Initial Commit

2026-09-15 15:24:03 -04:00
commit 4dc7086e7e
605 changed files with 101380 additions and 0 deletions
@@ -0,0 +1,120 @@
+# =====================================================================
+# Open WebUI - the front end, and the thing that calls the tool server.
+#
+# TWO SETTINGS HERE ARE LOAD-BEARING FOR owuitools. Everything else is
+# ordinary Open WebUI configuration you can change freely.
+#
+#   ENABLE_FORWARD_USER_INFO_HEADERS
+#       Sends X-OpenWebUI-User-Id and X-OpenWebUI-Chat-Id to the tool
+#       server. Without them the per-user probe budget has nothing to key
+#       on, and the VM sub-agent's live progress view has no chat to post
+#       into - it degrades to "live progress disabled: no usable chat id
+#       was forwarded", which looks like a broken feature.
+#
+#   AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER
+#       Open WebUI's own clock on a tool call. IT IS NOT UNLIMITED WHEN
+#       UNSET: env.py falls back to AIOHTTP_CLIENT_TIMEOUT, which
+#       defaults to 300. A vm_agent session drives a real machine for
+#       minutes to hours, and was being cut off at five minutes with the
+#       work already finished.
+#
+#       There are THREE clocks on that call and they must agree:
+#         OWUITOOLS_VM_WAIT_SECONDS   (configs/owuitools.env, 7000)
+#         proxy_read_timeout          (configs/services/gateway.nginx.conf,
+#                                      7200s, on /tools/vm_agent only)
+#         this one                    (7200)
+#       Keep the app's the smallest, so IT answers rather than a proxy
+#       cutting the connection with no result.
+#
+# If you run this through Portainer, enter these in Portainer's own stack
+# editor. A redeploy regenerates stack.env and discards edits made to the
+# file on disk.
+#
+# The OIDC block at the bottom is entirely optional - delete it and use
+# the built-in login form. It is included because it is what this project
+# was developed against.
+# =====================================================================
+# The project name is pinned, and that matters more than it looks.
+#
+# Compose derives a project name from the directory the compose file is
+# in, so running this as `docker compose -f docs/deployment/...` would
+# create a network called `deployment_default`. The tool server's own
+# compose joins Open WebUI's network BY NAME, expecting
+# `openwebui_default` - so without this line, following the install guide
+# in order fails at the next step with "network declared as external, but
+# could not be found".
+#
+# If you already run Open WebUI under a different project name, set
+# OWUITOOLS_OWUI_NETWORK in configs/owuitools.env instead of changing
+# this.
+name: openwebui
+
+services:
+  open-webui:
+    image: ghcr.io/open-webui/open-webui:main
+    container_name: open-webui
+    restart: unless-stopped
+    init: true
+
+    ports:
+      - "3000:8080"
+
+    environment:
+      # --- required by owuitools ---------------------------------------
+      ENABLE_FORWARD_USER_INFO_HEADERS: "True"
+      AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER: "7200"
+
+      # --- ordinary configuration --------------------------------------
+      TZ: "UTC"
+      OLLAMA_BASE_URL: "http://host.docker.internal:11434"
+      # Generate one: `openssl rand -hex 32`. Changing it logs everyone out.
+      WEBUI_SECRET_KEY: "CHANGE_ME"
+      WEBUI_URL: "https://ai.example.com"
+
+      ENABLE_PERSISTENT_CONFIG: "true"
+      ENABLE_API_KEYS: "true"
+      ENABLE_EVALUATION_ARENA_MODELS: "False"
+
+      # --- optional: OIDC through an identity provider ------------------
+      # Delete this whole block to use the built-in login form instead.
+      # ENABLE_OAUTH_PERSISTENT_CONFIG=false keeps these under the
+      # compose file's control rather than letting the first boot persist
+      # them into the database and then ignore every later change.
+      ENABLE_OAUTH_PERSISTENT_CONFIG: "false"
+      ENABLE_OAUTH_SIGNUP: "true"
+      ENABLE_LOGIN_FORM: "true"
+      OAUTH_MERGE_ACCOUNTS_BY_EMAIL: "true"
+      OAUTH_PROVIDER_NAME: "authentik"
+      OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID:-}
+      OAUTH_CLIENT_SECRET: ${OAUTH_CLIENT_SECRET:-}
+      OPENID_PROVIDER_URL: "https://auth.example.com/application/o/open-webui/.well-known/openid-configuration"
+      OPENID_REDIRECT_URI: "https://ai.example.com/oauth/oidc/callback"
+      OAUTH_SCOPES: "openid email profile"
+      ENABLE_OAUTH_ID_TOKEN_COOKIE: "false"
+      ENABLE_OAUTH_ROLE_MANAGEMENT: "true"
+      OAUTH_ROLES_CLAIM: "roles"
+      OAUTH_ALLOWED_ROLES: "user,admin"
+      OAUTH_ADMIN_ROLES: "admin"
+
+    volumes:
+      - /srv/openwebui/data:/app/backend/data
+
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=5)\" || exit 1"
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 40s
+
+    logging:
+      driver: local
+      options:
+        max-size: "10m"
+        max-file: "5"