Add fuelish API; protect the host against memory exhaustion

- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared Ollama model and request options - base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap - docs and vault/service checks updated
2026-10-04 13:54:09 +02:00
parent 974486bc53
commit 82d944a0a8
15 changed files with 246 additions and 25 deletions
@@ -93,6 +93,13 @@ roundcube_smtp_port: "587"
 act_runner_version: "latest"
 act_runner_data_dir: /opt/act_runner
 act_runner_count: 3
+# Swap file created by the base role (the VPS has no swap partition)
+base_swap_size: "4G"
+base_swappiness: 10   # use swap only under real memory pressure
+
+# Memory cap per CI job container (swap disabled inside the job): a build that needs more is killed
+# instead of exhausting the host
+act_runner_job_memory: "4g"
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # gitea_runner_registration_token: ""  # Gitea admin → Site Administration → Runners → Create runner token

@@ -133,17 +140,23 @@ ollama_context_length: 16384
 ollama_mem_limit: 4608m
 ollama_keep_alive: "1h"   # unload the model after this idle time to free RAM

-# Browserless — headless Chromium for rendering JavaScript-heavy pages (internal only)
-browserless_version: "v2.57.0"
-browserless_data_dir: /opt/browserless
-browserless_mem_limit: 1g
-
-# SearXNG — metasearch backend for the n8n web_search tool (internal only)
-searxng_version: "2026.10.2-19ffbcd30"
-searxng_data_dir: /opt/searxng
-searxng_mem_limit: 384m
+# Fuelish — receipt OCR job API for the Android app (fuelish.ladkau.de)
+# The image is pushed to the private registry with upload-image.sh in the fuelish project;
+# after pushing a new version, set fuelish_version and deploy with --tags fuelish.
+domain_fuelish: "fuelish.{{ domain_base }}"
+fuelish_image: "{{ domain_registry }}/fuelish/tools"
+fuelish_version: "0.1.1"   # needs X-API-Key support (fuelish commit 7a91a37 or later) and OLLAMA_NUM_CTX / OLLAMA_NUM_THREAD (version 0.1.1 or later)
+fuelish_data_dir: /opt/fuelish
+fuelish_model: "{{ ollama_model }}"   # same model as n8n, so the shared Ollama keeps a single model loaded
+fuelish_mem_limit: 768m
+# Request options of the API; they equal the numCtx / numThread of the n8n Ollama nodes (16384 / 4)
+fuelish_num_ctx: "{{ ollama_context_length }}"
+fuelish_num_thread: 4
+# Registry account used to pull the image: the first registry_users entry unless overridden in the vault
+fuelish_registry_user: "{{ registry_users[0].username }}"
+fuelish_registry_password: "{{ registry_users[0].password }}"
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
-# searxng_secret_key: ""   # generate: openssl rand -hex 32
+# fuelish_api_key: ""   # generate: openssl rand -hex 32 — the same value goes into the Android app settings

 # n8n — workflow automation, AI chat and scheduled digests (agent.ladkau.de)
 domain_n8n: "agent.{{ domain_base }}"
@@ -170,6 +183,7 @@ smtp_port: 465
 smtp_secure: true   # true = implicit TLS (port 465); false = STARTTLS (port 587)
 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
 # n8n_encryption_key: ""   # generate: openssl rand -hex 32
+# searxng_secret_key: ""   # generate: openssl rand -hex 32 (SearXNG, the internal search backend)
 # gemini_api_key: ""      # Google AI Studio API key (default model of the Telegram chat)
 # telegram_bot_token: ""   # from @BotFather
 # telegram_user_id: ""     # your numeric Telegram user id (the only user the bot answers)
@@ -178,3 +192,13 @@ smtp_secure: true   # true = implicit TLS (port 465); false = STARTTLS (port 587
 # n8n_users:
 #   - username: admin
 #     password: "your-password"
+
+# n8n backend: Browserless — headless Chromium for the fetch_page tool (internal only)
+browserless_version: "v2.57.0"
+browserless_data_dir: /opt/browserless
+browserless_mem_limit: 1g
+
+# n8n backend: SearXNG — metasearch for the web_search tool (internal only)
+searxng_version: "2026.10.2-19ffbcd30"
+searxng_data_dir: /opt/searxng
+searxng_mem_limit: 384m
@@ -15,6 +15,7 @@ cache:
 container:
  network: bridge      # job containers get default bridge network with internet access
  privileged: false
+  options: "--memory={{ act_runner_job_memory }} --memory-swap={{ act_runner_job_memory }}"
  valid_volumes:
    - /tmp
  force_pull: true     # otherwise a job container image update (e.g. a build-image
@@ -152,3 +152,53 @@
    state: started
    enabled: true
  tags: base
+
+# Swap file: without swap, memory pressure ends in a frozen host instead of a slow one
+- name: Create swap file
+  ansible.builtin.command: fallocate -l {{ base_swap_size }} /swapfile
+  args:
+    creates: /swapfile
+  tags: base
+
+- name: Set swap file permissions
+  ansible.builtin.file:
+    path: /swapfile
+    owner: root
+    group: root
+    mode: "0600"
+  tags: base
+
+- name: Format swap file
+  ansible.builtin.shell: blkid -p /swapfile | grep -q 'TYPE="swap"' || mkswap /swapfile
+  register: base_mkswap
+  changed_when: "'Setting up swapspace' in base_mkswap.stdout"
+  tags: base
+
+- name: List active swap
+  ansible.builtin.command: swapon --noheadings --show=NAME
+  register: base_active_swap
+  changed_when: false
+  tags: base
+
+- name: Enable swap file
+  ansible.builtin.command: swapon /swapfile
+  when: "'/swapfile' not in base_active_swap.stdout"
+  tags: base
+
+- name: Mount swap file at boot
+  ansible.posix.mount:
+    src: /swapfile
+    path: none
+    fstype: swap
+    opts: sw
+    state: present
+  tags: base
+
+- name: Set swappiness
+  ansible.posix.sysctl:
+    name: vm.swappiness
+    value: "{{ base_swappiness }}"
+    sysctl_file: /etc/sysctl.d/60-swap.conf
+    state: present
+    reload: true
+  tags: base
@@ -25,6 +25,7 @@ SERVICES = [
    ("k8s",          "https://{{ domain_k8s }}",                200, "https://{{ domain_k8s }}"),
    ("Vaultwarden",  "https://{{ domain_vault }}",             200, "https://{{ domain_vault }}"),
    ("Downloads",    "https://{{ domain_dl }}",               200, "https://{{ domain_dl }}"),
+    ("Fuelish",     "https://{{ domain_fuelish }}/health",   200, "https://{{ domain_fuelish }}/health"),
    ("AI Chat",      "https://{{ domain_n8n }}/chat",         401, "https://{{ domain_n8n }}/chat"),
    ("n8n",          "https://{{ domain_n8n }}",              401, "https://{{ domain_n8n }}"),
 ]
@@ -0,0 +1,6 @@
+---
+- name: Restart fuelish
+  community.docker.docker_compose_v2:
+    project_src: "{{ fuelish_data_dir }}"
+    state: present
+    recreate: always
@@ -0,0 +1,35 @@
+---
+- name: Create fuelish directory
+  ansible.builtin.file:
+    path: "{{ fuelish_data_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags: fuelish
+
+# The tools image is pushed to the private registry with upload-image.sh
+- name: Log in to the container registry
+  community.docker.docker_login:
+    registry_url: "{{ domain_registry }}"
+    username: "{{ fuelish_registry_user }}"
+    password: "{{ fuelish_registry_password }}"
+  no_log: true
+  tags: fuelish
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ fuelish_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart fuelish
+  tags: fuelish
+
+- name: Start fuelish
+  community.docker.docker_compose_v2:
+    project_src: "{{ fuelish_data_dir }}"
+    state: present
+    pull: always
+  tags: fuelish
@@ -0,0 +1,33 @@
+# Managed by Ansible — do not edit manually
+services:
+  fuelish:
+    image: {{ fuelish_image }}:{{ fuelish_version }}
+    container_name: fuelish
+    restart: unless-stopped
+    command: ["uvicorn", "server:app", "--app-dir", "/opt/app/src", "--host", "0.0.0.0", "--port", "8000"]
+    environment:
+      OLLAMA_URL: "http://ollama:11434/api/chat"
+      OLLAMA_BASE_URL: "http://ollama:11434"
+      OLLAMA_MODEL: "{{ fuelish_model }}"
+      # Same request options as the n8n Ollama nodes, so the shared Ollama keeps its runner loaded
+      OLLAMA_NUM_CTX: "{{ fuelish_num_ctx }}"
+      OLLAMA_NUM_THREAD: "{{ fuelish_num_thread }}"
+      FUELISH_API_KEY: "{{ fuelish_api_key }}"
+    mem_limit: {{ fuelish_mem_limit }}
+    networks:
+      - traefik_public
+      - ollama_internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.fuelish.rule=Host(`{{ domain_fuelish }}`)"
+      - "traefik.http.routers.fuelish.entrypoints=websecure"
+      - "traefik.http.routers.fuelish.tls.certresolver=letsencrypt"
+      - "traefik.http.services.fuelish.loadbalancer.server.port=8000"
+      # The app polls GET /jobs/{id} while a receipt is processed
+      - "traefik.http.routers.fuelish.middlewares=rate-limit-lax@docker"
+
+networks:
+  traefik_public:
+    external: true
+  ollama_internal:
+    external: true
@@ -16,6 +16,7 @@
    - vaultwarden
    - dl
    - ollama
+    - fuelish
    - browserless
    - searxng
    - n8n