feat(open-webui): deploy env-declarative chat bake-off on esh-docker-vm:3211

Stand up Open WebUI v0.11.0 parallel to lobe-chat (:3210) as an operator-approved candidate replacement. Env-declarative config (ENABLE_PERSISTENT_CONFIG=False = the deploy is the config source of truth), model picker auto-tracks the LiteLLM gateway with no pins, background task model pinned to summarizer, TTS routed direct at the dots gateway (:8198). Gates verified on the box: G1 (declarative config, both directions), G2 (picker == live gateway roster, no hand-listing), G3 (models/sync genuinely reconciles create+delete), G5 (task model pinned). G4 (TTS) handed to tts-dev. Credential posture (G6): fresh capped LiteLLM key open-webui-esh (all-proxy-models, $50/1mo budget) rather than inheriting the uncapped lobe-chat-esh key; signup locked off after admin creation. Secrets vaulted under esh-docker-vm/open-webui-*. Note: the API-key toggle env var is ENABLE_API_KEYS (plural); a var only reaches the container if compose names it in environment:. lobe-chat is untouched.
2026-08-21 09:52:07 -07:00
parent f01ee28cea
commit 76834777a4
4 changed files with 262 additions and 0 deletions
@@ -0,0 +1,51 @@
+# open-webui on esh-docker-vm. Real .env lives on the host and is NEVER committed.
+# Populate secrets from the vault:
+#   secret get esh-docker-vm/open-webui-litellm-key   -> OPENAI_API_KEY
+#   secret get esh-docker-vm/open-webui-secret-key     -> WEBUI_SECRET_KEY
+#
+# ⚠️ ENABLE_PERSISTENT_CONFIG=False is load-bearing (G1): env is re-read every
+#    boot, UI changes do NOT persist across restart. Change config HERE + bounce.
+
+OPENWEBUI_PORT=3211
+OPENWEBUI_TAG=main
+OPENWEBUI_ENV=prod
+
+# --- The deal-sealer ---
+ENABLE_PERSISTENT_CONFIG=False
+
+# --- Auth / signup (G6). Signup is OFF in steady state; the first/admin account
+#     (lkraven / vh@phasefinal.com) was created during deploy with signup briefly
+#     enabled, then locked. To add a user: create via Admin UI (signup stays off). ---
+WEBUI_AUTH=True
+WEBUI_SECRET_KEY=
+ENABLE_SIGNUP=False
+ENABLE_LOGIN_FORM=True
+DEFAULT_USER_ROLE=pending
+# Open WebUI v0.11.0 env var is ENABLE_API_KEYS (plural); singular is inert.
+ENABLE_API_KEYS=True
+
+# --- Model source: LiteLLM gateway, NO pins (G2 auto-tracks the live roster). ---
+ENABLE_OPENAI_API=True
+OPENAI_API_BASE_URL=http://10.250.50.70:4000/v1
+OPENAI_API_KEY=
+ENABLE_OLLAMA_API=False
+
+# --- Background task model (G5): summarizer (gen seat @ temp 0). ---
+TASK_MODEL_EXTERNAL=summarizer
+
+# --- RAG embeddings via the gateway (avoids boot-time HF download). ---
+RAG_EMBEDDING_ENGINE=openai
+RAG_EMBEDDING_MODEL=qwen3-embedding
+RAG_OPENAI_API_BASE_URL=http://10.250.50.70:4000/v1
+
+# --- TTS (G4 — tts-dev tunes model/voice). Direct at the dots gateway, no LiteLLM. ---
+AUDIO_TTS_ENGINE=openai
+AUDIO_TTS_OPENAI_API_BASE_URL=http://10.100.79.3:8198/v1
+AUDIO_TTS_OPENAI_API_KEY=sk-no-auth-lan-seat
+AUDIO_TTS_MODEL=tts-1
+AUDIO_TTS_VOICE=nova
+
+# --- Telemetry off ---
+ANONYMIZED_TELEMETRY=False
+DO_NOT_TRACK=True
+SCARF_NO_ANALYTICS=True