feat: Add ROCm support and update Ollama configurations

- Created ansible playbooks for setting up AMD ROCm container environment.
- Added ROCm and AMD Graphics repositories in ansible tasks.
- Installed necessary ROCm packages including rocm-dkms and developer tools.
- Updated Dockerfile for Ollama to use version 0.13.4 and created a new Dockerfile for ROCm support.
- Enhanced game station scripts for better performance and added MangoHud configuration.
- Modified systemd service files to allow CPU core allocation.
- Updated playbooks for Ollama and Qwen2 to include new configurations and environment variables.
- Added Wake-on-LAN systemd service configuration.
- Updated Terraform configurations to include secret management for the web UI.
- Refactored Kubernetes deployment for open-webui to include secret handling and improved volume management.

terraform/modules/apps/open-webui/config.tf

@@ -1,5 +1,6 @@
 locals {
   persistent_folder = var.persistent_folder
-  openwebui_data    = "${local.persistent_folder}/open-webui"
+  openwebui_data    = "${local.persistent_folder}/open-webui.data"
+  openwebui_app     = "${local.persistent_folder}/open-webui.app"
 }
 

terraform/modules/apps/open-webui/variables.tf

@@ -34,3 +34,24 @@ variable "ollama_proxy" {
   }
 
 }
+
+variable "secret_key" {
+  description = "The secret key for WEBUI"
+  type        = string
+}
+
+variable "jwt_expires_in" {
+  description = "Always set a reasonable expiration time in production environments (e.g., 3600s, 1h, 7d etc.) to limit the lifespan of authentication tokens."
+  default     = "1h"
+  type        = string
+}
+
+variable "log_level" {
+  description = "The global log level for the application"
+  type        = string
+  default     = "INFO"
+  validation {
+    condition     = contains(["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"], var.log_level)
+    error_message = "log_level must be one of: DEBUG, INFO, WARNING, ERROR, CRITICAL"
+  }
+}

terraform/modules/apps/open-webui/webui.tf

@@ -8,6 +8,20 @@ resource "kubernetes_service_account" "openwebui" {
   automount_service_account_token = false
 }
 
+
+resource "kubernetes_secret" "openwebui" {
+  metadata {
+    name      = "openwebui-secret"
+    namespace = kubernetes_namespace.openwebui.metadata[0].name
+  }
+
+  data = {
+    "WEBUI_SECRET_KEY" = base64encode(var.secret_key)
+  }
+
+  type = "Opaque"
+
+}
 resource "kubernetes_deployment" "openwebui" {
   metadata {
     name      = "openwebui"
@@ -41,12 +55,39 @@ resource "kubernetes_deployment" "openwebui" {
         service_account_name            = kubernetes_service_account.openwebui.metadata[0].name
         automount_service_account_token = false
 
+        # We need an init container rsync the /app/backend from the original image to the hostPath volume, so that we don't overwrite user data on restarts
+        # also fix permissions
+        init_container {
+          name    = "startup"
+          image   = "ghcr.io/open-webui/open-webui:${var.tag}"
+          command = ["sh", "-c", "apt-get update && apt-get install -y --no-install-recommends rsync && rm -rf /target_app/* && rsync -avz --delete /app/backend/* /target_app/ --exclude data && chown -R 1000:1000 /target_app /target_data"]
+          security_context {
+            run_as_user  = 0
+            run_as_group = 0
+          }
+
+          volume_mount {
+            name       = "openwebui-app"
+            mount_path = "/target_app"
+          }
+
+          volume_mount {
+            name       = "openwebui-data"
+            mount_path = "/target_data"
+          }
+        }
+
+
         container {
-          name  = "app"
-          image = "ghcr.io/open-webui/open-webui:${var.tag}"
+          name              = "app"
+          image             = "ghcr.io/open-webui/open-webui:${var.tag}"
+          image_pull_policy = "Always"
 
           security_context {
             allow_privilege_escalation = false
+            run_as_non_root            = true
+            run_as_user                = 1000
+            run_as_group               = 1000
           }
 
           port {
@@ -54,6 +95,27 @@ resource "kubernetes_deployment" "openwebui" {
             container_port = 8080
           }
 
+          env {
+            name = "WEBUI_SECRET_KEY"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.openwebui.metadata[0].name
+                key  = "WEBUI_SECRET_KEY"
+              }
+            }
+          }
+
+          env {
+            name  = "JWT_EXPIRES_IN"
+            value = var.jwt_expires_in
+          }
+
+          env {
+            name  = "GLOBAL_LOG_LEVEL"
+            value = var.log_level
+          }
+
+
           readiness_probe {
             tcp_socket {
               port = 8080
@@ -63,10 +125,23 @@ resource "kubernetes_deployment" "openwebui" {
             failure_threshold     = 10
           }
 
+          volume_mount {
+            name       = "openwebui-app"
+            mount_path = "/app/backend"
+          }
+
           volume_mount {
             name       = "openwebui-data"
             mount_path = "/app/backend/data"
           }
+
+        }
+
+        volume {
+          name = "openwebui-app"
+          host_path {
+            path = local.openwebui_app
+          }
         }
 
         volume {