Open-WebUI Service

Defined in /modules/blocks/open-webui.nix, found in the selfhostblocks.nixosModules.open-webui module. See the manual for how to import the module in your code.

This service sets up Open WebUI which provides a frontend to various LLMs.

Features

Telemetry disabled.
Skip onboarding through custom patch.
Declarative LDAP Configuration.
- Needed LDAP groups are created automatically.
Declarative SSO Configuration.
- When SSO is enabled, login with user and password is disabled.
- Registration is enabled through SSO.
- Correct error message for unauthorized user through custom patch.
Access through subdomain using reverse proxy.
Access through HTTPS using reverse proxy.
Backup through the backup block.
Integration with the dashboard contract for displaying user facing application in a dashboard. Manual

Usage

Initial Configuration

The following snippet assumes a few blocks have been setup already:

{
  shb.open-webui = {
    enable = true;
    domain = "example.com";
    subdomain = "open-webui";

    ssl = config.shb.certs.certs.letsencrypt.${domain};

    sso = {
      enable = true;
      authEndpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";

      sharedSecret.result = config.shb.sops.secret.oidcSecret.result;
      sharedSecretForAuthelia.result = config.shb.sops.secret.oidcAutheliaSecret.result;
    };
  };

  shb.sops.secret."open-webui/oidcSecret".request = config.shb.open-webui.sso.sharedSecret.request;
  shb.sops.secret."open-webui/oidcAutheliaSecret" = {
    request = config.shb.open-webui.sso.sharedSecretForAuthelia.request;
    settings.key = "open-webui/oidcSecret";
  };
}

Secrets can be randomly generated with nix run nixpkgs#openssl -- rand -hex 64.

The user and admin LDAP groups are created automatically.

Application Dashboard

Integration with the dashboard contract is provided by the dashboard option.

For example using the Homepage service:

{
  shb.homepage.servicesGroups.Documents.services.OpenWebUI = {
    sortOrder = 1;
    dashboard.request = config.shb.home-assistant.dashboard.request;
    settings.icon = "sh-open-webui";
  };
}

The icon needs to be set manually otherwise it is not displayed correctly.

Integration with OLLAMA

Assuming ollama is enabled, it will be available on port config.services.ollama.port. The following snippet sets up acceleration using an AMD (i)GPU and loads some models.

{
  services.ollama = {
    enable = true;

    # https://wiki.nixos.org/wiki/Ollama#AMD_GPU_with_open_source_driver
    acceleration = "rocm";

    # https://ollama.com/library
    loadModels = [
      "deepseek-r1:1.5b"
      "llama3.2:3b"
      "llava:7b"
      "mxbai-embed-large:335m"
      "nomic-embed-text:v1.5"
    ];
  };
}

Integrating with the ollama service is done with:

{
  shb.open-webui = {
    environment.OLLAMA_BASE_URL = "http://127.0.0.1:${toString config.services.ollama.port}";
  };
}

Backup

Backing up Open-Webui using the Restic block is done like so:

shb.restic.instances."open-webui" = {
  request = config.shb.open-webui.backup;
  settings = {
    enable = true;
  };
};

The name "open-webui" in the instances can be anything. The config.shb.open-webui.backup option provides what directories to backup. You can define any number of Restic instances to backup Open WebUI multiple times.

Options Reference

id-prefix: services-open-webui-options-
list-id: selfhostblocks-services-open-webui-options
source: @OPTIONS_JSON@

4.8 KiB Raw Blame History