feat: Add SearXNG module and update infrastructure

- Introduced a new SearXNG module with configuration for Kubernetes deployment, service, and ingress.
- Updated existing Terraform app modules to include SearXNG in both dev-01 and prod-01 environments.
- Added necessary variables and secrets for SearXNG in the respective Terraform files.
- Updated Dockerfiles for llama.cpp and ollama to use latest versions.
- Enhanced security and hardening defaults in Kubernetes deployments.
- Improved documentation for Copilot instructions and Terraform workflows.

ansible/files/dockerfiles/Dockerfile.llamacpp.rocm

@@ -0,0 +1,14 @@
+FROM ghcr.io/ggml-org/llama.cpp:server-rocm
+
+ARG UID=1000
+ARG GID=1000
+RUN groupadd --system --gid ${GID} worker && \
+    useradd --system --gid ${GID} --uid ${UID} --home /home/worker worker && \
+    mkdir -p /home/worker && chown worker:worker /home/worker && \
+    cp /app/llama-server /home/worker/ && \
+    chmod +x /home/worker/llama-server && \
+    chown worker:worker /home/worker/llama-server
+
+WORKDIR /home/worker
+USER worker
+ENTRYPOINT ["/home/worker/llama-server"]

ansible/files/dockerfiles/Dockerfile.ollama

@@ -1,4 +1,4 @@
-FROM docker.io/ollama/ollama:0.13.4
+FROM docker.io/ollama/ollama:latest
 
 ARG UID=1000
 ARG GID=1000

ansible/files/dockerfiles/Dockerfile.ollama.rocm

@@ -1,4 +1,4 @@
-FROM docker.io/ollama/ollama:0.13.4-rocm
+FROM docker.io/ollama/ollama:rocm
 
 ARG UID=1000
 ARG GID=1000

ansible/host_vars/gpu-01.lab.alexpires.me.yml

@@ -88,6 +88,7 @@ duo_api_hostname: api-7cda1654.duosecurity.com
 
 # podman services settings
 ollama_home: "/mnt/data/ollama"
+llama_home: "/mnt/data/llamacpp"
 podman_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="
 
 # ComfyUI settings

ansible/playbook_podman_llama_rocm.yml

@@ -0,0 +1,30 @@
+- name: Setup llama.cpp - ROCm
+  hosts: llamacpp
+  vars:
+    podman_user: "{{ llama_user | default('llama') }}"
+    podman_group: "{{ llama_group | default('llama') }}"
+    podman_extra_groups: "users,video"
+    podman_user_home: "{{ llama_home | default('/home/llama') }}"
+    podman_user_folders:
+      - data
+    pods:
+      - name: llamacpp-rocm
+        build:
+          dockerfile: "{{ lookup('file', 'dockerfiles/Dockerfile.llamacpp.rocm') }}"
+        env:
+          LLAMA_ARG_MODELS_DIR: "/home/worker/.llamacpp"
+          LLAMA_ARG_THREADS: 6
+          LLAMA_ARG_PARALLEL: 1
+          LLAMA_ARG_CACHE: "true"
+        ports:
+          - "0.0.0.0:{{ llama_port | default(11435) }}:11434/tcp"
+        volumes:
+          - "{{ llama_home }}/data:/home/worker/.llamacpp:Z"
+        device:
+          - "/dev/kfd:/dev/kfd:rw"
+          - "/dev/dri:/dev/dri:rw"
+
+  tasks:
+    - name: Setup Pods
+      ansible.builtin.include_tasks:
+        file: tasks/podman.yml

ansible/playbook_podman_ollama.yml

@@ -16,13 +16,17 @@
           OLLAMA_NUM_THREADS: 6
           OLLAMA_NUM_PARALLEL: 1
           OLLAMA_KV_CACHE: "true"
+          OLLAMA_VULKAN: 1
+          GGML_VK_VISIBLE_DEVICES: 0,1,2
+          OLLAMA_NUM_GPU: 99
         ports:
           - "0.0.0.0:{{ ollama_port | default(11434) }}:11434/tcp"
         volumes:
           - "{{ ollama_home }}/data:/home/worker/.ollama:Z"
         device:
           - "nvidia.com/gpu=all"
-
+          - "/dev/kfd:/dev/kfd:rw"
+          - "/dev/dri:/dev/dri:rw"
   tasks:
     - name: Setup Pods
       ansible.builtin.include_tasks:

ansible/playbook_podman_ollama_rocm.yml

@@ -12,10 +12,12 @@
         build:
           dockerfile: "{{ lookup('file', 'dockerfiles/Dockerfile.ollama.rocm') }}"
         env:
-          OLLAMA_CONTEXT_SIZE: 65536
-          OLLAMA_NUM_THREADS: 6
-          OLLAMA_NUM_PARALLEL: 1
+          OLLAMA_CONTEXT_LENGTH: 4096
+          OLLAMA_NUM_THREADS: 10
+          OLLAMA_NUM_PARALLEL: 2
+          OLLAMA_FLASH_ATTENTION: 1
           OLLAMA_KV_CACHE: "true"
+          HSA_OVERRIDE_GFX_VERSION: "11.0.0"
         ports:
           - "0.0.0.0:{{ ollama_port | default(11434) }}:11434/tcp"
         volumes: