New features for local LLM stack: web search and pipelines for Open WebUI, Qdrant vector database

.coderabbit.yaml

@@ -0,0 +1,102 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+# https://docs.coderabbit.ai/getting-started/configure-coderabbit/
+
+language: en-US
+tone_instructions: ''
+early_access: true
+enable_free_tier: true
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  high_level_summary_placeholder: '@coderabbitai summary'
+  auto_title_placeholder: '@coderabbitai'
+  auto_title_instructions: ''
+  review_status: true
+  commit_status: true
+  collapse_walkthrough: false
+  changed_files_summary: true
+  sequence_diagrams: true
+  assess_linked_issues: true
+  related_issues: true
+  related_prs: true
+  suggested_labels: true
+  auto_apply_labels: false
+  suggested_reviewers: true
+  poem: false
+  labeling_instructions: []
+  path_filters: []
+  path_instructions: []
+  abort_on_close: true
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    ignore_title_keywords: []
+    labels: []
+    drafts: false
+    base_branches: []
+  tools:
+    shellcheck:
+      enabled: true
+    ruff:
+      enabled: true
+    markdownlint:
+      enabled: true
+    github-checks:
+      enabled: true
+      timeout_ms: 90000
+    languagetool:
+      enabled: true
+      enabled_only: false
+      level: default
+    biome:
+      enabled: true
+    hadolint:
+      enabled: true
+    swiftlint:
+      enabled: true
+    phpstan:
+      enabled: true
+      level: default
+    golangci-lint:
+      enabled: true
+    yamllint:
+      enabled: true
+    gitleaks:
+      enabled: true
+    checkov:
+      enabled: true
+    detekt:
+      enabled: true
+    eslint:
+      enabled: true
+    rubocop:
+      enabled: true
+    buf:
+      enabled: true
+    regal:
+      enabled: true
+    actionlint:
+      enabled: true
+    pmd:
+      enabled: true
+    cppcheck:
+      enabled: true
+    semgrep:
+      enabled: true
+    circleci:
+      enabled: true
+chat:
+  auto_reply: true
+knowledge_base:
+  opt_out: false
+  learnings:
+    scope: auto
+  issues:
+    scope: auto
+  jira:
+    project_keys: []
+  linear:
+    team_keys: []
+  pull_requests:
+    scope: auto

README.md

@@ -17,6 +17,7 @@ This repository contains the Infrastructure as Code (IaC) configuration and docu
   - [Cloud Services (External Dependencies)](#cloud-services-external-dependencies)
 - [Getting Started](#getting-started)
 - [Development](#development)
+  - [GitHub automations](#github-automations)
 - [EOL](#eol)
 
 ## Principles
@@ -77,7 +78,20 @@ Perform the checks by running `task lint` (or `pre-commit run --all-files`).
 
 Create/update example `.env` files: `task docker:create-example-env`.
 
-Updating the container images is automated with [Renovate](https://docs.renovatebot.com/).
+### GitHub automations
+
+- Workflows configured (see in [`.github/workflows`](.github/workflows)):
+  - [Pre-commit checks](.github/workflows/pre-commit.yml)
+  - [Build dev & admin container](.github/workflows/devcontainer.yml)
+  - [Build and deploy documentation site](.github/workflows/docs-web.yml)
+- Updating the container images and other components is automated with [Renovate](https://docs.renovatebot.com/)
+  - [GitHub Marketplace App](https://github.com/marketplace/renovate)
+  - Configured with [`renovate.json`](renovate.json)
+  - Free for public and private repositories
+- AI Code Review for MRs is done with [Code Rabbit](https://www.coderabbit.ai/)
+  - [GitHub Marketplace App](https://github.com/marketplace/coderabbitai)
+  - Configured with [`.coderabbit.yaml`](.coderabbit.yaml)
+  - Free for public repositories
 
 ## EOL
 

Taskfile.yaml

@@ -7,9 +7,10 @@ version: '3'
 includes:
   ansible: ./ansible/Taskfile.ansible.yaml
   docker: ./docker/Taskfile.docker.yaml
+  app: ./docker/Taskfile.apps.yaml
+  crowdsec: ./docker/security/Taskfile.crowdsec.yaml
   docs: ./docs/web/Taskfile.web.yaml
   devcontainer: ./.devcontainer/Taskfile.dev.yaml
-  crowdsec: ./docker/security/Taskfile.crowdsec.yaml
 
 tasks:
   default:

config-example/docker/myhost/.env

@@ -1,6 +1,7 @@
 # Host-specific Docker Compose environment variables
 
-# Storage - Located on main node
+### Storage - Located on main node
+
 STORAGE_ALL=/mnt
 STORAGE_LOCAL=/mnt/local/storage
 STORAGE_LOCAL_MEDIA=${STORAGE_LOCAL}/media
@@ -14,7 +15,8 @@ DOCKER_VOLUMES=${STORAGE_LOCAL}/docker-volumes
 BEES_BTRFS_UUID=96c03041-7dde-48b4-8cc1-3f72e18e1bd2
 BEES_DB_SIZE=1073741824 # 1 GiB
 
-# Storage - Located on NAS
+### Storage - Located on NAS
+
 STORAGE_NAS=/mnt/nas
 STORAGE_DOWNLOADS=${STORAGE_NAS}/downloads
 STORAGE_TORRENT_DOWNLOADS=${STORAGE_NAS}/downloads/torrent-downloads
@@ -23,13 +25,13 @@ STORAGE_MEDIA=${STORAGE_NAS}/media
 STORAGE_FAMILYMEDIA=${STORAGE_NAS}/family-media
 STORAGE_BACKUP_ON_NAS=${STORAGE_NAS}/backup
 
-# For Homepage
+### For Homepage
 
 LOCATION_CITY=Greenwich
 LOCATION_LATITUDE=51.48
 LOCATION_LONGITUDE=0.00
 
-# Local accounts
+### Local accounts
 
 KOPIA_B2_REPOSITORY_PASSWORD="use-some-very-secure-value-here"
 KOPIA_NAS_REPOSITORY_PASSWORD="use-some-very-secure-value-here"
@@ -52,14 +54,30 @@ AUTHELIA_ADMIN_PASSWORD="use-some-very-secure-value-here"
 # Generate key within the crowdsec container: cscli bouncers add traefik-bouncer
 CROWDSEC_BOUNCER_API_KEY="use-some-very-secure-value-here"
 
-# Cloud accounts
-
 # Use a local account that has at least read privileges. Local account can be created on the Legacy Interface.
 # To temporally switch to the old interface: Settings -> System -> Legacy Interface -> Enable
 # Then create the user on Settings -> Admins
 UNIFI_LOCAL_VIEWONLY_USERNAME="viewonly"
 UNIFI_LOCAL_VIEWONLY_PASSWORD="use-some-very-secure-value-here"
 
+# Generate a secure random key (min 32 chars) using: `openssl rand -base64 32`
+OPEN_WEBUI_SECRET_KEY="use-some-very-secure-value-here"
+
+# Any random string
+SEARXNG_SECRET="use-some-very-secure-value-here"
+
+# Any random string
+QDRANT_API_KEY="use-some-very-secure-value-here"
+
+N8N_ENCRYPTION_KEY="use-some-very-secure-value-here"
+N8N_USER_MANAGEMENT_JWT_SECRET="use-some-very-secure-value-here"
+
+N8N_POSTGRES_USER="root"
+N8N_POSTGRES_PASSWORD="use-some-very-secure-value-here"
+N8N_POSTGRES_DB="n8n"
+
+### Cloud accounts
+
 CLOUDFLARE_DNS_API_TOKEN="use-some-very-secure-value-here"
 CLOUDFLARE_TUNNEL_TOKEN="use-some-very-secure-value-here"
 

config-example/docker/myhost/apply.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -e
 
+
+### Common code ###
+
 # shellcheck disable=SC2034,SC2046
 HOST_CONFIG_DIR=$(dirname $(realpath -s "$0"))
 
@@ -15,6 +18,9 @@ fi
 # shellcheck disable=SC1091
 source "${DOCKER_STACKS_DIR}/common.sh"
 
+
+### Host-specific configuration ###
+
 init "myhost"
 
 set +e
@@ -78,13 +84,18 @@ up tools vaultwarden
 up tools openspeedtest
 up tools cyberchef
 up tools guacamole
+up tools kasm
+up tools stirling-pdf
+up tools searxng
 
 # AI
 up ai ollama
-up ai open-webui
 up ai litellm
+up ai open-webui
+up ai open-webui-pipelines
 up ai autogenstudio
 up ai sillytavern
+up ai qdrant
 
 # Communication
 # down communication matrix-synapse
@@ -104,4 +115,7 @@ up arr flaresolverr
 # Personal
 up personal personal-web
 
+
+### Common code ###
+
 cleanup

docker/Taskfile.apps.yaml

@@ -0,0 +1,12 @@
+version: '3'
+
+tasks:
+  ollama-port-forward:
+    desc: Forward Ollama port
+    dotenv: ['config/docker/.env']
+    env:
+      REMOTE_PORT: 11444
+      LOCAL_PORT: 11434
+    cmds:
+      - echo "Forwarding remote port (${REMOTE_PORT}) to local Ollama port (${LOCAL_PORT}). Press Ctrl+C to to stop."
+      - ssh -N -o 'ExitOnForwardFailure yes' -R "*:${REMOTE_PORT}:localhost:${LOCAL_PORT}" ${ADMIN_USER}@${MAIN_NODE}

docker/Taskfile.docker.yaml

@@ -62,7 +62,7 @@ tasks:
     cmds:
       - scripts/create-example-env.py config/docker/.env > config-example/docker/.env
       - scripts/create-example-env.py config/docker/${MAIN_NODE}/.env > config-example/docker/myhost/.env
-      - cp config/docker/${MAIN_NODE}/apply.sh config-example/docker/myhost/apply.sh
+      - cat config/docker/${MAIN_NODE}/apply.sh | sed "s/${MAIN_NODE}/myhost/g" > config-example/docker/myhost/apply.sh
     sources:
       - config/docker/**/.env
       - config/docker/**/apply.sh

docker/ai/README.md

@@ -31,9 +31,9 @@ Man sshd -> `GatewayPorts`:
 > The argument may be no to force remote port forwardings to be available to the local host only, yes to force remote port forwardings to bind to the wildcard address, or clientspecified to allow the client to select the address to which the forwarding is bound.
 > The default is no.
 
-My usage:
+Task to start port forwarding (execute on the machine hosting Ollama):
 ```sh
-ssh -N -o 'ExitOnForwardFailure yes' -R "*:11444:localhost:11434" buba@nest
+task app:ollama-port-forward
 ```
 
 ### Access Ollama with OpenAI compatible API

docker/ai/litellm/config.yaml

@@ -1,18 +1,38 @@
+# LiteLLM supports all the text / chat / vision models from OpenRouter
+# https://docs.litellm.ai/docs/providers/openrouter
+# https://openrouter.ai/models
+#
+# LiteLLM supports all anthropic models
+# https://docs.litellm.ai/docs/providers/anthropic
+# https://docs.anthropic.com/en/docs/about-claude/models
+#
+# LiteLLM supports all models from Ollama
+# https://docs.litellm.ai/docs/providers/ollama
+# https://github.com/ollama/ollama
+
+---
 model_list:
   - model_name: claude-3-5-sonnet # RECEIVED MODEL NAME
     litellm_params: # All params accepted by litellm.completion() - https://docs.litellm.ai/docs/completion/input
-      model: claude-3-5-sonnet-20240620 # MODEL NAME sent to `litellm.completion()`
+      model: anthropic/claude-3-5-sonnet-latest # MODEL NAME sent to `litellm.completion()`
       api_key: "os.environ/ANTHROPIC_API_KEY" # Does os.getenv("ANTHROPIC_API_KEY")
 
+  - model_name: gpt-4o
+    litellm_params:
+      model: openrouter/openai/gpt-4o-2024-11-20
+      api_key: "os.environ/OPENROUTER_API_KEY"
+
   - model_name: ollama-local-phi
     litellm_params:
       model: ollama_chat/phi3.5:3.8b
       api_base: "os.environ/LOCAL_OLLAMA_API_BASE"
+      api_key: "none"
 
   - model_name: ollama-mac-mistral
     litellm_params:
       model: ollama_chat/mistral:7b-instruct
       api_base: "os.environ/REMOTE_OLLAMA_API_BASE"
+      api_key: "none"
 
 router_settings:
   fallbacks:

docker/ai/ollama.yaml

@@ -28,7 +28,6 @@ services:
       traefik.enable: true
       traefik.http.routers.ollama.entrypoints: websecure
       traefik.http.routers.ollama.middlewares: https-local@file
-      traefik.http.routers.ollama.rule: Host(`ollama.${MYDOMAIN}`)
       traefik.http.services.ollama.loadbalancer.server.port: 11434
       homepage.group: AI
       homepage.name: "Ollama"

docker/ai/open-webui-pipelines.yaml

@@ -0,0 +1,33 @@
+# Pipelines: Versatile, UI-Agnostic OpenAI-Compatible Plugin Framework
+#
+# > Welcome to Pipelines, an Open WebUI initiative. Pipelines bring modular, customizable workflows to any UI client supporting OpenAI API specs – and much more!
+# > Easily extend functionalities, integrate unique logic, and create dynamic workflows with just a few lines of code.
+#
+# https://docs.openwebui.com/pipelines/
+# https://github.com/open-webui/pipelines
+---
+name: open-webui-pipelines
+services:
+  pipelines:
+    image: ghcr.io/open-webui/pipelines:main
+    container_name: open-webui-pipelines
+    restart: on-failure:10
+    volumes:
+      - ${DOCKER_VOLUMES}/open-webui-pipelines:/app/pipelines
+    networks:
+      - proxy
+    labels:
+      traefik.enable: true
+      traefik.http.routers.open-webui-pipelines.entrypoints: websecure
+      traefik.http.routers.open-webui-pipelines.middlewares: https-local@file
+      traefik.http.routers.open-webui-pipelines.rule: Host(`open-webui-pipelines.${MYDOMAIN}`)
+      traefik.http.services.open-webui-pipelines.loadbalancer.server.port: 9099
+      homepage.group: AI
+      homepage.name: "Open WebUI Pipelines"
+      homepage.icon: open-webui.png
+      homepage.href: https://open-webui-pipelines.${MYDOMAIN}/
+      homepage.description: "UI-Agnostic OpenAI API Plugin Framework"
+
+networks:
+  proxy:
+    external: true