{ config, ... }:
{
  services.ollama = {
    enable = true;
    port = 11434;
    user = "nix-apps";
    group = "jallen-nas";
    openFirewall = true;
    acceleration = "cuda";
    home = "/media/nas/ssd/nix-app-data/ollama";
  };

  services.open-webui = {
    enable = true;
    host = "0.0.0.0";
    port = 8888;
    openFirewall = true;
    # stateDir = "/media/nas/ssd/nix-app-data/open-webui";
    environmentFile = config.sops.secrets."jallen-nas/open-webui".path;
    environment = {
      OPENID_PROVIDER_URL = "https://authentik.mjallen.dev/application/o/chat/.well-known/openid-configuration";
      OPENID_PROVIDER_NAME = "authentik";
      ENABLE_OAUTH_SIGNUP = "true";
      OAUTH_MERGE_ACCOUNTS_BY_EMAIL = "true";
      ANONYMIZED_TELEMETRY = "False";
      DO_NOT_TRACK = "True";
      SCARF_NO_ANALYTICS = "True";
      OLLAMA_API_BASE_URL = "http://127.0.0.1:11434";
      LOCAL_FILES_ONLY = "False";
    };
  };
}