: ""
+      kind: ServiceAccount
+    - group: apps
+      kind: Deployment
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index 5a0b7be..9882961 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -73,6 +73,9 @@ resources:
 - minecraft-atm10.yaml
 - bitnami-helm-repo.yaml
 - minecraft-postgresql.yaml
+- genai-project.yaml
+- ollama.yaml
+- open-webui.yaml
 - quay-project.yaml
 - quay.yaml
 - nextcloud-project.yaml
diff --git a/bootstrap/ollama.yaml b/bootstrap/ollama.yaml
new file mode 100644
index 0000000..ce4f1bf
--- /dev/null
+++ b/bootstrap/ollama.yaml
@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ollama
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: genai
+  sources:
+    - repoURL: https://helm.otwld.com
+      chart: ollama
+      targetRevision: 1.90.0
+      helm:
+        releaseName: ollama
+        valueFiles:
+          - $values/apps/ollama/values.yaml
+    - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ollama
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
diff --git a/bootstrap/open-webui.yaml b/bootstrap/open-webui.yaml
new file mode 100644
index 0000000..6239105
--- /dev/null
+++ b/bootstrap/open-webui.yaml
@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: open-webui
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: genai
+  sources:
+    - repoURL: https://helm.openwebui.com
+      chart: open-webui
+      targetRevision: 17.0.0
+      helm:
+        releaseName: open-webui
+        valueFiles:
+          - $values/apps/open-webui/values.yaml
+    - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ollama
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false