Merge upstream/dev into feature/tiktok-scraper

Sync with the advanced dev tip so the PR compares against current dev
(drops already-merged commits from the diff). No history rewritten.

surfsense_web/content/docs/docker-installation/index.mdx

@@ -59,6 +59,7 @@ The defaults give you local email/password auth, local document parsing with Doc
 
 - **Authentication** — switch to Google OAuth login.
 - **Document parsing** — switch to Unstructured or LlamaCloud (both need API keys).
+- **Embedding endpoint** — set `EMBEDDING_BASE_URL` for Chonkie/LiteLLM embedding models, or `OLLAMA_EMBEDDING_BASE_URL` as an Ollama-specific fallback.
 - **Connector credentials** — OAuth apps for [external connectors](/docs/connectors/external) that need them on self-hosted deployments.
 - **Messaging channels** — Telegram, WhatsApp, Slack, and Discord bots (see [Messaging Channels](/docs/messaging-channels)).
 

surfsense_web/content/docs/local-models/ollama.mdx

@@ -50,6 +50,23 @@ http://<host>:11434
 
 Replace `<host>` with the LAN IP or domain for that machine.
 
+## Embeddings on a Separate Ollama Server
+
+Search-space model connections configure chat and completion models. The global
+embedding model is configured in the backend environment.
+
+Use Chonkie's LiteLLM embedding provider when embeddings run on Ollama:
+
+```dotenv
+EMBEDDING_MODEL=litellm://ollama/nomic-embed-text
+EMBEDDING_BASE_URL=http://host.docker.internal:11434
+```
+
+If chat and embeddings run on different Ollama instances, keep the chat model
+connection pointed at the chat server and set `EMBEDDING_BASE_URL` to the
+embedding server. `OLLAMA_EMBEDDING_BASE_URL` is also supported as an
+Ollama-specific fallback when `EMBEDDING_BASE_URL` is not set.
+
 ## Add the Connection
 
 1. Open Workspace Settings.

surfsense_web/content/docs/manual-installation.mdx

@@ -57,6 +57,8 @@ Copy-Item -Path .env.example -Destination .env
 
 `.env.example` is the source of truth for configuration — every variable is documented inline with comments and sensible defaults. At minimum, set your PostgreSQL connection string and a JWT secret key (generate one with `openssl rand -base64 32`). Everything else — auth type, ETL service, embeddings, TTS/STT, connector credentials — is optional and explained in the file itself.
 
+For separate embedding servers, set `EMBEDDING_BASE_URL` with Chonkie/LiteLLM embedding models; `OLLAMA_EMBEDDING_BASE_URL` is also supported as an Ollama-specific fallback.
+
 ### 2. Install Dependencies
 
 ```bash