gguf-puller: pull public GGUF repos without the HF token secret

[AlienWalker1995]

Problem

ordo-ai-stack-llamacpp-1 crash-looped because its model file was missing; restoring it surfaced that docker compose run gguf-puller hard-fails whenever the SOPS-managed hf_token secret file is absent (or its ${HOME} source mis-resolves inside a Hermes/ops-controller compose subprocess — the same is not a valid Windows path error seen in the audit log). Even public GGUF pulls fail, so the puller couldn't be used to recover.

Fix

scripts/pull_gguf_models.py already falls back from HF_TOKEN_FILE to the HF_TOKEN env var and pulls public repos anonymously. So for gguf-puller only:

• Replace HF_TOKEN_FILE=/run/secrets/hf_token + secrets: [hf_token] with optional HF_TOKEN=${HF_TOKEN:-}.
• Empty by default → public repos pull token-free and compose run never hard-fails. Set HF_TOKEN in .env for gated repos.

The runtime services (ops-controller, dashboard, comfyui, comfyui-model-puller) keep the SOPS file secret unchanged — this is deliberately scoped to the puller, not a stack-wide secrets change.

Why not env-provider / a stack-wide change

A secrets.hf_token.environment: HF_TOKEN provider was tried first — it also hard-fails when HF_TOKEN is unset (environment variable "HF_TOKEN" required by secret … is not set). Compose's only non-fatal mechanism is ${VAR:-} on a plain env var. Ripping the secret out of all 5 services would diverge from the SOPS+age design (per repo convention) for no benefit, so this PR touches just the puller.

Note: comfyui-model-puller has the same latent trap but uses a different script (pull_comfyui_models.py); left untouched pending verification of its token handling.

Validation

docker compose --profile models run --rm gguf-puller with no secret and no HF_TOKEN pulls a public GGUF successfully (Done., exit 0). docker compose config resolves clean.

🤖 Generated with Claude Code