Skip to main content

02-open-webui.md

kstack: book: Centerpoint Home Lab chapter: AI & Automation page: Open Web UI tags: [open-webui, ai, chat, ollama, interface]

Overview

emptyOpen Web UI is the primary chat and AI management interface for the homelab. It provides a ChatGPT-style web frontend connected to the local Ollama backend, with support for conversation history, model selection, RAG (document chat), image generation, and tool use. It can also proxy to external OpenAI-compatible APIs.

Access

Type URL Notes Internal https://ai.home.local LAN access via Step-CA TLS External https://ai.jeeves5454.ddns.net Internet-facing — Authentik SSO + GeoBlock + CrowdSec

Configuration

Image: ghcr.io/open-webui/open-webui:main Compose project: ai-stack

Ports

Port Protocol Purpose 3015 TCP Web UI (mapped from internal 8080)

Traefik Labels

# Internal route
traefik.http.routers.openwebui-internal.rule: Host(`ai.home.local`)
traefik.http.routers.openwebui-internal.entrypoints: websecure
traefik.http.routers.openwebui-internal.tls.certresolver: step-ca
traefik.http.routers.openwebui-internal.service: openwebui-svc

# External route
traefik.http.routers.openwebui-external.rule: Host(`ai.jeeves5454.ddns.net`)
traefik.http.routers.openwebui-external.entrypoints: websecure
traefik.http.routers.openwebui-external.tls.certresolver: letsencrypt
traefik.http.routers.openwebui-external.middlewares: authentik-auth@docker,plex-geoblock@file,crowdsec-bouncer@file
traefik.http.routers.openwebui-external.service: openwebui-svc

traefik.http.services.openwebui-svc.loadbalancer.server.port: 8080

Environment Variables

Variable Value / Notes WEBUI_AUTH False — authentication handled by Authentik ENABLE_OLLAMA_API True ENABLE_OPENAI_API True ENABLE_IMAGE_GENERATION True IMAGE_GENERATION_ENGINE automatic1111 IMAGE_GENERATION_MODEL dreamshaper_8 IMAGE_SIZE 400x400 IMAGE_STEPS 8 AUTOMATIC1111_BASE_URL http://stable-diffusion:7860/ AUTOMATIC1111_CFG_SCALE 2 AUTOMATIC1111_SAMPLER DPM++ SDE AUTOMATIC1111_SCHEDULER Karras

WEBUI_AUTH=False disables Open Web UI's own login page. Authentication is delegated entirely to Authentik ForwardAuth on the external route. On the internal LAN route, the interface is open — access is controlled by network boundary only.

Volumes / Bind Mounts

Host Path / Volume Container Path Purpose open_webui_open-webui-data /app/backend/data Conversation history, settings, uploaded docs (named volume, external)

Networks

Network Purpose ai-stack_ai-internal Reaches Ollama backend on ai-internal network traefik-net Exposes the web UI via Traefik

Dependencies

    ollama — must be running for model inference; Open Web UI will start without it but model requests will fail Authentik — required for external route SSO; LAN route is unaffected if Authentik is down

    Notes / Gotchas

      The main image tag tracks the latest development build. For stability, consider pinning to a tagged release (e.g. v0.6.x). WEBUI_AUTH=False means anyone on the LAN can access the internal URL without credentials. If untrusted devices are on the LAN, consider enabling WEBUI_AUTH and creating user accounts, or adding Authentik middleware to the internal route as well. Conversation history and user settings are stored in the named Docker volume. Back this up before upgrades. Open Web UI admin panel is at https://ai.home.local/admin/ — first user to register (if auth is enabled) becomes the admin. Image generation requires the stable-diffusion container to be running (separate service, also on ai-internal network).

      Last Updated: 2026-06-16

      Back to top