Open WebUI and Self-Hosted AI Stacks
Open WebUI is a self-hosted chat interface for Ollama and any OpenAI-compatible API. Run it with Ollama in Docker Compose for a private ChatGPT-style stack.
Project: Open WebUI Documentation: Open WebUI docs
Verification: image name, port, volume path and environment variables are from the official docs as remembered; nothing was run here. Check the docs for current variable names. Items marked
(unverified)need confirming.
Compose Stack #
Replace <TAG> with a pinned version. The first account created becomes the administrator.
services:
ollama:
image: ollama/ollama:<TAG>
restart: unless-stopped
volumes:
- ollama:/root/.ollama
deploy:
resources:
reservations:
devices:
- driver: nvidia
count: all
capabilities: [gpu]
open-webui:
image: ghcr.io/open-webui/open-webui:<TAG>
restart: unless-stopped
depends_on:
- ollama
ports:
- "127.0.0.1:3000:8080"
environment:
OLLAMA_BASE_URL: http://ollama:11434
WEBUI_SECRET_KEY: ${WEBUI_SECRET_KEY}
ENABLE_SIGNUP: "false"
volumes:
- open-webui:/app/backend/data
volumes:
ollama:
open-webui:| COMMAND | DESCRIPTION |
|---|---|
openssl rand -hex 32 | Generate a value for WEBUI_SECRET_KEY (store in .env, not in git) |
docker compose up -d | Start the stack |
docker compose pull && docker compose up -d | Update |
docker compose exec ollama ollama pull MODEL | Download a model; it appears in the UI |
Key Settings #
| VARIABLE | USE |
|---|---|
OLLAMA_BASE_URL | Where Ollama is |
OPENAI_API_BASE_URL / OPENAI_API_KEY | Connect an OpenAI-compatible provider or a local server |
WEBUI_SECRET_KEY | Session signing key; set it so logins survive restarts |
ENABLE_SIGNUP | Allow self-registration; turn off after creating admin (unverified) |
WEBUI_AUTH | Disabling auth is for single-user local use only (unverified) |
Data lives in the /app/backend/data volume (users, chats, settings). Back it up: Docker Volume Backup.
Exposure #
- Keep the port on loopback and publish through a reverse proxy with TLS.
- For single sign-on use OIDC with authentik
(unverified: check the OAuth/OIDC variables in the docs). - Do not expose the Ollama port itself.