deploy/mainnet: split supplier into ollama (canonical) + gpt variants

Restore the canonical mainnet docker-compose.supplier.yml to mirror
testnet's ollama-backed supplier (LLM_BACKEND=ollama, OLLAMA_URL points
at marketplace-mainnet-ollama, Traefik routes mp-suppliers.vector.apex-
fusion.org). The ChatGPT/Codex variant introduced in 965fabd moves to
docker-compose.supplier-gpt.yml with project name + container name
suffixed -gpt so both can coexist on the same host.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/mainnet/docker-compose.supplier-gpt.yml

@@ -0,0 +1,71 @@
+# deploy/mainnet/docker-compose.supplier-gpt.yml — Supplier — MAINNET (ChatGPT/Codex backend)
+#
+# This compose runs a SECOND mainnet supplier with LLM_BACKEND=openai pointed
+# at the ChatMock localhost proxy (see docker-compose.chatmock.yml). Traefik
+# routes at mp-suppliers-gpt.vector.apexfusion.org. Coexists with the
+# canonical ollama-backed supplier in docker-compose.supplier.yml, which owns
+# the unsuffixed mp-suppliers.vector.apexfusion.org slot.
+#
+# Pre-flight networks (must already exist):
+#   docker network create marketplace-mainnet-net   # one-shot
+#   # traefik-net                                    is created by the Traefik project
+#
+# Pre-flight services:
+#   docker compose -f docker-compose.chatmock.yml up -d chatmock
+#   # then run the --profile login flow once to seed OAuth tokens in
+#   # the chatmock_data volume — see chatmock compose header for details
+
+name: marketplace-mainnet-supplier-gpt
+
+services:
+  supplier:
+    build:
+      context: ../..
+      dockerfile: supplier/Dockerfile
+    container_name: marketplace-mainnet-supplier-gpt
+    restart: unless-stopped
+    env_file:
+      - path: ../../supplier/.env
+        required: false
+    environment:
+      LLM_BACKEND: openai
+      OPENAI_BASE_URL: http://marketplace-mainnet-chatmock:8000
+      OPENAI_TIMEOUT_MS: "180000"
+      PORT: "8080"
+      # Enable LiveOgmiosProvider so submitTx/awaitTx actually broadcast.
+      # Mirrors the testnet supplier compose; without this the supplier
+      # silently falls back to ReadOnlyOgmiosProvider and Claim/Submit
+      # never reach chain.
+      LIVE_CHAIN: "1"
+      # NETWORK_ID and OGMIOS_URL intentionally not pinned here — they MUST
+      # come from the operator-provided supplier/.env on a mainnet host.
+      # Setting them via compose would be a footgun: a stray re-up on
+      # testnet hardware could silently re-tag the supplier as mainnet.
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null || exit 1"]
+      interval: 20s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
+    networks:
+      - marketplace-mainnet-net
+      - traefik-net
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-net"
+      - "traefik.http.routers.mp-suppliers-gpt-mainnet.entrypoints=web"
+      - "traefik.http.routers.mp-suppliers-gpt-mainnet.rule=Host(`mp-suppliers-gpt.vector.apexfusion.org`)"
+      - "traefik.http.services.mp-suppliers-gpt-mainnet.loadbalancer.server.port=8080"
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+networks:
+  marketplace-mainnet-net:
+    external: true
+    name: marketplace-mainnet-net
+  traefik-net:
+    external: true
+    name: traefik-net

deploy/mainnet/docker-compose.supplier.yml

@@ -1,19 +1,25 @@
-# deploy/mainnet/docker-compose.supplier.yml — Supplier — MAINNET (ChatGPT/Codex backend)
+# deploy/mainnet/docker-compose.supplier.yml — Supplier — MAINNET (ollama backend)
 #
-# This compose runs the mainnet supplier with LLM_BACKEND=openai pointed at
-# the ChatMock localhost proxy (see docker-compose.chatmock.yml). Traefik
-# routes at mp-suppliers-gpt.vector.apexfusion.org so the unsuffixed
-# mp-suppliers.* slot remains free for a future supplier with a different
-# backend.
+# Mirrors deploy/testnet/docker-compose.supplier.yml — the canonical
+# ollama-backed supplier. Mainnet differences:
+#   - container_name + project name use the marketplace-mainnet- prefix
+#   - No apex-net join: this host has no local apex-dashboard-mainnet
+#     stack; the supplier reaches chain via the public HTTPS endpoint
+#     supplied by supplier/.env (OGMIOS_URL=https://ogmios.vector.mainnet.apexfusion.org).
+#   - Traefik router name + Host rule drop the `testnet.` infix.
+#
+# For the ChatGPT/Codex-backed supplier variant see docker-compose.supplier-gpt.yml.
 #
 # Pre-flight networks (must already exist):
 #   docker network create marketplace-mainnet-net   # one-shot
 #   # traefik-net is created by the Traefik project
 #
 # Pre-flight services:
-#   docker compose -f docker-compose.chatmock.yml up -d chatmock
-#   # then run the --profile login flow once to seed OAuth tokens in
-#   # the chatmock_data volume — see chatmock compose header for details
+#   docker compose -f docker-compose.ollama.yml up -d
+#   docker exec marketplace-mainnet-ollama ollama pull qwen2.5:0.5b
+#
+# Bring up:
+#   docker compose -f deploy/mainnet/docker-compose.supplier.yml up -d
 
 name: marketplace-mainnet-supplier
 
@@ -28,9 +34,8 @@ services:
       - path: ../../supplier/.env
         required: false
     environment:
-      LLM_BACKEND: openai
-      OPENAI_BASE_URL: http://marketplace-mainnet-chatmock:8000
-      OPENAI_TIMEOUT_MS: "180000"
+      LLM_BACKEND: ollama
+      OLLAMA_URL: http://marketplace-mainnet-ollama:11434
       PORT: "8080"
       # Enable LiveOgmiosProvider so submitTx/awaitTx actually broadcast.
       # Mirrors the testnet supplier compose; without this the supplier
@@ -53,9 +58,9 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-net"
-      - "traefik.http.routers.mp-suppliers-gpt-mainnet.entrypoints=web"
-      - "traefik.http.routers.mp-suppliers-gpt-mainnet.rule=Host(`mp-suppliers-gpt.vector.apexfusion.org`)"
-      - "traefik.http.services.mp-suppliers-gpt-mainnet.loadbalancer.server.port=8080"
+      - "traefik.http.routers.mp-suppliers-mainnet.entrypoints=web"
+      - "traefik.http.routers.mp-suppliers-mainnet.rule=Host(`mp-suppliers.vector.apexfusion.org`)"
+      - "traefik.http.services.mp-suppliers-mainnet.loadbalancer.server.port=8080"
     logging:
       driver: json-file
       options: