diff --git a/ai.yaml b/ai.yaml
new file mode 100644
index 0000000..98a23f0
--- /dev/null
+++ b/ai.yaml
@@ -0,0 +1,204 @@
+services:
+  open-webui:
+    image: ghcr.io/open-webui/open-webui:main
+    entrypoint:
+    - /bin/bash
+    - /app/tools/startup.sh
+    healthcheck:
+      test:
+      - CMD
+      - curl
+      - -f
+      - http://localhost:8080/health
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    environment:
+    - OLLAMA_BASE_URL=http://ollama-intel-arc:11434
+    - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
+    - WEBUI_DB_HOST=postgresql
+    - DATABASE_URL=${OPEN_WEBUI_DATABASE_URL}
+    - ENABLE_TOOL_SERVER_CALLING=true
+    - TOOL_SERVER_CALLING=true
+    - WEBUI_URL=${WEBUI_URL}
+    - ENABLE_OAUTH_SIGNUP=${ENABLE_OAUTH_SIGNUP}
+    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
+    - OAUTH_PROVIDER_NAME=${OAUTH_PROVIDER_NAME}
+    - OPENID_PROVIDER_URL=${OPENID_PROVIDER_URL}
+    - OAUTH_CLIENT_ID=${OAUTH_CLIENT_ID}
+    - OAUTH_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
+    - OAUTH_SCOPES=${OAUTH_SCOPES}
+    - OPENID_REDIRECT_URI=${OPENID_REDIRECT_URI}
+    networks:
+    - traefik_backend
+    - postgresql_db-backend
+    extra_hosts:
+    - host.docker.internal:host-gateway
+    volumes:
+    - /volume1/docker/open-webui/data:/app/backend/data
+    - /volume1/docker/open-webui/startup.sh:/app/tools/startup.sh
+    stop_grace_period: 120s
+    deploy:
+      replicas: 2
+      placement:
+        max_replicas_per_node: 1
+      labels:
+      - traefik.enable=true
+      - traefik.http.routers.open-webui.rule=Host(`ai.bryanmail.net`)
+      - traefik.http.routers.open-webui.tls=true
+      - traefik.http.routers.open-webui.tls.certresolver=letsencrypt
+      - traefik.http.routers.open-webui.entrypoints=websecure
+      - traefik.http.services.open-webui.loadbalancer.server.port=8080
+      - traefik.http.services.open-webui.loadbalancer.server.scheme=http
+      - traefik.http.services.open-webui.loadbalancer.sticky.cookie=true
+      - traefik.http.services.open-webui.loadbalancer.sticky.cookie.name=owui_sticky
+      - traefik.http.services.open-webui.loadbalancer.sticky.cookie.secure=true
+      - traefik.http.services.open-webui.loadbalancer.sticky.cookie.httponly=true
+      - traefik.swarm.network=traefik_backend
+  litellm:
+    image: docker.litellm.ai/berriai/litellm:1.90.0
+    command: --config /app/config.yaml --port 4000
+    environment:
+    - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
+    - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
+    - AWS_REGION_NAME=${AWS_REGION_NAME}
+    - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY}
+    - LITELLM_SALT_KEY=${LITELLM_SALT_KEY}
+    - DATABASE_URL=${DATABASE_URL}
+    - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    - LITELLM_MODIFY_PARAMS=${LITELLM_MODIFY_PARAMS}
+    networks:
+    - traefik_backend
+    - postgresql_db-backend
+#    ports:
+#    - target: 4000
+#      published: 4000
+#      protocol: tcp
+#      mode: ingress
+    volumes:
+    - type: bind
+      source: /volume1/docker/litellm/app/config.yaml
+      target: /app/config.yaml
+      read_only: true
+    deploy:
+      labels:
+      - traefik.enable=true
+      - traefik.http.routers.litellm.rule=Host(`llm.bryanmail.net`)
+      - traefik.http.routers.litellm.tls=true
+      - traefik.http.routers.litellm.tls.certresolver=letsencrypt
+      - traefik.http.routers.litellm.entrypoints=websecure
+      - traefik.http.services.litellm.loadbalancer.server.port=4000
+      - traefik.http.services.litellm.loadbalancer.server.scheme=http
+      - traefik.swarm.network=traefik_backend
+      - traefik.http.routers.litellm.middlewares=forwardAuth-authentik@file, crowdsec@file,
+        litellm-headers
+      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Forwarded-For=
+      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Forwarded-Host=
+      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Forwarded-Proto=
+      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Forwarded-Port=
+      - traefik.http.middlewares.litellm-headers.headers.customrequestheaders.X-Real-Ip=
+      update_config:
+        parallelism: 1
+        delay: 15s
+        failure_action: rollback
+  searxng:
+    image: searxng/searxng:latest
+    environment:
+    - SEARXNG_BASE_URL=http://searxng:8080
+    volumes:
+    - /volume1/docker/searxng/etc/searxng:/etc/searxng
+    networks:
+    - traefik_backend
+  mcpo-critical: #do not modify or Proxmox access will be lost
+    image: ghcr.io/open-webui/mcpo:main
+    command:
+    - --config
+    - /app/config/config.json
+    - --api-key
+    - ${MCPO_API_KEY}
+    - --hot-reload
+    environment:
+    - PROXMOX_ALLOW_UNSAFE_COMMANDS=false #true
+    volumes:
+    - /volume1/docker/mcpo/config-critical.json:/app/config/config.json:ro
+    - /volume1/docker/mcpo/data:/mcpo_data
+    - /volume1/docker/cronicle/ssh_keys:/app/ssh_keys:ro
+#    - /volume1/docker/mcpo/teams-mcp-auth:/app/teams-mcp-auth
+    - /volume1/docker/mcpo/uv-cache:/app/uv-cache
+    networks:
+    - traefik_backend
+    deploy:
+      labels:
+      - traefik.enable=false
+#      - traefik.http.routers.mcp.rule=Host(`mcpc.bryanmail.net`)
+#      - traefik.http.routers.mcp.tls=true
+#      - traefik.http.routers.mcp.tls.certresolver=letsencrypt
+#      - traefik.http.routers.mcp.entrypoints=websecure
+#      - traefik.http.services.mcp.loadbalancer.server.port=8000
+#      - traefik.http.services.mcp.loadbalancer.server.scheme=http
+#      - traefik.http.routers.mcp.middlewares=forwardAuth-authentik@file, crowdsec@file
+#      - traefik.swarm.network=traefik_backend
+  mcpo:
+    image: ghcr.io/open-webui/mcpo:main
+    command:
+    - --config
+    - /app/config/config.json
+    - --api-key
+    - ${MCPO_API_KEY}
+    - --hot-reload
+    environment:
+    - PROXMOX_ALLOW_UNSAFE_COMMANDS=true
+    volumes:
+    - /volume1/docker/mcpo/config.json:/app/config/config.json:ro
+    - /volume1/docker/mcpo/data:/mcpo_data
+    - /volume1/docker/cronicle/ssh_keys:/app/ssh_keys:ro
+#    - /volume1/docker/mcpo/teams-mcp-auth:/app/teams-mcp-auth
+    - /volume1/docker/mcpo/uv-cache:/app/uv-cache
+    networks:
+    - traefik_backend
+    deploy:
+      labels:
+      - traefik.enable=false
+#      - traefik.http.routers.mcp.rule=Host(`mcp.bryanmail.net`)
+#      - traefik.http.routers.mcp.tls=true
+#      - traefik.http.routers.mcp.tls.certresolver=letsencrypt
+#      - traefik.http.routers.mcp.entrypoints=websecure
+#      - traefik.http.services.mcp.loadbalancer.server.port=8000
+#      - traefik.http.services.mcp.loadbalancer.server.scheme=http
+#      - traefik.http.routers.mcp.middlewares=forwardAuth-authentik@file, crowdsec@file
+#      - traefik.swarm.network=traefik_backend
+  n8n:
+    image: docker.n8n.io/n8nio/n8n
+    networks:
+    - traefik_backend
+    - postgresql_db-backend
+#    ports:
+#    - 5678:5678
+    volumes:
+    - /volume1/docker/n8n/data:/home/node/.n8n
+    - /volume1/docker/n8n/files:/files
+    deploy:
+      labels:
+      - traefik.enable=true
+      - traefik.http.routers.n8n.rule=Host(`agent.bryanmail.net`)
+      - traefik.http.routers.n8n.tls=true
+      - traefik.http.routers.n8n.tls.certresolver=letsencrypt
+      - traefik.http.routers.n8n.entrypoints=websecure
+      - traefik.http.services.n8n.loadbalancer.server.port=5678
+      - traefik.http.services.n8n.loadbalancer.server.scheme=http
+      - traefik.http.middlewares.n8n.headers.SSLRedirect=true
+      - traefik.http.middlewares.n8n.headers.STSSeconds=315360000
+      - traefik.http.middlewares.n8n.headers.browserXSSFilter=true
+      - traefik.http.middlewares.n8n.headers.contentTypeNosniff=true
+      - traefik.http.middlewares.n8n.headers.forceSTSHeader=true
+      - traefik.http.middlewares.n8n.headers.SSLHost=${DOMAIN_NAME}
+      - traefik.http.middlewares.n8n.headers.STSIncludeSubdomains=true
+      - traefik.http.middlewares.n8n.headers.STSPreload=true
+      - traefik.http.routers.n8n.middlewares=forwardAuth-authentik@file, crowdsec@file
+      - traefik.swarm.network=traefik_backend
+networks:
+  traefik_backend:
+    external: true
+  postgresql_db-backend:
+    external: true