add kiwi and lillypilly

hosts/k3s-nixos-01/k3s.nix

@@ -1,10 +1,19 @@
-{ config, pkgs, ... }:
+{ config, pkgs, baseVars, ... }:
 
 {
   environment.systemPackages = with pkgs; [
     k3s
+    ollama-rocm
+    rocmPackages.rocm-smi
+    btop
   ];
 
+  users.users.${baseVars.username} = {
+    extraGroups = [
+      "video" "render"
+    ];
+  };
+
   environment.sessionVariables = {
     KUBECONFIG = "$HOME/.kube/config";
   };
@@ -17,8 +26,8 @@
   services.openssh = {
     enable = true;
     settings = {
-      PasswordAuthentication = no;
-      PermitRootLogin = "no";
+      PasswordAuthentication = true;
+      PermitRootLogin = "yes";
     };
   };
 
@@ -27,7 +36,7 @@
     after = [ "network.target" ];
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {
-      ExecStart = "${pkgs.cloudflared}/bin/cloudflared tunnel --no-autoupdate run --token XXXXXXXXXXXXXXXXXXXXXXXXXXXX";
+      ExecStart = "${pkgs.cloudflared}/bin/cloudflared tunnel --no-autoupdate run --token token";
       Restart = "always";
       User = "cloudflared";
       Group = "cloudflared";
@@ -51,11 +60,12 @@
     ];
 
     firewall = {
-      enable = true;
+      enable = false;
       allowedTCPPorts = [
         6443
         10250
         22
+	      11434
       ];
       allowedUDPPorts = [ 8472 ];
     };
@@ -67,4 +77,35 @@
       }
     ];
   };
+
+  services.ollama = {
+	  enable = true;
+	  openFirewall = true;
+	  package = pkgs.ollama-rocm;
+	  host = "0.0.0.0";
+	  port = 11434;
+	  environmentVariables = {
+		  OLLAMA_ORIGINS = "https://ollama.illegalesachen.download";
+	  };
+  };
+
+  services.open-webui = {
+	  enable = true;
+	  host = "127.0.0.1";
+	  port = 11435;
+	  environment = {
+                  WEBUI_URL = "https://web-ui.illegalesachen.download";
+		  OLLAMA_BASE_URL = "http://127.0.0.1:11434";
+		  ENABLE_OAUTH_SIGNUP = "true";
+		  DEFAULT_USER_ROLE = "user";
+		  OAUTH_MERGE_ACCOUNTS_BY_EMAIL = "true";
+		  OAUTH_CLIENT_ID = "open-webui";
+		  OAUTH_CLIENT_SECRET = "...";
+		  OPENID_PROVIDER_URL = "...";
+	    OPENID_REDIRECT_URI= "http://web-ui.illegalesachen.download/oauth/oidc/callback";
+	  };
+  };
+
+  hardware.graphics.enable = true;
+  hardware.enableRedistributableFirmware = true;
 }