feat: cleaned up ai tooling

modules/hosts/nixos/defiant/configuration.nix

@@ -118,6 +118,9 @@
     # leave them alone so NM-wait-online doesn't time out waiting for them.
     networking.networkmanager.unmanaged = ["bond0" "wg0" "eno1" "eno2"];
 
+    # Only expose ollama over tailscale
+    networking.firewall.interfaces."tailscale0".allowedTCPPorts = [11434];
+
     systemd.network = {
       enable = true;
 
@@ -260,10 +263,13 @@
         };
       };
 
-      # ollama = {
-      #   enable = true;
-      #   exposePort = true;
-      # };
+      ollama = {
+        enable = true;
+        host = "0.0.0.0";
+        loadModels = [
+          "gpt-oss:120b"
+        ];
+      };
       tailscale = {
         enable = true;
         authKeyFile = config.sops.secrets."vpn-keys/tailscale-authkey/defiant".path;

modules/hosts/nixos/emergent/configuration.nix

@@ -45,7 +45,6 @@
     services.desktopManager.gnome.enable = true;
 
     host = {
-      # ai.enable = true;
       users = {
         eve = {
           isDesktopUser = true;

modules/hosts/nixos/horizon/configuration.nix

@@ -38,10 +38,6 @@
       hardware = {
         directAccess.enable = true;
       };
-
-      # ai = {
-      #   enable = true;
-      # };
     };
 
     virtualisation.docker.enable = true;
@@ -85,13 +81,6 @@
       };
 
       syncthing.enable = true;
-
-      # ollama = {
-      #   enable = true;
-      #   loadModels = [
-      #     "llama3.1:8b"
-      #   ];
-      # };
     };
 
     # Enable network-online.target for better network dependency handling

modules/hosts/nixos/twilight/configuration.nix

@@ -36,16 +36,8 @@
         graphicsAcceleration.enable = true;
         directAccess.enable = true;
       };
-      # ai = {
-      #   enable = true;
-      # };
     };
     services = {
-      # ollama = {
-      #   enable = true;
-      #   exposePort = true;
-      # };
-
       tailscale = {
         enable = true;
         authKeyFile = config.sops.secrets."vpn-keys/tailscale-authkey/twilight".path;