Remove ollama LAN NodePort service

The sanctioned ingress is ollama.ops.eblu.me via tailnet.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

argocd/manifests/ollama/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - pvc.yaml
   - deployment.yaml
   - service.yaml
-  - service-nodeport.yaml
   - ingress-tailscale.yaml
 
 images:

argocd/manifests/ollama/service-nodeport.yaml

@@ -1,16 +0,0 @@
----
-# Local subnet access for non-tailnet devices
-apiVersion: v1
-kind: Service
-metadata:
-  name: ollama-nodeport
-  namespace: ollama
-spec:
-  type: NodePort
-  selector:
-    app: ollama
-  ports:
-    - name: http
-      port: 11434
-      targetPort: 11434
-      nodePort: 80

nixos/ringtail/configuration.nix

@@ -130,8 +130,6 @@ in
       "--disable=metrics-server"
       "--write-kubeconfig-mode=644"
       "--tls-san=ringtail.tail8d86e.ts.net"
-      # Allow ollama NodePort on port 80 for non-tailnet LAN devices
-      "--service-node-port-range=80-32767"
     ];
     containerdConfigTemplate = ''
       {{ template "base" . }}