Opensearch updates

.gitignore

@@ -52,3 +52,5 @@ site/
 **/*.env
 !*.env.template
 !**/*.env.template
+!deploy/ollama.env
+!deploy/openwebui.env

deploy/Makefile

@@ -351,6 +351,29 @@ start-filebeat-3:
 start-kibana:
 	$(WITH_ENV) docker compose -f services.yml $(DC_START_CMD) kibana
 
+start-ollama: ## Start the Ollama inference service
+	$(WITH_ENV) docker compose -f services.yml $(DC_START_CMD) ollama
+
+pull-ollama-model: start-ollama ## Pull the model configured by OLLAMA_MODEL
+	$(WITH_ENV) docker compose -f services.yml exec -T ollama ollama pull "$${OLLAMA_MODEL}"
+
+setup-ollama: pull-ollama-model ## Start Ollama and pull its configured model
+
+opensearch-ai-init: ## Create or update Ollama-backed OpenSearch chat and PPL assistants
+	$(WITH_ENV) ../scripts/opensearch-ai-init.sh
+
+start-openwebui: ## Start Open WebUI and its Ollama dependency
+	$(WITH_ENV) docker compose -f services.yml $(DC_START_CMD) open-webui
+
+restart-openwebui: ## Restart the Open WebUI container
+	$(WITH_ENV) docker compose -f services.yml restart open-webui
+
+status-openwebui: ## Show Open WebUI and Ollama container status
+	$(WITH_ENV) docker compose -f services.yml ps open-webui ollama
+
+logs-openwebui: ## Follow the Open WebUI logs
+	$(WITH_ENV) docker compose -f services.yml logs --tail=100 -f open-webui
+
 start-samples: ## Start the sample database service
 	$(WITH_ENV) docker compose -f services.yml $(DC_START_CMD) samples-db
 
@@ -379,7 +402,7 @@ start-data-infra: start-nifi start-elastic start-samples ## Start core data infr
 
 start-all: start-data-infra start-medcat-service start-ocr-services ## Start all major services
 
-.PHONY: start-all start-data-infra start-nifi start-nifi-dev start-nifi-dev-build build-nifi-image start-elastic start-samples start-jupyter
+.PHONY: start-all start-data-infra start-nifi start-nifi-dev start-nifi-dev-build build-nifi-image start-elastic start-ollama pull-ollama-model setup-ollama opensearch-ai-init start-openwebui restart-openwebui status-openwebui logs-openwebui start-samples start-jupyter
 
 
 # stop services
@@ -423,6 +446,12 @@ delete-elastic: ## Remove Elasticsearch and Kibana containers
 delete-elastic-volumes: ## Delete Elasticsearch and Kibana volumes
 	$(WITH_ENV) docker compose -f services.yml $(DC_DOWN_CMD) -v elasticsearch-1 elasticsearch-2 elasticsearch-3 kibana
 
+delete-ollama: ## Remove the Ollama container but preserve downloaded models
+	$(WITH_ENV) docker compose -f services.yml rm -f -s ollama
+
+delete-openwebui: ## Remove the Open WebUI container but preserve its data
+	$(WITH_ENV) docker compose -f services.yml rm -f -s open-webui
+
 delete-databank:
 	$(WITH_ENV) docker compose -f services.yml rm -f -s cogstack-databank-db cogstack-databank-db-mssql
 
@@ -494,6 +523,12 @@ stop-filebeat-3:
 stop-kibana:
 	$(WITH_ENV) docker compose -f services.yml $(DC_STOP_CMD) kibana
 
+stop-ollama: ## Stop the Ollama inference service
+	$(WITH_ENV) docker compose -f services.yml $(DC_STOP_CMD) ollama
+
+stop-openwebui: ## Stop the Open WebUI service
+	$(WITH_ENV) docker compose -f services.yml $(DC_STOP_CMD) open-webui
+
 stop-samples: ## Stop the sample database service
 	$(WITH_ENV) docker compose -f services.yml $(DC_STOP_CMD) samples-db
 
@@ -522,7 +557,7 @@ stop-data-infra: stop-nifi stop-elastic stop-samples ## Stop core data infrastru
 
 stop-all: stop-data-infra stop-jupyter stop-medcat-service stop-ocr-services ## Stop all major services
 
-.PHONY: stop-data-infra stop-nifi stop-nifi-dev delete-nifi delete-nifi-containers delete-nifi-dev-containers delete-nifi-images delete-nifi-dev-images delete-nifi-volumes delete-elastic delete-elastic-volumes delete-databank delete-databank-volumes delete-samples-db delete-samples-db-volumes delete-medcat-trainer delete-medcat-trainer-volumes delete-jupyter delete-medcat-service delete-medcat-service-deid delete-ocr-services make-delete-jupyter make-delete-medcat-service make-delete-medcat-service-deid make-delete-ocr-services stop-elastic stop-samples stop-jupyter
+.PHONY: stop-data-infra stop-nifi stop-nifi-dev delete-nifi delete-nifi-containers delete-nifi-dev-containers delete-nifi-images delete-nifi-dev-images delete-nifi-volumes delete-elastic delete-elastic-volumes delete-ollama delete-openwebui delete-databank delete-databank-volumes delete-samples-db delete-samples-db-volumes delete-medcat-trainer delete-medcat-trainer-volumes delete-jupyter delete-medcat-service delete-medcat-service-deid delete-ocr-services make-delete-jupyter make-delete-medcat-service make-delete-medcat-service-deid make-delete-ocr-services stop-elastic stop-ollama stop-openwebui stop-samples stop-jupyter
 
 
 # cleanup

deploy/elasticsearch.env

@@ -106,6 +106,29 @@ ELASTICSEARCH_DOCKER_SHM_SIZE=512m
 ELASTICSEARCH_DOCKER_LOG_SIZE_PER_FILE="1000m"
 ELASTICSEARCH_DOCKER_LOG_NUM_FILES=10
 
+# OpenSearch ML Commons bootstrap settings. Connector timeouts are seconds;
+# the Dashboards opensearch.requestTimeout setting is milliseconds.
+OPENSEARCH_AI_OPENSEARCH_CONTAINER=elasticsearch-1
+# Local development credentials; update these when the OpenSearch admin login
+# is rotated or override them when invoking the bootstrap script.
+OPENSEARCH_AI_OPENSEARCH_USER=admin
+OPENSEARCH_AI_OPENSEARCH_PASSWORD=admin
+OPENSEARCH_AI_CONNECTION_TIMEOUT_SECONDS=120
+OPENSEARCH_AI_READ_TIMEOUT_SECONDS=360
+OPENSEARCH_AI_DEPLOY_TIMEOUT_SECONDS=300
+OPENSEARCH_AI_MAX_TOKENS=256
+OPENSEARCH_AI_REASONING_EFFORT=none
+
+# Stable resource names let scripts/opensearch-ai-init.sh safely find and
+# update resources instead of creating duplicates on every run.
+OPENSEARCH_AI_CHAT_CONNECTOR_NAME="Ollama Qwen Agent Connector"
+OPENSEARCH_AI_CHAT_MODEL_NAME="Qwen 3.5 Ollama Agent Model"
+OPENSEARCH_AI_CHAT_AGENT_NAME="Qwen 3.5 Conversational Agent v2"
+OPENSEARCH_AI_ROOT_AGENT_NAME="Qwen Dashboards Root Agent"
+OPENSEARCH_AI_PPL_CONNECTOR_NAME="Ollama Qwen PPL Connector"
+OPENSEARCH_AI_PPL_MODEL_NAME="Qwen 3.5 Ollama PPL Model"
+OPENSEARCH_AI_PPL_AGENT_NAME="Qwen PPL Query Assist Agent"
+
 # disables swapping, imporving r/w performance (at the expense of RAM)
 ELASTICSEARCH_BOOTSTRAP_MEMORY_LOCK=true
 

deploy/export_env_vars.sh

@@ -29,6 +29,8 @@ env_files=(
   "$DEPLOY_DIR/general.env"
   "$DEPLOY_DIR/nifi.env"
   "$DEPLOY_DIR/elasticsearch.env"
+  "$DEPLOY_DIR/ollama.env"
+  "$DEPLOY_DIR/openwebui.env"
   "$DEPLOY_DIR/database.env"
   "$DEPLOY_DIR/network_settings.env"
   "$DEPLOY_DIR/project.env"

deploy/general.env

@@ -21,6 +21,6 @@ VOLUME_PREFIX=deploy_
 DEPLOYMENT_ENV_FILE_PATH_GENERAL=../../../deploy/general.env
 
 # this is the default, for containers which dont rely on individual settings
-DOCKER_SHM_SIZE=1g
+DOCKER_SHM_SIZE=512m
 DOCKER_LOG_SIZE_PER_FILE="100m"
 DOCKER_LOG_NUM_FILES=10

deploy/ollama.env

@@ -0,0 +1,31 @@
+####################################################################### Ollama Env vars #######################################################################
+
+# Official Ollama server image.
+OLLAMA_DOCKER_IMAGE=ollama/ollama:latest
+OLLAMA_CONTAINER_NAME=cogstack-ollama
+
+# Ollama listens on every container interface so OpenSearch can reach it over
+# cogstack-net. The published host port remains bound to loopback in services.yml.
+OLLAMA_HOST=0.0.0.0:11434
+OLLAMA_OUTPUT_HOST=127.0.0.1
+OLLAMA_OUTPUT_PORT=11434
+
+# Default model for CogStack Q&A setup. This variable documents the selected
+# model; pull it once after starting Ollama (see the command below).
+OLLAMA_MODEL=qwen3.5:9b-q4_K_M
+
+# A 16K context provides room for OpenSearch agent instructions, mappings,
+# tool definitions, and retrieved documents without paying for the full 256K
+# context window in memory.
+OLLAMA_CONTEXT_LENGTH=16384
+
+# Keep one model resident and avoid excessive memory use alongside OpenSearch.
+OLLAMA_KEEP_ALIVE=5m
+OLLAMA_MAX_LOADED_MODELS=1
+OLLAMA_NUM_PARALLEL=1
+
+# Docker resource allocation.
+OLLAMA_DOCKER_CPU_MIN=1
+OLLAMA_DOCKER_CPU_MAX=4
+OLLAMA_DOCKER_RAM_MIN=2g
+OLLAMA_DOCKER_RAM=16g

deploy/openwebui.env

@@ -0,0 +1,39 @@
+###################################################################### Open WebUI Env vars ######################################################################
+
+# Official Open WebUI image. Pin this tag to a numbered release when a
+# reproducible production deployment is required.
+OPENWEBUI_DOCKER_IMAGE=ghcr.io/open-webui/open-webui:main
+OPENWEBUI_CONTAINER_NAME=cogstack-open-webui
+
+# Open WebUI reaches Ollama through the private Compose network. Do not use
+# localhost here because localhost inside this container is Open WebUI itself.
+OLLAMA_BASE_URL=http://ollama:11434
+
+# The first account registered becomes the administrator. After creating it,
+# signups can be disabled from the Open WebUI Admin Panel.
+WEBUI_AUTH=true
+ENABLE_SIGNUP=true
+DEFAULT_USER_ROLE=user
+WEBUI_NAME=CogStack
+
+# Leave this empty when using the official image entrypoint. It generates a
+# random key and persists it in the openwebui-data volume on first startup.
+WEBUI_SECRET_KEY=
+
+# Browser-facing address. Port 3001 avoids the existing Gitea port 3000.
+WEBUI_URL=http://localhost:3001
+OPENWEBUI_OUTPUT_HOST=127.0.0.1
+OPENWEBUI_OUTPUT_PORT=3001
+
+# Open WebUI is lightweight compared with model inference, which stays in the
+# separate Ollama container.
+OPENWEBUI_DOCKER_CPU_MIN=0.25
+OPENWEBUI_DOCKER_CPU_MAX=1
+OPENWEBUI_DOCKER_RAM_MIN=256m
+OPENWEBUI_DOCKER_RAM=2g
+
+# Disable optional usage reporting and update checks in this local deployment.
+ANONYMIZED_TELEMETRY=false
+DO_NOT_TRACK=true
+SCARF_NO_ANALYTICS=true
+ENABLE_VERSION_UPDATE_CHECK=false

deploy/services.yml

@@ -139,6 +139,9 @@ x-es-common-volumes: &es-common-volumes
   - ../security/es_roles/opensearch/internal_users.yml:/usr/share/opensearch/config/opensearch-security/internal_users.yml:ro
   - ../security/es_roles/opensearch/roles_mapping.yml:/usr/share/opensearch/config/opensearch-security/roles_mapping.yml:ro
   - ../security/es_roles/opensearch/roles.yml:/usr/share/opensearch/config/opensearch-security/roles.yml:ro
+  # Shared local ML model repository. Register files with a
+  # file:///usr/share/opensearch/models/<model>.zip URL.
+  - ../services/elasticsearch/models:/usr/share/opensearch/models:ro
   # Shared system settings
   - ../services/elasticsearch/sysctl.conf:/etc/sysctl.conf:ro
   # Shared snapshot mounts
@@ -475,6 +478,73 @@ services:
     extra_hosts: *common-hosts
     logging: *es-logging-common
 
+#---------------------------------------------------------------------------#
+# Ollama local model inference                                              #
+#---------------------------------------------------------------------------#
+  ollama:
+    image: ${OLLAMA_DOCKER_IMAGE:-ollama/ollama:latest}
+    container_name: ${OLLAMA_CONTAINER_NAME:-cogstack-ollama}
+    platform: ${DOCKER_DEFAULT_PLATFORM:-linux/amd64}
+    restart: unless-stopped
+    env_file:
+      - ./ollama.env
+    deploy:
+      resources:
+        limits:
+          cpus: "${OLLAMA_DOCKER_CPU_MAX:-4}"
+          memory: "${OLLAMA_DOCKER_RAM:-12g}"
+        reservations:
+          cpus: "${OLLAMA_DOCKER_CPU_MIN:-1}"
+          memory: "${OLLAMA_DOCKER_RAM_MIN:-2g}"
+    volumes:
+      - ollama-models:/root/.ollama
+    ports:
+      # Keep the unauthenticated Ollama API local to the Docker host.
+      - "${OLLAMA_OUTPUT_HOST:-127.0.0.1}:${OLLAMA_OUTPUT_PORT:-11434}:11434"
+    expose:
+      - "11434"
+    networks:
+      - cognet
+    logging: *logging-common
+    healthcheck:
+      test: ["CMD", "ollama", "list"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 20s
+
+#---------------------------------------------------------------------------#
+# Open WebUI for local Ollama chat and model management                      #
+#---------------------------------------------------------------------------#
+  open-webui:
+    image: ${OPENWEBUI_DOCKER_IMAGE:-ghcr.io/open-webui/open-webui:main}
+    container_name: ${OPENWEBUI_CONTAINER_NAME:-cogstack-open-webui}
+    platform: ${DOCKER_DEFAULT_PLATFORM:-linux/amd64}
+    restart: unless-stopped
+    env_file:
+      - ./openwebui.env
+    depends_on:
+      ollama:
+        condition: service_healthy
+    deploy:
+      resources:
+        limits:
+          cpus: "${OPENWEBUI_DOCKER_CPU_MAX:-1}"
+          memory: "${OPENWEBUI_DOCKER_RAM:-2g}"
+        reservations:
+          cpus: "${OPENWEBUI_DOCKER_CPU_MIN:-0.25}"
+          memory: "${OPENWEBUI_DOCKER_RAM_MIN:-256m}"
+    volumes:
+      - openwebui-data:/app/backend/data
+    ports:
+      # Port 3000 is already used by Gitea in this Compose project.
+      - "${OPENWEBUI_OUTPUT_HOST:-127.0.0.1}:${OPENWEBUI_OUTPUT_PORT:-3001}:8080"
+    expose:
+      - "8080"
+    networks:
+      - cognet
+    logging: *logging-common
+
 #---------------------------------------------------------------------------#
 # NiFi webapp                                                               #
 #---------------------------------------------------------------------------#
@@ -632,6 +702,14 @@ volumes:
   filebeat-data-3:
     driver: local
 
+  # Ollama model cache
+  ollama-models:
+    driver: local
+
+  # Open WebUI database, uploads, configuration, and generated secret key
+  openwebui-data:
+    driver: local
+
   # NiFi related
   nifi-vol-logs:
     driver: local

docs/deploy/configuration.md

@@ -24,6 +24,7 @@ The core Compose file, `deploy/services.yml`, loads these files:
 | `deploy/general.env` | General Docker logging and shared defaults |
 | `deploy/nifi.env` | NiFi image, ports, resources, proxy settings, and paths |
 | `deploy/elasticsearch.env` | Elasticsearch/OpenSearch, Dashboards/Kibana, and Beats |
+| `deploy/ollama.env` | Ollama image, model selection, port, and resource limits |
 | `deploy/database.env` | Sample and production database resources |
 | `deploy/gitea.env` | Gitea image, ports, and application settings |
 | `deploy/nginx.env` | NiFi nginx proxy settings |