Bring 15 stale entries in line with current private configs

Several of these had drifted so far they were unrecognizable (Nextcloud
was a bare minio stub, Ollama was missing the ollama service entirely,
Immich was missing 2 of 4 services). Also removed a real, exposed
Authentik OAuth client_id/secret that was sitting in Paperless-NGX's
entry (confirmed stale/rotated already, but shouldn't have been public
regardless) and stripped internal Caddy CA trust details from every
file per the same rule applied to nocodb/dashy etc.

Docker/Ollama/docker-compose.yaml

@@ -1,14 +1,44 @@
 services:
-  open-webui:
-    image: ghcr.io/open-webui/open-webui:ollama 
-    container_name: open-webui
-    environment:
-      - PUID=${PUID}
-      - PGID=${PGID}
-      - TZ=${TZ}
-    ports:
-      - ${HTTP_PORT}:8080
+  ollama:
+    # Uncomment below for GPU support
+    # deploy:
+    #   resources:
+    #     reservations:
+    #       devices:
+    #         - driver: nvidia
+    #           count: 1
+    #           capabilities:
+    #             - gpu
     volumes:
-      - /path/to/open-webui/ollama:/root/.ollama
-      - /path/to/open-webui/app:/app/backend/data
+      - /path/to/ollama:/root/.ollama
+    # Uncomment below to expose Ollama API outside the container stack
+    ports:
+      - "${HTTP_PORT2}:11434"
+    container_name: ollama
+    pull_policy: always
+    tty: true
     restart: unless-stopped
+    image: ollama/ollama:latest
+    networks:
+      - openai-net
+
+  open-webui:
+    image: ghcr.io/open-webui/open-webui:latest
+    container_name: open-webui
+    volumes:
+      - /path/to/open-webui:/app/backend/data
+    depends_on:
+      - ollama
+    ports:
+      - "${HTTP_PORT}:8080"
+    environment:
+      - "OLLAMA_BASE_URL=http://ollama:11434"
+    extra_hosts:
+      - host.docker.internal:host-gateway
+    restart: unless-stopped
+    networks:
+      - openai-net
+
+networks:
+  openai-net:
+    external: true