Open-WebUI Service

Defined in /modules/blocks/open-webui.nix, found in the selfhostblocks.nixosModules.open-webui module. See the manual for how to import the module in your code.

This service sets up Open WebUI which provides a frontend to various LLMs.

Features

Telemetry disabled.
Skip onboarding through custom patch.
Declarative LDAP Configuration. Needed LDAP groups are created automatically.
Declarative SSO Configuration. When SSO is enabled, login with user and password is disabled. Registration is enabled through SSO. Correct error message for unauthorized user through custom patch.
Access through subdomain using reverse proxy.
Access through HTTPS using reverse proxy.
Backup through the backup block.

Usage

The following snippet assumes a few blocks have been setup already:

{
  shb.open-webui = {
    enable = true;
    domain = "example.com";
    subdomain = "open-webui";

    ssl = config.shb.certs.certs.letsencrypt.${domain};

    sso = {
      enable = true;
      authEndpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";

      sharedSecret.result = config.shb.sops.secret.oidcSecret.result;
      sharedSecretForAuthelia.result = config.shb.sops.secret.oidcAutheliaSecret.result;
    };
  };

  shb.sops.secret.oidcSecret.request = config.shb.open-webui.sso.sharedSecret.request;
  shb.sops.secret.oidcAutheliaSecret = {
    request = config.shb.open-webui.sso.sharedSecretForAuthelia.request;
    settings.key = oidcSecret;
  };
}

Secrets can be randomly generated with nix run nixpkgs#openssl -- rand -hex 64.

The user and admin LDAP groups are created automatically.

Integration with OLLAMA

Assuming ollama is enabled, it will be available on port config.services.ollama.port. The following snippet sets up acceleration using an AMD (i)GPU and loads some models.

{
  services.ollama = {
    enable = true;

    # https://wiki.nixos.org/wiki/Ollama#AMD_GPU_with_open_source_driver
    acceleration = "rocm";

    # https://ollama.com/library
    loadModels = [
      "deepseek-r1:1.5b"
      "llama3.2:3b"
      "llava:7b"
      "mxbai-embed-large:335m"
      "nomic-embed-text:v1.5"
    ];
  };
}

Integrating with the ollama service is done with:

{
  shb.open-webui = {
    environment.OLLAMA_BASE_URL = "http://127.0.0.1:${toString config.services.ollama.port}";
  };
}

Backup

Backing up Open-Webui using the Restic block is done like so:

shb.restic.instances."open-webui" = {
  request = config.shb.open-webui.backup;
  settings = {
    enable = true;
  };
};

The name "open-webui" in the instances can be anything. The config.shb.open-webui.backup option provides what directories to backup. You can define any number of Restic instances to backup Open WebUI multiple times.

Options Reference

id-prefix: services-open-webui-options-
list-id: selfhostblocks-services-open-webui-options
source: @OPTIONS_JSON@

3.9 KiB Raw Blame History