Add LLM compose stack for phy-srv-gpu01 (not deployed yet)

Follows the homelab pattern: ironicbadger.docker_compose_generator v2
renders services/<host>/NN-<stack>/compose.yml templates into
~/docker/compose.yaml on the host.

- 01-vllm: chat model, fixed --gpu-memory-utilization
- 02-embeddings: second vLLM instance (--task embed) rather than a
  separate toolchain, so SM120 support only has to be solved once
- 03-openwebui: Open WebUI + pgvector (not chroma — corpus size)
- 99-network: shared bridge; leading comment keeps networks: top-level
- pin docker_compose_generator to 2.0.1 — galaxy tags mix v1/v2 formats
- group_vars: stack config incl. LDAP placeholders still to be filled

The role only writes the compose file; starting the stack stays manual.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ansible/services/phy-srv-gpu01/03-openwebui/compose.yml

@@ -0,0 +1,62 @@
+services:
+  openwebui:
+    image: "{{ openwebui_image }}"
+    container_name: openwebui
+    networks:
+      - llmnet
+    ports:
+      # plain HTTP for now — no TLS yet (projektplan §2.2). Put a reverse proxy
+      # in front (new stack 04-proxy) once an internal CA certificate exists.
+      - "80:8080"
+    depends_on:
+      - vllm
+      - owui-db
+    volumes:
+      - "{{ appdata_path }}/apps/open-webui:/app/backend/data"
+    environment:
+      - "WEBUI_URL=http://{{ llm_dns_name }}"
+      - "WEBUI_SECRET_KEY={{ vault_owui_secret_key }}"
+
+      # --- inference: vLLM speaks the OpenAI API, Ollama stays off ---
+      - OPENAI_API_BASE_URL=http://vllm:8000/v1
+      - OPENAI_API_KEY=dummy
+      - ENABLE_OLLAMA_API=false
+
+      # --- vector store: pgvector rather than the default chroma, which does
+      #     not scale to the corpus sizes discussed in §2.6 ---
+      - VECTOR_DB=pgvector
+      - "PGVECTOR_DB_URL=postgresql://openwebui:{{ vault_owui_db_password }}@owui-db:5432/openwebui"
+
+      # --- RAG embeddings from the second vLLM instance ---
+      - RAG_EMBEDDING_ENGINE=openai
+      - RAG_OPENAI_API_BASE_URL=http://embeddings:8000/v1
+      - RAG_OPENAI_API_KEY=dummy
+      - "RAG_EMBEDDING_MODEL={{ embedding_model_name }}"
+
+      # --- AD/LDAP login (group llm_users) ---
+      # NOTE: verify these variable names against the Open WebUI docs for the
+      # tag actually deployed — they have changed between releases.
+      - ENABLE_LDAP=true
+      - LDAP_SERVER_LABEL=Phytron AD
+      - "LDAP_SERVER_HOST={{ ldap_server_host }}"
+      - "LDAP_SERVER_PORT={{ ldap_server_port }}"
+      - "LDAP_APP_DN={{ ldap_bind_dn }}"
+      - "LDAP_APP_PASSWORD={{ vault_ldap_bind_password }}"
+      - "LDAP_SEARCH_BASE={{ ldap_search_base }}"
+      - "LDAP_SEARCH_FILTER={{ ldap_search_filter }}"
+      - LDAP_ATTRIBUTE_FOR_USERNAME=sAMAccountName
+      - LDAP_USE_TLS=false
+    restart: unless-stopped
+
+  owui-db:
+    image: "{{ pgvector_image }}"
+    container_name: owui-db
+    networks:
+      - llmnet
+    volumes:
+      - "{{ appdata_path }}/databases/openwebui-pgdata:/var/lib/postgresql/data"
+    environment:
+      - POSTGRES_DB=openwebui
+      - POSTGRES_USER=openwebui
+      - "POSTGRES_PASSWORD={{ vault_owui_db_password }}"
+    restart: unless-stopped