feat(llm): ollama compose service — GPU, idle unload, models volume (refs #564)

compose.yml

@@ -307,6 +307,40 @@ services:
       - "promtail=true"
     restart: unless-stopped
 
+  ollama:
+    image: ollama/ollama:latest
+    container_name: ollama
+    networks:
+      - data
+    ports:
+      # Host + LAN: the rack's Ollama is one endpoint in the multi-host
+      # pool (rig 4090 / laptop 5080 serve the same API on the LAN).
+      - "11434:11434"
+    environment:
+      # Unload models after idle so the shared 3060 frees VRAM for
+      # notebooks/zotero.
+      - OLLAMA_KEEP_ALIVE=5m
+    volumes:
+      - ollama_models:/root/.ollama
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities: [gpu]
+    healthcheck:
+      test: ["CMD", "ollama", "ls"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    labels:
+      - "promtail=true"
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+
   # Watches the notebooks service for errors (container logs via the
   # docker socket + __marimo__/session snapshots) and files deduplicated,
   # auto-closing Gitea issues via dev/scripts/nb_issue_filer.py. See
@@ -1024,3 +1058,4 @@ volumes:
   prometheus_data:
   tempo_data:
   grafana_data:
+  ollama_models: