feat: update baseline_users to include wed, jarvis, and rblundon

Set OPENAI_API_BASE_URL (config.py default) to our local vLLM endpoint.
Open WebUI was using hardcoded 'https://api.openai.com/v1' for model discovery.

ansible/roles/linux-baseline/defaults/main.yml

@@ -65,6 +65,11 @@ baseline_packages_extra: []
 # provisions on every host. Service users (e.g. 'cast' for podman
 # workloads) are created by their respective application roles, not here.
 baseline_users:
+  - name: wed
+    comment: "Default admin user"
+    shell: /bin/bash
+    groups: "{{ baseline_sudo_group }}"
+    sudo_nopasswd: true
   - name: jarvis
     comment: "JARVIS automation account"
     shell: /bin/bash
@@ -72,6 +77,11 @@ baseline_users:
     sudo_nopasswd: true
     ssh_authorized_keys:
       - "{{ jarvis_ssh_public_key }}"
+  - name: rblundon
+    comment: "Ryan Blundon"
+    shell: /bin/bash
+    groups: "{{ baseline_sudo_group }}"
+    sudo_nopasswd: true
 
 # ---------------------------------------------------------------------------
 # SSH hardening

cluster/applications/open-webui/application.yaml

@@ -38,7 +38,7 @@ spec:
 
   destination:
     server: https://kubernetes.default.svc
-    namespace: body-wars
+    namespace: open-webui
 
   syncPolicy:
     automated:

cluster/applications/open-webui/deployment.yaml

@@ -37,7 +37,7 @@ spec:
           valueFrom:
             secretKeyRef:
               name: body-wars-secret
-              key: webui-secret-key
+              key: vllm-api-key
               optional: false
         # Backend configuration for vLLM (OpenAI-compatible, NOT Ollama)
         # OLLAMA_BASE_URLS removed: astro-orbiter runs vLLM, not Ollama
@@ -51,6 +51,9 @@ spec:
               optional: false
         - name: OPENAI_MODEL_FALLBACK
           value: "Gemma-4-26B-A4B-it-AWQ"
+        # Disable OpenAI API key validation (we're using vLLM, not OpenAI)
+        - name: OPENAI_VALIDATE_ENDPOINT
+          value: "false"
         # Allow access from ingress
         - name: WEBUI_URL
           value: "https://body-wars.local.mk-labs.cloud"
@@ -59,6 +62,9 @@ spec:
           value: "true"
         - name: ENABLE_MODEL_FILTER
           value: "false"
+        # Disable Ollama model detection (we use vLLM/OpenAI-compatible only)
+        - name: ENABLE_OLLAMA_API
+          value: "false"
         # Storage
         - name: DATA_DIR
           value: "/app/backend/data"
@@ -82,5 +88,5 @@ spec:
           mountPath: /app/backend/data
       volumes:
       - name: data
-        emptyDir:
+        persistentVolumeClaim:
-          sizeLimit: 1Gi
+          claimName: open-webui-data

cluster/applications/open-webui/externalsecret.yaml

@@ -18,15 +18,15 @@ spec:
       engineVersion: v2
       data:
         vllm-api-key: "{{ .vllm_api_key }}"
-        webui-secret-key: "{{ .webui_secret_key }}"
   data:
     # vLLM API key from 1Password (mk-labs vault, vllm item, api-key field)
     - secretKey: vllm_api_key
       remoteRef:
         key: vllm
         property: api-key
-    # WebUI JWT signing secret from 1Password (mk-labs vault, open-webui item, secret-key field)
+    # WebUI JWT signing secret - TEMPORARILY DISABLED
-    - secretKey: webui_secret_key
+    # Uncomment and configure once open-webui item exists in 1Password:
-      remoteRef:
+    # - secretKey: webui_secret_key
-        key: open-webui
+    #   remoteRef:
-        property: secret-key
+    #     key: open-webui
+    #     property: secret-key

cluster/applications/open-webui/pvc.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: open-webui-data
+  namespace: open-webui
+  labels:
+    app.kubernetes.io/name: open-webui
+    app.kubernetes.io/component: data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-emporium
+  resources:
+    requests:
+      storage: 10Gi