diff --git a/dankclaw/open-webui/quadlet/open-webui.container b/dankclaw/open-webui/quadlet/open-webui.container index d401182..105e7a5 100644 --- a/dankclaw/open-webui/quadlet/open-webui.container +++ b/dankclaw/open-webui/quadlet/open-webui.container @@ -6,7 +6,7 @@ # Chat UI for the LLM fleet. It runs on the CPU image (dankclaw is CPU-only, so # the :cuda image would waste a large pull for a GPU it cannot use) and points # its OpenAI connection at the live vLLM backend on this host via the bridge -# gateway (10.89.3.1:52625, model frank-default-large). It publishes 3005 +# gateway (192.168.0.143:52625, model frank-default-large). It publishes 3005 # (3000 is Gitea's HTTP port). Data persists under # /home/dank/Containers/open-webui/data. See docs/Dankclaw/OpenWebUI.md. # @@ -15,8 +15,10 @@ # interface: a zombie that accepted TCP and reset every request, and chat # served empty responses for ~2 days with no error anywhere. It now runs on a # pinned bridge network (open-webui.network), which has no per-container -# helper to die. The healthcheck probes /health (app liveness) and requires a -# non-loopback interface (network liveness). +# helper to die. The LLM is reached via the host LAN IP (192.168.0.143): +# the bridge gateway lives in the rootless netns, not the host netns where +# llama-server runs. The healthcheck probes /health (app liveness) and +# requires a non-loopback interface (network liveness). [Unit] Description=open-webui chat UI container @@ -27,7 +29,7 @@ ContainerName=open-webui Network=open-webui.network Image=ghcr.io/open-webui/open-webui:main PublishPort=3005:8080 -Environment=OPENAI_API_BASE_URL=http://10.89.3.1:52625 +Environment=OPENAI_API_BASE_URL=http://192.168.0.143:52625 Environment=ANONYMIZED_TELEMETRY=False Environment=DO_NOT_TRACK=True Volume=/home/dank/Containers/open-webui/data:/app/backend/data diff --git a/dankclaw/open-webui/quadlet/open-webui.network b/dankclaw/open-webui/quadlet/open-webui.network index 3e272ad..0903aa0 100644 --- a/dankclaw/open-webui/quadlet/open-webui.network +++ b/dankclaw/open-webui/quadlet/open-webui.network @@ -11,10 +11,12 @@ # A kernel bridge has no per-container helper, so the failure mode # cannot occur. # -# The subnet is pinned so the gateway IP is deterministic: the LLM -# backend (llama-server :52625, bound 0.0.0.0 on the host) is reached -# from the container via the gateway. host.containers.internal is a -# slirp4netns-only name and does not resolve on a bridge. +# The subnet is pinned so the container's own IP (10.89.3.2) is +# deterministic. Note the LLM backend is NOT reached via this gateway: +# the gateway lives in the rootless netns, while llama-server runs in +# the host netns. The host's LAN IP (192.168.0.143) reaches it through +# the rootless NAT. host.containers.internal is a slirp4netns-only name +# and does not resolve on a bridge. # # Subnet registry on dankclaw (rootless): # 10.88.0.0/16 default "podman" bridge diff --git a/docs/Dankclaw/OpenWebUI.md b/docs/Dankclaw/OpenWebUI.md index 83aed1e..a2006e6 100644 --- a/docs/Dankclaw/OpenWebUI.md +++ b/docs/Dankclaw/OpenWebUI.md @@ -11,7 +11,7 @@ OpenWebUI is a self-hosted chat interface for LLMs. It connects to OpenAI-compat | Image | `ghcr.io/open-webui/open-webui:main` (CPU build; Dankclaw is CPU-only) | | Port | 3005 (host) → 8080 (container). Port 3000 is Gitea's HTTP, so it is not usable. | | Data volume | `/home/dank/Containers/open-webui/data` → `/app/backend/data` | -| Default backend | vLLM on Dankclaw `:52625` = `frank-default-large` (via bridge gateway `10.89.3.1:52625`) | +| Default backend | vLLM on Dankclaw `:52625` = `frank-default-large` (via host LAN IP `192.168.0.143:52625`) | | Network | Pinned bridge `systemd-open-webui` (`10.89.3.0/24`, gateway `10.89.3.1`) — see [History](#history) | | Persistence | Quadlet unit `open-webui.service`; `[Install] WantedBy=default.target` | | Deploy | `scripts/deploy-open-webui-quadlet.sh dankclaw` | @@ -61,7 +61,7 @@ The quadlet carries a built-in healthcheck (30s interval, 3 retries, 300s start - Use the non-CUDA image on this CPU-only host. - The default admin account is created on first login; secure it immediately. - If the backend is loading (3–8 minute model load), OpenWebUI shows connection errors until the model is ready. -- The LLM is reached via the bridge gateway `10.89.3.1`, not `host.containers.internal` (that name is slirp4netns-only and does not resolve on a bridge). To reach the Dankserver backend, use the LAN address `192.168.0.235:7770`. +- The LLM is reached via the host LAN IP `192.168.0.143:52625`, not the bridge gateway: the gateway (`10.89.3.1`) lives in the rootless netns, while llama-server runs in the host netns, so the gateway refuses. `host.containers.internal` is slirp4netns-only and does not resolve on a bridge either. To reach the Dankserver backend, use the LAN address `192.168.0.235:7770`. ## History diff --git a/tests/open_webui_quadlet.bats b/tests/open_webui_quadlet.bats index ceb22d8..6fdba5b 100644 --- a/tests/open_webui_quadlet.bats +++ b/tests/open_webui_quadlet.bats @@ -58,12 +58,14 @@ QDIR="$REPO_ROOT/dankclaw/open-webui/quadlet" || { echo "open-webui.container must publish 3005:8080"; return 1; } } -@test "open-webui points its LLM at the live vLLM backend (52625) via the bridge gateway" { - # host.containers.internal is a slirp4netns-only name. On the bridge, - # the host's 0.0.0.0-bound services are reached via the gateway IP. - grep -qE '^Environment=OPENAI_API_BASE_URL=http://10\.89\.3\.1:52625' \ +@test "open-webui points its LLM at the live vLLM backend (52625) via the host LAN IP" { + # host.containers.internal is a slirp4netns-only name. The bridge + # gateway (10.89.3.1) lives in the rootless netns, NOT the host netns + # where llama-server runs -- it refuses. The host's LAN IP reaches it + # through the rootless NAT (verified from the container, 2026-08-22). + grep -qE '^Environment=OPENAI_API_BASE_URL=http://192\.168\.0\.143:52625' \ "$QDIR/open-webui.container" \ - || { echo "open-webui.container must set OPENAI_API_BASE_URL to the vLLM on the bridge gateway 10.89.3.1:52625"; return 1; } + || { echo "open-webui.container must set OPENAI_API_BASE_URL to the vLLM at 192.168.0.143:52625"; return 1; } } @test "open-webui persists its data under /home/dank/Containers/open-webui/data" {