Add fuelish API; protect the host against memory exhaustion

- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared
  Ollama model and request options
- base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap
- docs and vault/service checks updated

ansible/roles/act_runner/templates/config.yml.j2

@@ -15,6 +15,7 @@ cache:
 container:
   network: bridge      # job containers get default bridge network with internet access
   privileged: false
+  options: "--memory={{ act_runner_job_memory }} --memory-swap={{ act_runner_job_memory }}"
   valid_volumes:
     - /tmp
   force_pull: true     # otherwise a job container image update (e.g. a build-image

ansible/roles/base/tasks/main.yml

@@ -152,3 +152,53 @@
     state: started
     enabled: true
   tags: base
+
+# Swap file: without swap, memory pressure ends in a frozen host instead of a slow one
+- name: Create swap file
+  ansible.builtin.command: fallocate -l {{ base_swap_size }} /swapfile
+  args:
+    creates: /swapfile
+  tags: base
+
+- name: Set swap file permissions
+  ansible.builtin.file:
+    path: /swapfile
+    owner: root
+    group: root
+    mode: "0600"
+  tags: base
+
+- name: Format swap file
+  ansible.builtin.shell: blkid -p /swapfile | grep -q 'TYPE="swap"' || mkswap /swapfile
+  register: base_mkswap
+  changed_when: "'Setting up swapspace' in base_mkswap.stdout"
+  tags: base
+
+- name: List active swap
+  ansible.builtin.command: swapon --noheadings --show=NAME
+  register: base_active_swap
+  changed_when: false
+  tags: base
+
+- name: Enable swap file
+  ansible.builtin.command: swapon /swapfile
+  when: "'/swapfile' not in base_active_swap.stdout"
+  tags: base
+
+- name: Mount swap file at boot
+  ansible.posix.mount:
+    src: /swapfile
+    path: none
+    fstype: swap
+    opts: sw
+    state: present
+  tags: base
+
+- name: Set swappiness
+  ansible.posix.sysctl:
+    name: vm.swappiness
+    value: "{{ base_swappiness }}"
+    sysctl_file: /etc/sysctl.d/60-swap.conf
+    state: present
+    reload: true
+  tags: base

ansible/roles/dashboard/templates/app.py.j2

@@ -25,6 +25,7 @@ SERVICES = [
     ("k8s",          "https://{{ domain_k8s }}",                200, "https://{{ domain_k8s }}"),
     ("Vaultwarden",  "https://{{ domain_vault }}",             200, "https://{{ domain_vault }}"),
     ("Downloads",    "https://{{ domain_dl }}",               200, "https://{{ domain_dl }}"),
+    ("Fuelish",     "https://{{ domain_fuelish }}/health",   200, "https://{{ domain_fuelish }}/health"),
     ("AI Chat",      "https://{{ domain_n8n }}/chat",         401, "https://{{ domain_n8n }}/chat"),
     ("n8n",          "https://{{ domain_n8n }}",              401, "https://{{ domain_n8n }}"),
 ]

ansible/roles/fuelish/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart fuelish
+  community.docker.docker_compose_v2:
+    project_src: "{{ fuelish_data_dir }}"
+    state: present
+    recreate: always

ansible/roles/fuelish/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+- name: Create fuelish directory
+  ansible.builtin.file:
+    path: "{{ fuelish_data_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  tags: fuelish
+
+# The tools image is pushed to the private registry with upload-image.sh
+- name: Log in to the container registry
+  community.docker.docker_login:
+    registry_url: "{{ domain_registry }}"
+    username: "{{ fuelish_registry_user }}"
+    password: "{{ fuelish_registry_password }}"
+  no_log: true
+  tags: fuelish
+
+- name: Deploy Docker Compose file
+  ansible.builtin.template:
+    src: docker-compose.yml.j2
+    dest: "{{ fuelish_data_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Restart fuelish
+  tags: fuelish
+
+- name: Start fuelish
+  community.docker.docker_compose_v2:
+    project_src: "{{ fuelish_data_dir }}"
+    state: present
+    pull: always
+  tags: fuelish

ansible/roles/fuelish/templates/docker-compose.yml.j2

@@ -0,0 +1,33 @@
+# Managed by Ansible — do not edit manually
+services:
+  fuelish:
+    image: {{ fuelish_image }}:{{ fuelish_version }}
+    container_name: fuelish
+    restart: unless-stopped
+    command: ["uvicorn", "server:app", "--app-dir", "/opt/app/src", "--host", "0.0.0.0", "--port", "8000"]
+    environment:
+      OLLAMA_URL: "http://ollama:11434/api/chat"
+      OLLAMA_BASE_URL: "http://ollama:11434"
+      OLLAMA_MODEL: "{{ fuelish_model }}"
+      # Same request options as the n8n Ollama nodes, so the shared Ollama keeps its runner loaded
+      OLLAMA_NUM_CTX: "{{ fuelish_num_ctx }}"
+      OLLAMA_NUM_THREAD: "{{ fuelish_num_thread }}"
+      FUELISH_API_KEY: "{{ fuelish_api_key }}"
+    mem_limit: {{ fuelish_mem_limit }}
+    networks:
+      - traefik_public
+      - ollama_internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.fuelish.rule=Host(`{{ domain_fuelish }}`)"
+      - "traefik.http.routers.fuelish.entrypoints=websecure"
+      - "traefik.http.routers.fuelish.tls.certresolver=letsencrypt"
+      - "traefik.http.services.fuelish.loadbalancer.server.port=8000"
+      # The app polls GET /jobs/{id} while a receipt is processed
+      - "traefik.http.routers.fuelish.middlewares=rate-limit-lax@docker"
+
+networks:
+  traefik_public:
+    external: true
+  ollama_internal:
+    external: true