panel: remove the Ollama card and its controller entry

The local 14B model is not usable from this machine (8.25 tok/s prompt
processing; pi sends a 9,510-token agent prompt against a 4,096 context, so it
was truncated to 2,050 and still needed ~4 min before the first token). Nothing
about the panel was worth keeping for it.

- portal/tools.py: drop the 'Ollama Local LLM' tile (no other references remain)
- services.toml: drop the ollama allowlist entry; 8 services remain
- service_controller.py + docs: keep the generic 'systemd-system' kind but drop
  the ollama-specific wording and mark it as currently unused

Verified on .13: /api/services no longer lists ollama, the deployed tools.py has
0 ollama matches, the other 8 cards still report correctly, portal is healthy.

deploy/service-controller/service_controller.py

@@ -117,9 +117,9 @@ def _do(kind: str, action: str, target: str, remote: str | None = None) -> str:
                          (system units; `remote` sends it over ssh)
 
     `systemd-system` requires a NOPASSWD sudoers rule for that exact
-    command+argument on the target host. On .27 this is granted for
-    `systemctl start|stop|restart ollama` (see hosts/sam-4screen-desktop),
-    where `target` must match the rule verbatim: "ollama", not "ollama.service".
+    command+argument on the target host, and `target` must match the rule
+    verbatim (e.g. "foo", not "foo.service"). No service currently uses this
+    kind — it is kept as a tested capability.
 
     Note: sudo matches the *literal* PATH-resolved path, and NixOS puts a
     symlink (`/run/current-system/sw/bin/systemctl`) on PATH, so a bare

deploy/service-controller/services.toml

@@ -10,7 +10,8 @@
 #   systemd-system  -> sudo -n systemctl start/stop <target>  (system units; `remote`
 #                      sends it over ssh). Needs a matching NOPASSWD sudoers rule on
 #                      the target host, and `target` must match it verbatim
-#                      ("ollama", not "ollama.service").
+#                      (e.g. "foo", not "foo.service").
+#                      NOTE: no service currently uses this kind.
 #
 # group "media": family-facing editors (shared by everyone).
 # group "pipeline": photo ingestion (prefect worker + dashboard) — admin only.
@@ -98,19 +99,3 @@ label = "World Monitor"
 ram_mb = 120
 default_state = "running"
 who = ["sam"]
-
-# Ollama on .27 — now a NixOS *system* service (services.ollama in
-# hosts/sam-4screen-desktop/configuration.nix). The old user unit was deleted, so
-# this must be toggled with `sudo systemctl`, not `systemctl --user`. Bound to
-# 0.0.0.0:11434 for OmniRoute/dsh on .13. Models live in /var/lib/ollama/models.
-# RAM is the loaded model; OLLAMA_KEEP_ALIVE=5m unloads it when idle.
-[[services]]
-id = "ollama"
-kind = "systemd-system"
-target = "ollama"
-remote = "sam@192.168.20.27"
-group = "ai"
-label = "Local LLM Server (Ollama .27)"
-ram_mb = 9000
-default_state = "running"
-who = ["sam", "jo", "harry", "finn"]

docs/portal-architecture.md

@@ -112,7 +112,6 @@ To allow family members to free up RAM on `.13` without exposing `/var/run/docke
 | `prefect-worker` | `prefect-worker` (systemd user) | ~129 MB | `pipeline` | `sam` |
 | `photo-dashboard` | `photo-dashboard` (systemd user) | ~112 MB | `pipeline` | `sam` |
 | `worldmonitor` | 4-container group (Container) | ~120 MB | `admin` | `sam` |
-| `ollama` | `ollama` on **`.27`** (`systemd-system`, via ssh) | ~9000 MB (loaded model) | `ai` | `sam`, `jo`, `harry`, `finn` |
 
 ### Controller kinds (`kind` in `services.toml`)
 
@@ -120,12 +119,12 @@ To allow family members to free up RAM on `.13` without exposing `/var/run/docke
 | :--- | :--- | :--- |
 | `container` | `docker start/stop <target>` | Same host (`.13`); `sam` is in the `docker` group. |
 | `systemd-user` | `systemctl --user <action> <target>` | Local `.13` user units (paperclip, prefect-worker, photo-dashboard). |
-| `systemd-system` | `sudo -n <canonical systemctl> <action> <target>` | System units, local or on a `remote` host over ssh. |
+| `systemd-system` | `sudo -n <canonical systemctl> <action> <target>` | System units, local or on a `remote` host over ssh. **Currently unused** — kept as a tested capability. |
 
-**`systemd-system` gotchas** (both were hit while wiring `ollama`):
+**`systemd-system` gotchas** (learned while it was in use; apply if it is ever wired up again):
 
 1. It needs a matching **NOPASSWD** sudoers rule on the target host, and the
-   `target` must match the rule verbatim — `ollama`, never `ollama.service`.
+   `target` must match the rule verbatim — `foo`, never `foo.service`.
 2. On NixOS, `systemctl` on `PATH` is a symlink (`/run/current-system/sw/bin/systemctl`)
    while the sudoers rule names the store path, and sudo matches the *literal*
    resolved path. A bare `sudo systemctl …` therefore does **not** match. The

portal/tools.py

@@ -85,9 +85,6 @@ def _cat() -> list[Tool]:
              "Chat admin console (admins only)", "https://pb.chat.lab.audasmedia.com.au", login=True, admin=True),
         Tool("ai-router", "AI Router", "ai",
              "OmniRoute LLM gateway dashboard", "https://omniroute.lab.audasmedia.com.au"),
-        Tool("ollama", "Ollama Local LLM", "ai",
-             "Local AI model server (Qwen 2.5 Coder on .27)", "http://192.168.20.27:11434",
-             service_id="ollama", ram_mb=9000, togglable=True, lan=True),
         Tool("n8n", "n8n", "ai",
              "Workflow automation", "https://n8n.lab.audasmedia.com.au", login=True),
         Tool("prefect", "Prefect", "ai",