vh
76834777a4
Stand up Open WebUI v0.11.0 parallel to lobe-chat (:3210) as an operator-approved candidate replacement. Env-declarative config (ENABLE_PERSISTENT_CONFIG=False = the deploy is the config source of truth), model picker auto-tracks the LiteLLM gateway with no pins, background task model pinned to summarizer, TTS routed direct at the dots gateway (:8198). Gates verified on the box: G1 (declarative config, both directions), G2 (picker == live gateway roster, no hand-listing), G3 (models/sync genuinely reconciles create+delete), G5 (task model pinned). G4 (TTS) handed to tts-dev. Credential posture (G6): fresh capped LiteLLM key open-webui-esh (all-proxy-models, $50/1mo budget) rather than inheriting the uncapped lobe-chat-esh key; signup locked off after admin creation. Secrets vaulted under esh-docker-vm/open-webui-*. Note: the API-key toggle env var is ENABLE_API_KEYS (plural); a var only reaches the container if compose names it in environment:. lobe-chat is untouched.
52 lines
1.8 KiB
Bash
52 lines
1.8 KiB
Bash
# open-webui on esh-docker-vm. Real .env lives on the host and is NEVER committed.
|
|
# Populate secrets from the vault:
|
|
# secret get esh-docker-vm/open-webui-litellm-key -> OPENAI_API_KEY
|
|
# secret get esh-docker-vm/open-webui-secret-key -> WEBUI_SECRET_KEY
|
|
#
|
|
# ⚠️ ENABLE_PERSISTENT_CONFIG=False is load-bearing (G1): env is re-read every
|
|
# boot, UI changes do NOT persist across restart. Change config HERE + bounce.
|
|
|
|
OPENWEBUI_PORT=3211
|
|
OPENWEBUI_TAG=main
|
|
OPENWEBUI_ENV=prod
|
|
|
|
# --- The deal-sealer ---
|
|
ENABLE_PERSISTENT_CONFIG=False
|
|
|
|
# --- Auth / signup (G6). Signup is OFF in steady state; the first/admin account
|
|
# (lkraven / vh@phasefinal.com) was created during deploy with signup briefly
|
|
# enabled, then locked. To add a user: create via Admin UI (signup stays off). ---
|
|
WEBUI_AUTH=True
|
|
WEBUI_SECRET_KEY=
|
|
ENABLE_SIGNUP=False
|
|
ENABLE_LOGIN_FORM=True
|
|
DEFAULT_USER_ROLE=pending
|
|
# Open WebUI v0.11.0 env var is ENABLE_API_KEYS (plural); singular is inert.
|
|
ENABLE_API_KEYS=True
|
|
|
|
# --- Model source: LiteLLM gateway, NO pins (G2 auto-tracks the live roster). ---
|
|
ENABLE_OPENAI_API=True
|
|
OPENAI_API_BASE_URL=http://10.250.50.70:4000/v1
|
|
OPENAI_API_KEY=
|
|
ENABLE_OLLAMA_API=False
|
|
|
|
# --- Background task model (G5): summarizer (gen seat @ temp 0). ---
|
|
TASK_MODEL_EXTERNAL=summarizer
|
|
|
|
# --- RAG embeddings via the gateway (avoids boot-time HF download). ---
|
|
RAG_EMBEDDING_ENGINE=openai
|
|
RAG_EMBEDDING_MODEL=qwen3-embedding
|
|
RAG_OPENAI_API_BASE_URL=http://10.250.50.70:4000/v1
|
|
|
|
# --- TTS (G4 — tts-dev tunes model/voice). Direct at the dots gateway, no LiteLLM. ---
|
|
AUDIO_TTS_ENGINE=openai
|
|
AUDIO_TTS_OPENAI_API_BASE_URL=http://10.100.79.3:8198/v1
|
|
AUDIO_TTS_OPENAI_API_KEY=sk-no-auth-lan-seat
|
|
AUDIO_TTS_MODEL=tts-1
|
|
AUDIO_TTS_VOICE=nova
|
|
|
|
# --- Telemetry off ---
|
|
ANONYMIZED_TELEMETRY=False
|
|
DO_NOT_TRACK=True
|
|
SCARF_NO_ANALYTICS=True
|