Frank
da68b5ce1a
basicauth (2026-08-22 incident): - the Caddyfile template carried its own $2a$14$ prefix and deploy.sh substituted the full hash (prefix included), rendering an invalid double-prefixed hash. Every basicauth vhost rejected every password with 401 and Caddy logged nothing. - template is now a bare REPLACE_WITH_HASH token; tests pin the render contract (no prefix in template; rendered line is exactly 'dank <hash>'). open-webui (2026-08-22 incident): - its slirp4netns helper process died, leaving the container running with only 'lo' in its netns: port 3005 accepted TCP and reset every request, so chat served empty responses for ~2 days, unlogged. - move to a pinned bridge network (systemd-open-webui, 10.89.3.0/24, gw 10.89.3.1) — no per-container helper to die. - LLM endpoint reached via the gateway (host.containers.internal is slirp-only): OPENAI_API_BASE_URL=http://10.89.3.1:52625. - add a quadlet healthcheck: /health (app) + non-loopback interface (network liveness; the dead-tap state leaves only 'lo'). - deploy script now copies the .network file too. - docs updated (OpenWebUI History section, Caddy basic-auth contract).
105 lines
3.6 KiB
Bash
Executable File
105 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# deploy-open-webui-quadlet.sh — Install and (re)start open-webui on dankclaw.
|
|
#
|
|
# open-webui is boot-persistent via Quadlet (see AGENTS.md). This script:
|
|
# 1. Pushes main to origin
|
|
# 2. Pulls the repo on the target
|
|
# 3. Creates the data dir and copies the unit + network into ~/.config/containers/systemd/
|
|
# 4. daemon-reloads and starts open-webui (first run pulls the image)
|
|
#
|
|
# It is idempotent: it stops any running unit and removes any container with the
|
|
# name (a prior run or a bare-container leftover) before reinstalling and
|
|
# starting. The data dir is preserved across reruns, so existing chats survive.
|
|
#
|
|
# Usage:
|
|
# ./scripts/deploy-open-webui-quadlet.sh <target> [--dry-run]
|
|
# ./scripts/deploy-open-webui-quadlet.sh dankclaw
|
|
set -euo pipefail
|
|
|
|
REMOTE_USER="dank"
|
|
REMOTE_HOST="dankclaw"
|
|
REMOTE_DIR="/home/dank/serverAppConfigs"
|
|
QDIR="dankclaw/open-webui/quadlet"
|
|
UNIT="open-webui.service"
|
|
DATA_DIR="/home/dank/Containers/open-webui/data"
|
|
|
|
TARGET="${1:-}"
|
|
DRY_RUN=0
|
|
if [ "${2:-}" = "--dry-run" ]; then
|
|
DRY_RUN=1
|
|
fi
|
|
|
|
if [ -z "${TARGET:-}" ]; then
|
|
echo "Usage: $0 <target> [--dry-run]"
|
|
exit 1
|
|
fi
|
|
if [ "${TARGET}" != "dankclaw" ]; then
|
|
echo "This stack runs only on dankclaw (got: ${TARGET})"
|
|
exit 1
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Local pre-flight
|
|
# ---------------------------------------------------------------------------
|
|
cd "$(dirname "$0")/.."
|
|
if ! git diff --quiet HEAD; then
|
|
echo "FAIL: Local working tree has uncommitted changes. Commit first."
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$DRY_RUN" = "1" ]; then
|
|
echo "[dry-run] Would push main, pull on ${REMOTE_HOST}, install ${UNIT}, and start it (data at ${DATA_DIR})."
|
|
exit 0
|
|
fi
|
|
|
|
echo "=== Deploying open-webui quadlet to ${REMOTE_HOST} ==="
|
|
echo "[1/3] Pushing local main to origin..."
|
|
git push origin main
|
|
|
|
REMOTE="${REMOTE_USER}@${REMOTE_HOST}"
|
|
|
|
echo "[2/3] Installing and starting ${UNIT} on ${REMOTE_HOST}..."
|
|
ssh "$REMOTE" bash -s <<REMOTE_EOF
|
|
set -euo pipefail
|
|
cd '${REMOTE_DIR}'
|
|
|
|
echo ' Pulling repo...'
|
|
git pull origin main
|
|
|
|
echo ' Stopping any running unit (idempotent)...'
|
|
systemctl --user stop '${UNIT}' 2>/dev/null || true
|
|
|
|
echo ' Removing any container with the name (prior run or bare-container leftover)...'
|
|
podman rm -f open-webui 2>/dev/null || true
|
|
|
|
echo ' Creating the data dir (preserved across reruns)...'
|
|
mkdir -p '${DATA_DIR}'
|
|
|
|
echo ' Copying the quadlet unit + network into ~/.config/containers/systemd/ ...'
|
|
mkdir -p ~/.config/containers/systemd
|
|
cp ${QDIR}/open-webui.container ~/.config/containers/systemd/
|
|
cp ${QDIR}/open-webui.network ~/.config/containers/systemd/
|
|
|
|
echo ' daemon-reload (generates the unit)...'
|
|
# Quadlet units are generator-managed: systemctl enable fails on them. The
|
|
# [Install] WantedBy=default.target in the .container file is itself the
|
|
# enablement (is-enabled reports "generated"); with user linger on it starts at
|
|
# boot. So: daemon-reload, then start.
|
|
systemctl --user daemon-reload
|
|
|
|
echo ' Starting (first run pulls the image; this can take a while)...'
|
|
systemctl --user start '${UNIT}'
|
|
|
|
echo ' Unit state:'
|
|
systemctl --user --no-pager status '${UNIT}' 2>&1 | grep -E "●|Active:" || true
|
|
REMOTE_EOF
|
|
|
|
echo "[3/3] Verifying open-webui is up..."
|
|
ssh "$REMOTE" '
|
|
echo " is-enabled: $(systemctl --user is-enabled open-webui.service 2>&1) (boot-persistent)"
|
|
echo " port 3005:"; (ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null) | grep -E ":3005\b" || echo " (not listening yet)"
|
|
echo " HTTP probe:"; curl -s -o /dev/null -w " http://127.0.0.1:3005 -> %{http_code}\n" -m 10 http://127.0.0.1:3005/ || echo " (no HTTP yet)"
|
|
' || true
|
|
|
|
echo "=== open-webui quadlet deployed to ${REMOTE_HOST} ==="
|