open-webui: reach the LLM via the host LAN IP, not the bridge gateway

The bridge gateway (10.89.3.1) lives in the rootless netns; llama-server
runs in the host netns, so the gateway refuses. 192.168.0.143:52625
reaches it through the rootless NAT (verified from the container).
Same LAN-IP pattern the doc already prescribes for the Dankserver
backend.

dankclaw/open-webui/quadlet/open-webui.container

@@ -6,7 +6,7 @@
 # Chat UI for the LLM fleet. It runs on the CPU image (dankclaw is CPU-only, so
 # the :cuda image would waste a large pull for a GPU it cannot use) and points
 # its OpenAI connection at the live vLLM backend on this host via the bridge
-# gateway (10.89.3.1:52625, model frank-default-large). It publishes 3005
+# gateway (192.168.0.143:52625, model frank-default-large). It publishes 3005
 # (3000 is Gitea's HTTP port). Data persists under
 # /home/dank/Containers/open-webui/data. See docs/Dankclaw/OpenWebUI.md.
 #
@@ -15,8 +15,10 @@
 # interface: a zombie that accepted TCP and reset every request, and chat
 # served empty responses for ~2 days with no error anywhere. It now runs on a
 # pinned bridge network (open-webui.network), which has no per-container
-# helper to die. The healthcheck probes /health (app liveness) and requires a
+# helper to die. The LLM is reached via the host LAN IP (192.168.0.143):
-# non-loopback interface (network liveness).
+# the bridge gateway lives in the rootless netns, not the host netns where
+# llama-server runs. The healthcheck probes /health (app liveness) and
+# requires a non-loopback interface (network liveness).
 
 [Unit]
 Description=open-webui chat UI container
@@ -27,7 +29,7 @@ ContainerName=open-webui
 Network=open-webui.network
 Image=ghcr.io/open-webui/open-webui:main
 PublishPort=3005:8080
-Environment=OPENAI_API_BASE_URL=http://10.89.3.1:52625
+Environment=OPENAI_API_BASE_URL=http://192.168.0.143:52625
 Environment=ANONYMIZED_TELEMETRY=False
 Environment=DO_NOT_TRACK=True
 Volume=/home/dank/Containers/open-webui/data:/app/backend/data

dankclaw/open-webui/quadlet/open-webui.network

@@ -11,10 +11,12 @@
 # A kernel bridge has no per-container helper, so the failure mode
 # cannot occur.
 #
-# The subnet is pinned so the gateway IP is deterministic: the LLM
+# The subnet is pinned so the container's own IP (10.89.3.2) is
-# backend (llama-server :52625, bound 0.0.0.0 on the host) is reached
+# deterministic. Note the LLM backend is NOT reached via this gateway:
-# from the container via the gateway. host.containers.internal is a
+# the gateway lives in the rootless netns, while llama-server runs in
-# slirp4netns-only name and does not resolve on a bridge.
+# the host netns. The host's LAN IP (192.168.0.143) reaches it through
+# the rootless NAT. host.containers.internal is a slirp4netns-only name
+# and does not resolve on a bridge.
 #
 # Subnet registry on dankclaw (rootless):
 #   10.88.0.0/16  default "podman" bridge

docs/Dankclaw/OpenWebUI.md

@@ -11,7 +11,7 @@ OpenWebUI is a self-hosted chat interface for LLMs. It connects to OpenAI-compat
 | Image | `ghcr.io/open-webui/open-webui:main` (CPU build; Dankclaw is CPU-only) |
 | Port | 3005 (host) → 8080 (container). Port 3000 is Gitea's HTTP, so it is not usable. |
 | Data volume | `/home/dank/Containers/open-webui/data` → `/app/backend/data` |
-| Default backend | vLLM on Dankclaw `:52625` = `frank-default-large` (via bridge gateway `10.89.3.1:52625`) |
+| Default backend | vLLM on Dankclaw `:52625` = `frank-default-large` (via host LAN IP `192.168.0.143:52625`) |
 | Network | Pinned bridge `systemd-open-webui` (`10.89.3.0/24`, gateway `10.89.3.1`) — see [History](#history) |
 | Persistence | Quadlet unit `open-webui.service`; `[Install] WantedBy=default.target` |
 | Deploy | `scripts/deploy-open-webui-quadlet.sh dankclaw` |
@@ -61,7 +61,7 @@ The quadlet carries a built-in healthcheck (30s interval, 3 retries, 300s start
 - Use the non-CUDA image on this CPU-only host.
 - The default admin account is created on first login; secure it immediately.
 - If the backend is loading (3–8 minute model load), OpenWebUI shows connection errors until the model is ready.
-- The LLM is reached via the bridge gateway `10.89.3.1`, not `host.containers.internal` (that name is slirp4netns-only and does not resolve on a bridge). To reach the Dankserver backend, use the LAN address `192.168.0.235:7770`.
+- The LLM is reached via the host LAN IP `192.168.0.143:52625`, not the bridge gateway: the gateway (`10.89.3.1`) lives in the rootless netns, while llama-server runs in the host netns, so the gateway refuses. `host.containers.internal` is slirp4netns-only and does not resolve on a bridge either. To reach the Dankserver backend, use the LAN address `192.168.0.235:7770`.
 
 ## History
 

tests/open_webui_quadlet.bats

@@ -58,12 +58,14 @@ QDIR="$REPO_ROOT/dankclaw/open-webui/quadlet"
         || { echo "open-webui.container must publish 3005:8080"; return 1; }
 }
 
-@test "open-webui points its LLM at the live vLLM backend (52625) via the bridge gateway" {
+@test "open-webui points its LLM at the live vLLM backend (52625) via the host LAN IP" {
-    # host.containers.internal is a slirp4netns-only name. On the bridge,
+    # host.containers.internal is a slirp4netns-only name. The bridge
-    # the host's 0.0.0.0-bound services are reached via the gateway IP.
+    # gateway (10.89.3.1) lives in the rootless netns, NOT the host netns
-    grep -qE '^Environment=OPENAI_API_BASE_URL=http://10\.89\.3\.1:52625' \
+    # where llama-server runs -- it refuses. The host's LAN IP reaches it
+    # through the rootless NAT (verified from the container, 2026-08-22).
+    grep -qE '^Environment=OPENAI_API_BASE_URL=http://192\.168\.0\.143:52625' \
         "$QDIR/open-webui.container" \
-        || { echo "open-webui.container must set OPENAI_API_BASE_URL to the vLLM on the bridge gateway 10.89.3.1:52625"; return 1; }
+        || { echo "open-webui.container must set OPENAI_API_BASE_URL to the vLLM at 192.168.0.143:52625"; return 1; }
 }
 
 @test "open-webui persists its data under /home/dank/Containers/open-webui/data" {