Frank
d63acd489c
The per-key config DB already pointed web search at SearXNG (engine=searxng, query URL http://192.168.0.143:8081/search), but only inside the data volume. The quadlet now carries the same values as seeding env vars, so a fresh data dir comes up wired, and the doc records the access path: the internal host-published port, not the search. vhost — the Anubis->Authentik guard chain is browser-only, and the bridge egress sits in SearXNG's pass_ip, so the 4-req/IP/hour JSON cap never applies.
65 lines
2.9 KiB
INI
65 lines
2.9 KiB
INI
# Quadlet unit: open-webui (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/open-webui.container
|
|
# Unit name: open-webui.service (container name: open-webui)
|
|
#
|
|
# Chat UI for the LLM fleet. It runs on the CPU image (dankclaw is CPU-only, so
|
|
# the :cuda image would waste a large pull for a GPU it cannot use) and points
|
|
# its OpenAI connection at the live llama.cpp backend on this host via the
|
|
# host LAN IP (192.168.0.143:7770, model frank-default-large). It publishes 3005
|
|
# (3000 is Gitea's HTTP port). Data persists under
|
|
# /home/dank/Containers/open-webui/data. See serverAppConfigs-docs/Dankclaw/OpenWebUI.md.
|
|
#
|
|
# Network history (2026-08-22): this unit used Network=slirp4netns. When the
|
|
# slirp4netns helper process died, the container kept running but lost its tap
|
|
# interface: a zombie that accepted TCP and reset every request, and chat
|
|
# served empty responses for ~2 days with no error anywhere. It now runs on a
|
|
# pinned bridge network (open-webui.network), which has no per-container
|
|
# helper to die. The LLM is reached via the host LAN IP (192.168.0.143):
|
|
# the bridge gateway lives in the rootless netns, not the host netns where
|
|
# llama-server runs. The healthcheck probes /health (app liveness) and
|
|
# requires a non-loopback interface (network liveness).
|
|
|
|
[Unit]
|
|
Description=open-webui chat UI container
|
|
After=network.target
|
|
|
|
[Container]
|
|
ContainerName=open-webui
|
|
Network=open-webui.network
|
|
Image=ghcr.io/open-webui/open-webui:main
|
|
PublishPort=3005:8080
|
|
Environment=OPENAI_API_BASE_URL=http://192.168.0.143:7770
|
|
Environment=ANONYMIZED_TELEMETRY=False
|
|
Environment=DO_NOT_TRACK=True
|
|
|
|
# Web search -> SearXNG, reached over the host-published port (NOT the
|
|
# search.franksdank.cloud vhost): the Anubis->Authentik guard chain is a
|
|
# browser mechanism and a plain HTTP client cannot solve it. The internal
|
|
# port bypasses Caddy entirely. These env vars SEED the per-key config DB on
|
|
# first run (fill-missing only); once the keys exist in /app/backend/data the
|
|
# DB is authoritative, so this block documents the intent and makes a fresh
|
|
# data dir come up wired. SearXNG's limiter exempts this source (the bridge
|
|
# egress 10.89.x is in pass_ip), so the 4-req/IP/hour JSON cap never applies.
|
|
Environment=ENABLE_WEB_SEARCH=True
|
|
Environment=WEB_SEARCH_ENGINE=searxng
|
|
Environment=SEARXNG_QUERY_URL=http://192.168.0.143:8081/search
|
|
Environment=SEARXNG_LANGUAGE=all
|
|
Environment=WEB_SEARCH_RESULT_COUNT=6
|
|
Volume=/home/dank/Containers/open-webui/data:/app/backend/data
|
|
|
|
# App liveness (/health) AND network liveness (a non-loopback interface must
|
|
# exist; a dead tap leaves only "lo" behind).
|
|
HealthCmd=CMD-SHELL python -c 'import os,urllib.request,sys; urllib.request.urlopen("http://127.0.0.1:8080/health",timeout=5).read(); sys.exit(0 if any(i!="lo" for i in os.listdir("/sys/class/net")) else 1)'
|
|
HealthInterval=30s
|
|
HealthTimeout=10s
|
|
HealthRetries=3
|
|
HealthStartPeriod=300s
|
|
|
|
[Service]
|
|
TimeoutStartSec=900
|
|
Restart=always
|
|
|
|
[Install]
|
|
WantedBy=default.target
|