Isolate the LLM server from the internet

.config/containers/systemd/ollama.container

@@ -5,8 +5,9 @@ Description=A local LLM server
 # keep-sorted start
 ContainerName=ollama
 Image=docker.io/ollama/ollama:latest
+Network=ollama.network
 PublishPort=11434:11434
-Volume=%h/.local/share/ollama:/root/.ollama:Z
+Volume=%h/.local/share/ollama:/root/.ollama:ro,z
 # keep-sorted end
 
 [Install]

.config/containers/systemd/ollama.network

@@ -0,0 +1,5 @@
+[Unit]
+Description=Isolated network for my local LLM server
+
+[Network]
+Internal=true

.local/bin/llm-import-model

@@ -0,0 +1,9 @@
+#! /usr/bin/bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+mkdir --parents ~/.local/share/ollama/
+pod_id=$(podman run --detach --rm --volume ~/.local/share/ollama/:/root/.ollama ollama:latest)
+podman exec --interactive --tty "${pod_id}" ollama pull "${1}"
+podman kill "${pod_id}"