vh
39da1d4a97
The board mixed tools with endpoints. A vLLM seat whose href is a /docs page
sat in the same band as ComfyUI; the MQTT broker and the RustDesk relay, which
have no page at all, sat in Apps; and `Service Networking` was thirteen members
spanning three AdGuards, five Dockges, two Traefiks and four headless agents.
Every group is now one of two kinds and they never mix. TOOLS are expanded and
sit at the top of their tab. ENDPOINTS — an API, a broker, a background agent,
an href that is /docs or /ping or nothing — carry `initiallyCollapsed: true`
and sit at the bottom. Collapsed is not hidden: the eyebrow and its rule still
render, so the tab still says the thing exists and one click expands it.
A second rule fell out of the same pass and now shapes the group boundaries: a
group's members should all carry a widget or none should. A stat strip makes a
card ~50px taller, so one widget card in a row of plain ones opens a void under
the plain ones. That is why AdGuard and Traefik get their own groups rather
than sharing one with Dockge, and it is most of why the old Service Networking
band looked broken. AdGuard (ANA) was the last short card in its row and now
carries the same query/blocked/latency strip as its two siblings — one
infra-ops AdGuard login authenticates against all three instances, verified
against each; it lives in that stack's .env on the host and is vaulted.
The sixteen GPU-backed model seats were deliberately NOT relabelled.
`homepage.group` is read at container creation, so clearer names for
`AI - Inference` and friends would have cost a recreate on six vLLM seats, four
eval seats and four TTS engines — multi-minute model reloads on endpoints peers
reach through the gateway. Order plus `initiallyCollapsed` buys the same
separation for nothing, so those names stay as they are on purpose.
28 containers that ARE cheap to bounce were relabelled, across five hosts, via
rerunnable elway playbooks. Their label steps are gated on the old value still
being present, so a second run reports skipped rather than churning. Two verify
steps were wrong on first contact and are fixed with the reason recorded: the
traefik check raced its own recreate, and asserting a model seat is "running"
cannot answer "did I bounce it" when a seat may be legitimately stopped —
container age can, and now does.
The canonical stacks/ tree was synced to the deployed labels afterwards, so
intent and reality agree again on all fourteen tracked stacks.
Also documents the real nature of the post-recreate blank dashboard, which cost
~25 minutes here and an hour on 2026-08-19. `initialSettings":{}` in the served
HTML is the catch branch of the page's data loader, not a warm-up and not a
cache — and the error can vanish entirely, because the logger is assigned inside
the same try and the catch only logs if the logger exists. Ruled out by
measurement this time: all four API routes return 200 with correct content while
the page serves {}, and the previous known-good settings.yaml reproduces it
identically. The README now carries the one-command test and the next lead.
Before/after, all four tabs: http://10.100.10.50:8090/b/homepage-relayout/
123 lines
6.7 KiB
YAML
123 lines
6.7 KiB
YAML
# open-webui — evaluation chat frontend over the LiteLLM gateway, on esh-docker-vm.
|
|
#
|
|
# WHY THIS EXISTS (bake-off against lobe-chat, 2026-08-21)
|
|
# Lobe's config model does not survive a fleet that changes daily: its model
|
|
# list is a static env string that never auto-discovers (it rotted in BOTH
|
|
# directions — missed `sec`/`sec-reasoning` going in, kept retired `char-rp`
|
|
# names that 400 on click), and half its config (TTS service/model/voice)
|
|
# lives in each browser's local store, so "configured" is a property of
|
|
# whoever's laptop rather than of the deploy. Open WebUI is env-declarative and
|
|
# auto-tracks the gateway roster. This stack stands up PARALLEL to lobe-chat
|
|
# (Lobe on :3210, this on :3211); nothing about Lobe changes until/unless the
|
|
# operator retires it. The June-2026 weight objection (1,825 MB vs 143 MB) is
|
|
# moot here: esh-docker-vm has ~138 GB free.
|
|
#
|
|
# THE DEAL-SEALER — ENABLE_PERSISTENT_CONFIG=False (see .env)
|
|
# Default is True, and under True env vars are read ONCE on first boot,
|
|
# written to the DB, then ignored forever — so edit-env-and-bounce silently
|
|
# does nothing. We set it False so the deploy is the single source of config
|
|
# truth: every knob below is re-read from env on each boot, and a change made
|
|
# in the Admin UI does NOT survive a restart. Verified both directions at
|
|
# deploy (G1). ⚠️ Open upstream bugs touch this flag (open-webui #20830 Redis
|
|
# cache — N/A, we use no Redis; #15505; #21839) — re-verify after image bumps.
|
|
#
|
|
# CREDENTIAL POSTURE (G6 — chosen, not inherited)
|
|
# Purpose-minted LiteLLM virtual key `key_alias: open-webui-esh`, scoped to the
|
|
# `all-proxy-models` access group (reaches EVERYTHING incl. paid passthroughs —
|
|
# GLM/Kimi/gen-frontier) per the operator's standing posture, BUT capped with a
|
|
# `max_budget` ceiling (unlike lobe-chat-esh which is uncapped). A paid call
|
|
# from this UI spends real vendor credits until the cap trips. Signup is turned
|
|
# OFF after the first/admin account is created, so the surface is not open-
|
|
# registration on the LAN. Secrets live in the vault, never in git:
|
|
# secret get esh-docker-vm/open-webui-litellm-key -> OPENAI_API_KEY
|
|
# secret get esh-docker-vm/open-webui-secret-key -> WEBUI_SECRET_KEY
|
|
# secret get esh-docker-vm/open-webui-admin -> lkraven admin cred state
|
|
#
|
|
# TTS (G4 — tts-dev owns verification; env knobs set here)
|
|
# Routed DIRECT at the fleet dots gateway http://10.100.79.3:8198/v1, NOT
|
|
# through LiteLLM. Rationale (agreed with tts-dev): :8198 is itself the swap-
|
|
# proof switchboard — engines swap behind it — so LiteLLM would add only a hop
|
|
# and a wrong `audio/mpeg` content-type stamp; direct needs no gateway key on
|
|
# the audio path. Reversible: flip AUDIO_TTS_OPENAI_API_BASE_URL to the gateway
|
|
# + `ext-tts` if audio spend/log visibility is ever wanted. The five AUDIO_TTS_*
|
|
# vars are tts-dev's to tune (model/voice); base URL + engine are settled.
|
|
|
|
name: open-webui
|
|
|
|
services:
|
|
open-webui:
|
|
image: ghcr.io/open-webui/open-webui:${OPENWEBUI_TAG:-main}
|
|
container_name: ${OPENWEBUI_CONTAINER:-open-webui}
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${OPENWEBUI_PORT:-3211}:8080"
|
|
environment:
|
|
# --- The deal-sealer: deploy is the single source of config truth. ---
|
|
- ENABLE_PERSISTENT_CONFIG=${ENABLE_PERSISTENT_CONFIG:-False}
|
|
- ENV=${OPENWEBUI_ENV:-prod}
|
|
- WEBUI_NAME=${WEBUI_NAME:-PFI Open WebUI}
|
|
- WEBUI_URL=${WEBUI_URL:-http://10.0.50.45:3211}
|
|
# --- Auth / signup posture (G6). Signup is flipped False post-admin. ---
|
|
- WEBUI_AUTH=${WEBUI_AUTH:-True}
|
|
- WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY:?set in .env, from the vault}
|
|
- ENABLE_SIGNUP=${ENABLE_SIGNUP:-False}
|
|
- ENABLE_LOGIN_FORM=${ENABLE_LOGIN_FORM:-True}
|
|
- DEFAULT_USER_ROLE=${DEFAULT_USER_ROLE:-pending}
|
|
# NOTE: the env var is ENABLE_API_KEYS (plural) in Open WebUI v0.11.0
|
|
# (config.py: os.getenv('ENABLE_API_KEYS','False')). The singular form is
|
|
# inert — a deploy that sets ENABLE_API_KEY silently leaves key-mint 403.
|
|
- ENABLE_API_KEYS=${ENABLE_API_KEYS:-True}
|
|
# --- Model source: the LiteLLM gateway, no pins (G2 auto-tracks). ---
|
|
- ENABLE_OPENAI_API=${ENABLE_OPENAI_API:-True}
|
|
- OPENAI_API_BASE_URL=${OPENAI_API_BASE_URL:-http://10.250.50.70:4000/v1}
|
|
- OPENAI_API_KEY=${OPENAI_API_KEY:?set in .env, from the vault}
|
|
# Ollama is banned fleet-wide; keep the client from probing localhost:11434.
|
|
- ENABLE_OLLAMA_API=${ENABLE_OLLAMA_API:-False}
|
|
# --- Background task model (G5): pin it or an unpinned default hammers a
|
|
# name the gateway does not serve and fills logs with 4xx. External
|
|
# (OpenAI-type) models use TASK_MODEL_EXTERNAL. summarizer = gen seat
|
|
# at temp 0, the right fit for auto-title/tag/query-rewrite. ---
|
|
- TASK_MODEL_EXTERNAL=${TASK_MODEL_EXTERNAL:-summarizer}
|
|
# --- RAG embeddings through the gateway (fleet-consistent; avoids a boot-
|
|
# time HuggingFace download of the default local sentence-transformer). ---
|
|
- RAG_EMBEDDING_ENGINE=${RAG_EMBEDDING_ENGINE:-openai}
|
|
- RAG_EMBEDDING_MODEL=${RAG_EMBEDDING_MODEL:-qwen3-embedding}
|
|
- RAG_OPENAI_API_BASE_URL=${RAG_OPENAI_API_BASE_URL:-http://10.250.50.70:4000/v1}
|
|
- RAG_OPENAI_API_KEY=${OPENAI_API_KEY:?set in .env, from the vault}
|
|
# --- TTS (G4): direct at the dots gateway, engine + base URL settled;
|
|
# model/voice are tts-dev's to tune. Seat is LAN/WG-only, no auth. ---
|
|
- AUDIO_TTS_ENGINE=${AUDIO_TTS_ENGINE:-openai}
|
|
- AUDIO_TTS_OPENAI_API_BASE_URL=${AUDIO_TTS_OPENAI_API_BASE_URL:-http://10.100.79.3:8198/v1}
|
|
- AUDIO_TTS_OPENAI_API_KEY=${AUDIO_TTS_OPENAI_API_KEY:-sk-no-auth-lan-seat}
|
|
- AUDIO_TTS_MODEL=${AUDIO_TTS_MODEL:-tts-1}
|
|
- AUDIO_TTS_VOICE=${AUDIO_TTS_VOICE:-nova}
|
|
# --- Telemetry off. ---
|
|
- ANONYMIZED_TELEMETRY=${ANONYMIZED_TELEMETRY:-False}
|
|
- DO_NOT_TRACK=${DO_NOT_TRACK:-True}
|
|
- SCARF_NO_ANALYTICS=${SCARF_NO_ANALYTICS:-True}
|
|
volumes:
|
|
- open-webui_data:/app/backend/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "python3 -c \"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8080/health').status==200 else 1)\" || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 120s
|
|
networks:
|
|
- tnet
|
|
labels:
|
|
- homepage.group=AI - Gateways & Chat
|
|
- homepage.name=Open WebUI (esh)
|
|
- homepage.icon=mdi-chat-question
|
|
- homepage.description=Env-declarative chat frontend over the LiteLLM gateway (eval vs Lobe)
|
|
- homepage.href=http://10.0.50.45:${OPENWEBUI_PORT:-3211}
|
|
|
|
volumes:
|
|
open-webui_data:
|
|
name: open-webui_data
|
|
|
|
networks:
|
|
tnet:
|
|
name: traefik-net
|
|
external: true
|