feat: containerize Ollama scripts with Flux image automation

Package ollama management scripts into a container image for in-cluster
execution as a K8s Job. Refactors update-model.sh to use Ollama HTTP API
directly (via service DNS) instead of kubectl exec, with auto-detection
of in-cluster vs Mac execution mode. Adds GHA workflow to build/push
the image on changes, and Flux ImageAutomation to auto-update the Job
manifest when new images are available.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: web-flow

.github/workflows/build-ollama-scripts.yaml

@@ -0,0 +1,47 @@
+name: Build Ollama Scripts
+
+on:
+  push:
+    paths:
+      - 'scripts/ollama/**'
+    branches:
+      - master
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository_owner }}/ollama-scripts
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,prefix=,format=short
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: scripts/ollama
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

gitops/clusters/homelab/apps/ollama/job-model-update.yaml

@@ -0,0 +1,29 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ollama-model-update
+  namespace: ollama
+  annotations:
+    description: "Pull new Ollama model and remove old one via HTTP API"
+spec:
+  ttlSecondsAfterFinished: 86400
+  backoffLimit: 2
+  activeDeadlineSeconds: 600
+  template:
+    metadata:
+      labels:
+        app: ollama-model-update
+    spec:
+      restartPolicy: OnFailure
+      imagePullSecrets:
+        - name: ghcr-creds
+      containers:
+        - name: model-update
+          image: ghcr.io/homeiac/ollama-scripts:INITIAL # {"$imagepolicy": "flux-system:ollama-scripts"}
+          env:
+            - name: NEW_MODEL
+              value: "qwen3:4b"
+            - name: OLD_MODEL
+              value: "qwen2.5:3b"
+            - name: OLLAMA_URL
+              value: "http://ollama-gpu.ollama.svc:80"

gitops/clusters/homelab/apps/ollama/kustomization.yaml

@@ -6,4 +6,5 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
-
+  - job-model-update.yaml
+  - secrets/ghcr-creds.sops.yaml

gitops/clusters/homelab/apps/ollama/secrets/ghcr-creds.sops.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ghcr-creds
+    namespace: ollama
+type: kubernetes.io/dockerconfigjson
+stringData:
+    .dockerconfigjson: ENC[AES256_GCM,data:zlRqVDMP9CN6cCZDkNWOOYD+00ozRPsiM2yln99l5Znyj4O0Wcad9rMf9WW+Y+Cl/Nkac1m9JeLwzatlwP9A2stGQMow67EDXflx1XWdmI8mZpyonhRk3qM6n3uSXKvceOd4FpQtMgsgsoaqo/AvYT4bi7LNL9yyarcgMEwXHJetTNs7wZILMmoJLFoZ9VxtAInMJGXlJviNXisMCDLUT7g2ZnMHWMK6vlg0qg==,iv:aukokOBL3IHL6JqFKxKLhKTvMFRt57GCKd5WhwJdi/k=,tag:Qtamug5yONtPFLshhHZDzA==,type:str]
+sops:
+    age:
+        - recipient: age1uwvq3llqjt666t4ckls9wv44wcpxxwlu8svqwx5kc7v76hncj94qg3tsna
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBySVNoTFNqZVJQMUE1d0hZ
+            ckZ5aXdDb3pOSDNWL3BpQjloc2RiS1BxU2dZCko5RysyUDE5NU53ejZ6Yi9ocU9L
+            MUt2emhVK0ZOdmxnU2hyMm9wdWVtUFEKLS0tIEcxcCsvRUFiSmthdVQ5a0dYazRm
+            YXFRYVBUMUdoeGNtWHhJUjFXenRiTWMKK8XMVKycTOqG4SC+2nF8SxzDKZI0xWnY
+            aPiAhlCcetAQEFEw62G+sPaFIVjOD1wxJzct73de+0y1QiegX+DDmw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-26T19:13:42Z"
+    mac: ENC[AES256_GCM,data:5Smqq98kT8GdUExFilAWJ3QBkldTRn9pABqHkfMAQQK+fApRfwG2bOZVRFkN/Fn5BkXLAN23wx2CSMpQyRPereQfOlIQd9cuXOiSNvLC9RdP+jqRyXbQzVbZhrDvvKO/Y3bL6N8d14sjazx9X1Zd85S16NlGuknRHg7GGJ9eR6o=,iv:ZM0Pd+DTqnSmRyK+ig45txZ8igNI8GxrU1NX5qwnGyY=,tag:6kIgIUNH+c8Vs61y54Z1Cw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

gitops/clusters/homelab/flux-system/image-automation-ollama-scripts.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+  name: ollama-scripts
+  namespace: flux-system
+spec:
+  image: ghcr.io/homeiac/ollama-scripts
+  interval: 5m
+  secretRef:
+    name: ghcr-creds
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+  name: ollama-scripts
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: ollama-scripts
+  filterTags:
+    pattern: '^[a-f0-9]{7}$'
+  policy:
+    alphabetical:
+      order: desc
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageUpdateAutomation
+metadata:
+  name: ollama-scripts
+  namespace: flux-system
+spec:
+  interval: 5m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  git:
+    checkout:
+      ref:
+        branch: master
+    commit:
+      author:
+        name: fluxcdbot
+        email: fluxcd@homelab.local
+      messageTemplate: |
+        chore(flux): update ollama-scripts image to {{range .Changed.Changes}}{{.NewValue}}{{end}}
+    push:
+      branch: master
+  update:
+    path: ./gitops/clusters/homelab/apps/ollama
+    strategy: Setters

gitops/clusters/homelab/flux-system/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
 - image-automation-pve-nut.yaml
 - image-automation-proxmox-provisioner.yaml
 - image-automation-frigate-health-checker.yaml
+- image-automation-ollama-scripts.yaml

scripts/ollama/Dockerfile

@@ -0,0 +1,14 @@
+FROM alpine:3.19
+
+RUN apk add --no-cache \
+    bash \
+    curl \
+    jq
+
+WORKDIR /app
+
+COPY update-model.sh check-ollama.sh test-inference.sh /app/
+
+RUN chmod +x /app/*.sh
+
+ENTRYPOINT ["/app/update-model.sh"]