Arbiter's LLM-as-a-Judge configuration is entirely runtime. An OllamaInstance is created through Admin → LLM-as-a-Judge and stored in MongoDB, so an operator deploying Arbiter from a container image cannot bring it up already configured. Every fresh deployment needs a human to click through the admin UI before Second Opinion works.
This blocks the Philterd Appliance, which runs Ollama alongside Arbiter on the same box. The appliance knows the endpoint is http://ollama:11434, but has no way to tell Arbiter.
The related arbiter.data-sources.allowed-hosts half is already solvable, since it is a Spring @Value property and binds from the environment. Only the instance registration is stuck in the database.
Proposal
Seed a default Ollama instance from configuration when none exists, in the same spirit as ARBITER_ADMIN_INITIAL_PASSWORD: applied on first start, ignored once an instance is present, so it never fights an operator's UI changes.
arbiter.llm.ollama.url=http://ollama:11434
arbiter.llm.ollama.model=gemma3:4b
arbiter.llm.ollama.name=Local
arbiter.llm.ollama.default=true
Seeding must still respect the data-source host allow-list. A seeded instance pointing at a private-range host should be created but rejected at call time unless the host is allow-listed, rather than the seed quietly bypassing the SSRF guard.
Acceptance Criteria
Arbiter's LLM-as-a-Judge configuration is entirely runtime. An
OllamaInstanceis created through Admin → LLM-as-a-Judge and stored in MongoDB, so an operator deploying Arbiter from a container image cannot bring it up already configured. Every fresh deployment needs a human to click through the admin UI before Second Opinion works.This blocks the Philterd Appliance, which runs Ollama alongside Arbiter on the same box. The appliance knows the endpoint is
http://ollama:11434, but has no way to tell Arbiter.The related
arbiter.data-sources.allowed-hostshalf is already solvable, since it is a Spring@Valueproperty and binds from the environment. Only the instance registration is stuck in the database.Proposal
Seed a default Ollama instance from configuration when none exists, in the same spirit as
ARBITER_ADMIN_INITIAL_PASSWORD: applied on first start, ignored once an instance is present, so it never fights an operator's UI changes.Seeding must still respect the data-source host allow-list. A seeded instance pointing at a private-range host should be created but rejected at call time unless the host is allow-listed, rather than the seed quietly bypassing the SSRF guard.
Acceptance Criteria
arbiter.data-sources.allowed-hostsARBITER_ADMIN_INITIAL_PASSWORDalready is