Add Authentik OIDC login, ollama-auth LAN proxy, and asr/tts sidecar wiring

- open-webui: OIDC-only auth via Authentik (password/local login disabled),
  account linking by email
- ollama: GPU reservation, disable idle unload, read-only GGUF import mount
- ollama-auth: nginx bearer-token proxy in front of ollama for LAN access
- docker-compose.audio.yaml + docker-stack.sh: wrap base/gpu/audio compose
  files so asr/tts sidecars (../asr-server, ../tts-server) always come up
  together with the GPU override

docker-compose.yaml

@@ -2,11 +2,49 @@ services:
   ollama:
     volumes:
       - ollama:/root/.ollama
+      # Read-only mount for importing custom GGUF files (e.g. via `ollama create`)
+      - /home/brian-llm/models/gguf:/gguf-import:ro
     container_name: ollama
     pull_policy: always
     tty: true
     restart: unless-stopped
     image: ollama/ollama:${OLLAMA_DOCKER_TAG-latest}
+    environment:
+      # Never unload a loaded model on idle -- default is 5 minutes.
+      - 'OLLAMA_KEEP_ALIVE=-1'
+      - 'OLLAMA_NUM_PARALLEL=4'
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities: [gpu]
+    # No ports published here -- Ollama has no auth of its own, so LAN access
+    # goes through the ollama-auth proxy below instead. open-webui still
+    # reaches it directly over the internal docker network (see
+    # OLLAMA_BASE_URL), which doesn't need the token.
+
+  ollama-auth:
+    image: nginx:alpine
+    container_name: ollama-auth
+    restart: unless-stopped
+    depends_on:
+      - ollama
+    volumes:
+      - ./ollama-auth/default.conf.template:/etc/nginx/templates/default.conf.template:ro
+    environment:
+      - 'OLLAMA_AUTH_TOKEN=${OLLAMA_AUTH_TOKEN}'
+    ports:
+      # Reachable from the LAN directly; restrict to the LAN subnet with the
+      # host firewall (see ufw rules) as defense in depth, but the real
+      # boundary is now the Bearer token check in ollama-auth/default.conf.template.
+      # This is plain HTTP, so the token is readable by anything already on
+      # the LAN segment that can sniff traffic -- accepted here since the
+      # trust boundary is "the LAN subnet," not "the wire." Revisit with TLS
+      # if that assumption ever stops holding (untrusted/guest/IoT devices
+      # sharing this LAN, etc).
+      - '11434:11434'
 
   open-webui:
     build:
@@ -19,14 +57,59 @@ services:
     depends_on:
       - ollama
     ports:
-      - ${OPEN_WEBUI_PORT-3000}:8080
+      # Published on all interfaces since nginx runs on a separate LAN host
+      # (192.168.50.224) and must reach this port directly. Firewalling this
+      # to that host is still good hygiene (see ufw/DOCKER-USER notes) but is
+      # no longer the sole security boundary -- OIDC auth below is real
+      # authentication against Authentik regardless of network path.
+      - '${OPEN_WEBUI_PORT-3000}:8080'
     environment:
       - 'OLLAMA_BASE_URL=http://ollama:11434'
       - 'WEBUI_SECRET_KEY='
+      - 'DEFAULT_MODELS=gemma-4-e2b-mtp'
+      - 'ENABLE_OAUTH_SIGNUP=true'
+      # Links Authentik login to the existing local account with the same
+      # email instead of rejecting it as a collision -- safe here since this
+      # is a single-admin personal instance, not an open-signup multi-tenant one.
+      - 'OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true'
+      # Fill these in after creating the OAuth2/OpenID Provider + Application
+      # in Authentik (see instructions) -- OAUTH_CLIENT_ID/SECRET come from
+      # that provider.
+      - 'OAUTH_CLIENT_ID=${OAUTH_CLIENT_ID}'
+      - 'OAUTH_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}'
+      - 'OPENID_PROVIDER_URL=https://auth.hetherman.cloud/application/o/ai-open-webui/.well-known/openid-configuration'
+      - 'OPENID_REDIRECT_URI=https://ai.hetherman.cloud/oauth/oidc/callback'
+      - 'OAUTH_SCOPES=openid email profile'
+      # SSO-only: Authentik becomes the sole way to authenticate, admin
+      # included. If Authentik is ever unreachable, nobody can log in until
+      # it's fixed -- no local password fallback.
+      - 'ENABLE_PASSWORD_AUTH=false'
+      - 'ENABLE_LOGIN_FORM=false'
+      - 'ENABLE_SIGNUP=false'
     extra_hosts:
       - host.docker.internal:host-gateway
     restart: unless-stopped
 
+  # ollama-keepwarm:
+  #   image: curlimages/curl:latest
+  #   container_name: ollama-keepwarm
+  #   restart: unless-stopped
+  #   depends_on:
+  #     - ollama
+  #   # Pings Ollama every 60s to load the default model and refresh its
+  #   # keep_alive timer -- covers first boot and re-loads it any time the
+  #   # ollama container itself restarts (which flushes it from memory).
+  #   # Keep this model name in sync with DEFAULT_MODELS above.
+  #   entrypoint:
+  #     - sh
+  #     - -c
+  #     - |
+  #       while true; do
+  #         curl -s -o /dev/null -X POST http://ollama:11434/api/generate \
+  #           -d '{"model":"gemma-4-e2b","keep_alive":-1}'
+  #         sleep 60
+  #       done
+
 volumes:
   ollama: {}
   open-webui: {}