Sam Rolfe
d7802bddb1
The ollama card was wired to 'systemctl --user', but the .27 user unit was removed when Ollama moved to services.ollama (NixOS system service). The panel therefore reported Stopped while the service was Running and its buttons failed. - new controller kind 'systemd-system' -> sudo -n <canonical systemctl> ... - resolve systemctl to its store path first: NixOS puts a symlink on PATH but the NOPASSWD sudoers rule names the store path, so bare 'sudo systemctl' does not match (verified: full path exit=0, bare name 'a password is required') - _remote() now shlex.join()s the remote command; ssh joins trailing argv with spaces, which was word-splitting the 'sh -c' wrapper and failing with a sudo usage error - services.toml: ollama -> kind=systemd-system, target=ollama (matches the sudoers rule verbatim), default_state=running - docs/portal-architecture.md: document the three controller kinds + gotchas Verified end-to-end from .13: start->running, stop->stopped, start->running, real systemctl agrees, and /v1/models lists both qwen2.5 models over the LAN.
117 lines
3.4 KiB
TOML
117 lines
3.4 KiB
TOML
# service-controller allowlist — ON_OFF.md §3/§4.
|
|
#
|
|
# Only services listed here can be started/stopped. Everything else 404s.
|
|
# Safety (non-negotiable, §6): never list console deps, house-critical audio,
|
|
# voice/whisper/HA path, or n8n/prefect-server (shared infra, always on).
|
|
#
|
|
# kind:
|
|
# container -> docker start/stop <target> (sam is in the docker group)
|
|
# systemd-user -> systemctl --user start/stop <target> (local .13 user units)
|
|
# systemd-system -> sudo -n systemctl start/stop <target> (system units; `remote`
|
|
# sends it over ssh). Needs a matching NOPASSWD sudoers rule on
|
|
# the target host, and `target` must match it verbatim
|
|
# ("ollama", not "ollama.service").
|
|
#
|
|
# group "media": family-facing editors (shared by everyone).
|
|
# group "pipeline": photo ingestion (prefect worker + dashboard) — admin only.
|
|
# group "admin": heavy infra someone may pause when idle — admin only.
|
|
|
|
[[services]]
|
|
id = "gimp"
|
|
kind = "container"
|
|
target = "family-home-lab-gimp-1"
|
|
group = "media"
|
|
label = "GIMP"
|
|
ram_mb = 233
|
|
default_state = "stopped"
|
|
who = ["sam", "finn", "harry", "jo"]
|
|
|
|
[[services]]
|
|
id = "video-editor"
|
|
kind = "container"
|
|
target = "family-home-lab-video-editor-1"
|
|
group = "media"
|
|
label = "Video Editor (KdenLive)"
|
|
ram_mb = 237
|
|
default_state = "stopped"
|
|
who = ["sam", "finn", "harry", "jo"]
|
|
|
|
[[services]]
|
|
id = "audio-editor"
|
|
kind = "container"
|
|
target = "family-home-lab-audio-editor-1"
|
|
group = "media"
|
|
label = "Audio Editor (Audacity)"
|
|
ram_mb = 201
|
|
default_state = "stopped"
|
|
who = ["sam", "finn", "harry", "jo"]
|
|
|
|
[[services]]
|
|
id = "lmms"
|
|
kind = "container"
|
|
target = "lmms"
|
|
group = "media"
|
|
label = "LMMS Music Studio"
|
|
ram_mb = 798 # incl. webtop desktop; Xvfb fixed to 2560x1440 (2026-10-07)
|
|
default_state = "stopped"
|
|
who = ["sam", "finn", "harry", "jo"]
|
|
|
|
[[services]]
|
|
id = "paperclip"
|
|
kind = "systemd-user"
|
|
target = "paperclipai"
|
|
group = "admin"
|
|
label = "Paperclip"
|
|
ram_mb = 495
|
|
default_state = "stopped"
|
|
who = ["sam"]
|
|
|
|
# Photo ingestion pipeline — admin controlled. Do NOT stop while ingesting
|
|
# Google Photos (user actively working on it, 2026-10-07).
|
|
[[services]]
|
|
id = "prefect-worker"
|
|
kind = "systemd-user"
|
|
target = "prefect-worker"
|
|
group = "pipeline"
|
|
label = "Prefect worker (photo pool)"
|
|
ram_mb = 129
|
|
default_state = "running"
|
|
who = ["sam"]
|
|
|
|
[[services]]
|
|
id = "photo-dashboard"
|
|
kind = "systemd-user"
|
|
target = "photo-dashboard"
|
|
group = "pipeline"
|
|
label = "Photo pipeline dashboard"
|
|
ram_mb = 112
|
|
default_state = "running"
|
|
who = ["sam"]
|
|
|
|
# WorldMonitor — 4-container group (UI + relay + redis + rest). One switch for all.
|
|
[[services]]
|
|
id = "worldmonitor"
|
|
kind = "container"
|
|
targets = ["worldmonitor", "worldmonitor-ais-relay", "worldmonitor-redis", "worldmonitor-redis-rest"]
|
|
group = "admin"
|
|
label = "World Monitor"
|
|
ram_mb = 120
|
|
default_state = "running"
|
|
who = ["sam"]
|
|
|
|
# Ollama on .27 — now a NixOS *system* service (services.ollama in
|
|
# hosts/sam-4screen-desktop/configuration.nix). The old user unit was deleted, so
|
|
# this must be toggled with `sudo systemctl`, not `systemctl --user`. Bound to
|
|
# 0.0.0.0:11434 for OmniRoute/dsh on .13. Models live in /var/lib/ollama/models.
|
|
# RAM is the loaded model; OLLAMA_KEEP_ALIVE=5m unloads it when idle.
|
|
[[services]]
|
|
id = "ollama"
|
|
kind = "systemd-system"
|
|
target = "ollama"
|
|
remote = "sam@192.168.20.27"
|
|
group = "ai"
|
|
label = "Local LLM Server (Ollama .27)"
|
|
ram_mb = 9000
|
|
default_state = "running"
|
|
who = ["sam", "jo", "harry", "finn"]
|