fix wordpress

Adds the ollama/ollama container on port 11434, a persistent model
store at /var/ollama, and a oneshot service that pulls the model on
first boot. Opens port 11434 in the firewall.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nixos/atitraining/Dockerfile

@@ -5,17 +5,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         less \
         default-mysql-client \
         unzip \
+        subversion \
     && curl -sL -o /usr/local/bin/wp \
        https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar \
     && chmod +x /usr/local/bin/wp \
     && rm -rf /var/lib/apt/lists/*
 
-# Pre-install the p2 theme.
+# Pre-install the p2 theme via SVN (removed from downloads.wordpress.org).
-# p2 turns WordPress into a real-time microblog stream (Twitter-like) —
+RUN svn export https://themes.svn.wordpress.org/p2/1.5.8/ /var/www/html/wp-content/themes/p2 \
-# intentionally weird for a traditional blog context.
-RUN curl -sL https://downloads.wordpress.org/theme/p2.zip -o /tmp/p2.zip \
-    && unzip -q /tmp/p2.zip -d /var/www/html/wp-content/themes/ \
-    && rm /tmp/p2.zip \
     && chown -R www-data:www-data /var/www/html/wp-content/themes/p2
 
 # Tell WordPress it's behind an HTTPS reverse proxy

nixos/firewall.nix

@@ -13,6 +13,8 @@
 
     5432 #coldairnetworks postgres
     9090 #sync.io
+
+    11434 #ollama
   ];
 
   # Allow DNS from all podman bridge networks (10.89.0.0/16).

nixos/linux.nix

@@ -223,6 +223,26 @@ in {
   systemd.services.arion-atitraining.after = lib.mkAfter [ "build-atitraining-image.service" ];
   systemd.services.arion-atitraining.wants = [ "build-atitraining-image.service" ];
 
+  systemd.services.ollama-pull = {
+    description = "Pull qwen2.5-coder:1.5b model into Ollama";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "podman-ollama.service" ];
+    wants = [ "podman-ollama.service" ];
+    path = [ pkgs.curl ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      until curl -sf http://localhost:11434/api/tags > /dev/null 2>&1; do
+        echo "Waiting for ollama..."
+        sleep 3
+      done
+      curl -sf http://localhost:11434/api/pull \
+        -d '{"name":"qwen2.5-coder:1.5b","stream":false}'
+    '';
+  };
+
   systemd.services.novnc = {
     description = "noVNC WebSocket proxy for VNC desktop";
     wantedBy = [ "multi-user.target" ];
@@ -319,6 +339,7 @@ in {
     "d /var/coldairnetworks-db/ssl 0755 root root"
     "d /var/atitraining/db 0755 root root"
     "d /var/atitraining/wp-uploads 0755 root root"
+    "d /var/ollama 0755 root root"
   ];
 
   networking.hostName = "${hostname}";
@@ -442,6 +463,14 @@ in {
         user = "0"; # run as root
       };
       
+      "ollama" = {
+        autoStart = true;
+        image = "ollama/ollama:latest";
+        ports = ["11434:11434"];
+        volumes = ["/var/ollama:/root/.ollama"];
+        environment = {};
+      };
+
       "blog-quine" = {
         autoStart = true;
         image = "quineglobal/blog-quine@sha256:88097e4867a99a375db490bf7a989c122653cdb48bfdf6d9ad5e2f6a0bfb2d38";