146 lines
4.8 KiB
Markdown
146 lines
4.8 KiB
Markdown
# Open-WebUI Service {#services-open-webui}
|
|
|
|
Defined in [`/modules/blocks/open-webui.nix`](@REPO@/modules/blocks/open-webui.nix),
|
|
found in the `selfhostblocks.nixosModules.open-webui` module.
|
|
See [the manual](usage.html#usage-flake) for how to import the module in your code.
|
|
|
|
This service sets up [Open WebUI][] which provides a frontend to various LLMs.
|
|
|
|
[Open WebUI]: https://docs.openwebui.com/
|
|
|
|
## Features {#services-open-webui-features}
|
|
|
|
- Telemetry disabled.
|
|
- Skip onboarding through custom patch.
|
|
- Declarative [LDAP](#services-open-webui-options-shb.open-webui.ldap) Configuration.
|
|
- Needed LDAP groups are created automatically.
|
|
- Declarative [SSO](#services-open-webui-options-shb.open-webui.sso) Configuration.
|
|
- When SSO is enabled, login with user and password is disabled.
|
|
- Registration is enabled through SSO.
|
|
- Correct error message for unauthorized user through custom patch.
|
|
- Access through [subdomain](#services-open-webui-options-shb.open-webui.subdomain) using reverse proxy.
|
|
- Access through [HTTPS](#services-open-webui-options-shb.open-webui.ssl) using reverse proxy.
|
|
- [Backup](#services-open-webui-options-shb.open-webui.sso) through the [backup block](./blocks-backup.html).
|
|
- Integration with the [dashboard contract](contracts-dashboard.html) for displaying user facing application in a dashboard. [Manual](#services-open-webui-usage-applicationdashboard)
|
|
|
|
## Usage {#services-open-webui-usage}
|
|
|
|
### Initial Configuration {#services-open-webui-usage-configuration}
|
|
|
|
The following snippet assumes a few blocks have been setup already:
|
|
|
|
- the [secrets block](usage.html#usage-secrets) with SOPS,
|
|
- the [`shb.ssl` block](blocks-ssl.html#usage),
|
|
- the [`shb.lldap` block](blocks-lldap.html#blocks-lldap-global-setup).
|
|
- the [`shb.authelia` block](blocks-authelia.html#blocks-sso-global-setup).
|
|
|
|
```nix
|
|
{
|
|
shb.open-webui = {
|
|
enable = true;
|
|
domain = "example.com";
|
|
subdomain = "open-webui";
|
|
|
|
ssl = config.shb.certs.certs.letsencrypt.${domain};
|
|
|
|
sso = {
|
|
enable = true;
|
|
authEndpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";
|
|
|
|
sharedSecret.result = config.shb.sops.secret.oidcSecret.result;
|
|
sharedSecretForAuthelia.result = config.shb.sops.secret.oidcAutheliaSecret.result;
|
|
};
|
|
};
|
|
|
|
shb.sops.secret."open-webui/oidcSecret".request = config.shb.open-webui.sso.sharedSecret.request;
|
|
shb.sops.secret."open-webui/oidcAutheliaSecret" = {
|
|
request = config.shb.open-webui.sso.sharedSecretForAuthelia.request;
|
|
settings.key = "open-webui/oidcSecret";
|
|
};
|
|
}
|
|
```
|
|
|
|
Secrets can be randomly generated with `nix run nixpkgs#openssl -- rand -hex 64`.
|
|
|
|
The [user](#services-open-webui-options-shb.open-webui.ldap.userGroup)
|
|
and [admin](#services-open-webui-options-shb.open-webui.ldap.adminGroup)
|
|
LDAP groups are created automatically.
|
|
|
|
### Application Dashboard {#services-open-webui-usage-applicationdashboard}
|
|
|
|
Integration with the [dashboard contract](contracts-dashboard.html) is provided
|
|
by the [dashboard option](#services-open-webui-options-shb.open-webui.dashboard).
|
|
|
|
For example using the [Homepage](services-homepage.html) service:
|
|
|
|
```nix
|
|
{
|
|
shb.homepage.servicesGroups.Documents.services.OpenWebUI = {
|
|
sortOrder = 1;
|
|
dashboard.request = config.shb.home-assistant.dashboard.request;
|
|
settings.icon = "sh-open-webui";
|
|
};
|
|
}
|
|
```
|
|
|
|
The icon needs to be set manually otherwise it is not displayed correctly.
|
|
|
|
## Integration with OLLAMA {#services-open-webui-ollama}
|
|
|
|
Assuming ollama is enabled, it will be available on port `config.services.ollama.port`.
|
|
The following snippet sets up acceleration using an AMD (i)GPU and loads some models.
|
|
|
|
```nix
|
|
{
|
|
services.ollama = {
|
|
enable = true;
|
|
|
|
# https://wiki.nixos.org/wiki/Ollama#AMD_GPU_with_open_source_driver
|
|
acceleration = "rocm";
|
|
|
|
# https://ollama.com/library
|
|
loadModels = [
|
|
"deepseek-r1:1.5b"
|
|
"llama3.2:3b"
|
|
"llava:7b"
|
|
"mxbai-embed-large:335m"
|
|
"nomic-embed-text:v1.5"
|
|
];
|
|
};
|
|
}
|
|
```
|
|
|
|
Integrating with the ollama service is done with:
|
|
|
|
```nix
|
|
{
|
|
shb.open-webui = {
|
|
environment.OLLAMA_BASE_URL = "http://127.0.0.1:${toString config.services.ollama.port}";
|
|
};
|
|
}
|
|
```
|
|
|
|
## Backup {#services-open-webui-usage-backup}
|
|
|
|
Backing up Open-Webui using the [Restic block](blocks-restic.html) is done like so:
|
|
|
|
```nix
|
|
shb.restic.instances."open-webui" = {
|
|
request = config.shb.open-webui.backup;
|
|
settings = {
|
|
enable = true;
|
|
};
|
|
};
|
|
```
|
|
|
|
The name `"open-webui"` in the `instances` can be anything.
|
|
The `config.shb.open-webui.backup` option provides what directories to backup.
|
|
You can define any number of Restic instances to backup Open WebUI multiple times.
|
|
|
|
## Options Reference {#services-open-webui-options}
|
|
|
|
```{=include=} options
|
|
id-prefix: services-open-webui-options-
|
|
list-id: selfhostblocks-services-open-webui-options
|
|
source: @OPTIONS_JSON@
|
|
```
|