fix(k8s/open-webui): memory 1Gi→2Gi (OOMKill HuggingFace download au boot)

fix(ansible/postgresql): GRANT ALL ON SCHEMA public (PostgreSQL 15+ default)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/postgresql/tasks/main.yml

@@ -139,5 +139,19 @@
   loop: "{{ postgresql_users }}"
   no_log: true
 
+# PostgreSQL 15+ révoque CREATE ON SCHEMA public par défaut
+- name: Grant schema public to users (PostgreSQL 15+)
+  community.postgresql.postgresql_privs:
+    database: "{{ item.db }}"
+    privs: ALL
+    type: schema
+    objs: public
+    role: "{{ item.name }}"
+    state: present
+  become: true
+  become_user: postgres
+  loop: "{{ postgresql_users }}"
+  no_log: true
+
 # Firewall géré centralement par le rôle gateway (nftables)
 # Port 5432 ouvert pour cluster_network dans nftables.conf.j2

k8s/apps/open-webui/deployment.yaml

@@ -55,10 +55,10 @@ spec:
           resources:
             requests:
               cpu: 200m
-              memory: 256Mi
+              memory: 512Mi
             limits:
               cpu: 1000m
-              memory: 1Gi
+              memory: 2Gi
           readinessProbe:
             httpGet:
               path: /health