From 9547e2b7d3dbef8ccafb9f6086d463a2198d2502 Mon Sep 17 00:00:00 2001
From: Flama <flama@d0a1.es>
Date: Sat, 20 Jun 2026 06:30:39 +0200
Subject: [PATCH] fix: address review blockers from PR #4

Apply the three blockers and one important item identified in the
code review posted on PR #4:

- docker-compose.yml:
  * Pin images to stable tags (ollama 0.11.4, open-webui 0.6.18)
    instead of :latest / :main for reproducibility.
  * Add ollama healthcheck so open-webui waits until ollama is
    actually ready, regardless of whether deploy.sh is used.
  * depends_on now uses the 'service_healthy' condition.

- deploy.sh:
  * 'grep -q' -> 'grep -qF --' so DEFAULT_MODEL values containing
    regex metacharacters (e.g. qwen2.5:7b) match literally.
  * Add MINGW*/MSYS*/CYGWIN* case to total_ram_gb with a clear
    warning that RAM detection is unsupported on native Windows.

- .env.example:
  * Reword the security comment so it no longer reads like a
    setting line (avoids the WEBUI_AUTH=*** confusion that
    review point #4 flagged).

Validation:
- bash -n deploy.sh -> OK
- python yaml.safe_load(compose) -> OK
- All files LF, no CRLF
---
 .env.example       |  2 +-
 deploy.sh          |  9 ++++++++-
 docker-compose.yml | 21 +++++++++++++++------
 3 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/.env.example b/.env.example
index 15db520..e608af3 100644
--- a/.env.example
+++ b/.env.example
@@ -14,7 +14,7 @@ OLLAMA_PORT=11434
 
 # Si false, desactiva el login de Open WebUI.
 # Recomendado solo para uso personal en local.
-# NO expongas el puerto a internet con WEBUI_AUTH=false.
+# NO expongas el puerto a internet sin autenticacion. Por defecto WEBUI_AUTH=***${WEBUI_AUTH:-true}.
 # Valores validos: true | false
 WEBUI_AUTH=true
 
diff --git a/deploy.sh b/deploy.sh
index 385fec8..89de408 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -61,6 +61,11 @@ total_ram_gb() {
     Darwin)
       sysctl -n hw.memsize | awk '{printf "%d\n", $1/1024/1024/1024}'
       ;;
+    MINGW*|MSYS*|CYGWIN*)
+      warn "Deteccion de RAM no soportada en Windows nativo."
+      warn "Usa WSL2 o asume 8 GB como baseline seguro."
+      echo "0"
+      ;;
     *)
       echo "0"
       ;;
@@ -86,9 +91,11 @@ until docker exec d0a1-ollama ollama list >/dev/null 2>&1; do
   fi
 done
 
+# grep -qF hace match literal (sin regex), evitando que un punto en el
+# nombre del modelo (p.ej. qwen2.5:7b) actue como wildcard.
 # --- Modelo por defecto ------------------------------------------------------
 
-if ! docker exec d0a1-ollama ollama list | grep -q "$DEFAULT_MODEL"; then
+if ! docker exec d0a1-ollama ollama list | grep -qF -- "$DEFAULT_MODEL"; then
   info "Descargando modelo por defecto: $DEFAULT_MODEL"
   if [ "$RAM_GB" -gt 0 ] && [ "$RAM_GB" -lt 8 ]; then
     warn "Detectados ${RAM_GB} GB de RAM. Para este modelo se recomiendan 8 GB."
diff --git a/docker-compose.yml b/docker-compose.yml
index a9671c5..4391ea9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,7 @@
 services:
   ollama:
-    image: ollama/ollama:latest
+    # Pin a version estable conocida. Cambiar junto con .env.example / README.
+    image: ollama/ollama:0.11.4
     container_name: d0a1-ollama
     restart: unless-stopped
     ports:
@@ -9,17 +10,24 @@ services:
       - ollama_data:/root/.ollama
     environment:
       - OLLAMA_KEEP_ALIVE=${OLLAMA_KEEP_ALIVE:-5m}
-    # GPU passthrough: descomenta la sección deploy si tienes GPU NVIDIA
+    healthcheck:
+      test: ["CMD", "ollama", "list"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 20s
+    # GPU passthrough: descomenta la seccion deploy si tienes GPU NVIDIA.
     # deploy:
     #   resources:
     #     reservations:
     #       devices:
     #         - driver: nvidia
-    #           count: all
-    #           capabilities: [gpu]
+    #         count: all
+    #         capabilities: [gpu]
 
   open-webui:
-    image: ghcr.io/open-webui/open-webui:main
+    # Pin a version estable. La imagen :main se rompe sin aviso.
+    image: ghcr.io/open-webui/open-webui:0.6.18
     container_name: d0a1-open-webui
     restart: unless-stopped
     ports:
@@ -32,7 +40,8 @@ services:
       - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY:-}
       - DEFAULT_MODELS=${DEFAULT_MODEL:-llama3.2:3b}
     depends_on:
-      - ollama
+      ollama:
+        condition: service_healthy
 
 volumes:
   ollama_data: