Frank
35381f7e9d
systemd splits unquoted Environment= values on whitespace, so 'OAUTH_SCOPES=openid email profile roles' arrived as 'openid' and the authorize request carried a single scope — the id_token then lacked the email claim and the callback failed. Quoted, all four scopes flow. Also: assign the default openid/email/profile ScopeMappings to the provider (2026.x no longer auto-creates them; without them the token grant is the intersection with the provider's mappings = roles only, and userinfo 403s).
89 lines
4.5 KiB
INI
89 lines
4.5 KiB
INI
# Quadlet unit: open-webui (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/open-webui.container
|
|
# Unit name: open-webui.service (container name: open-webui)
|
|
#
|
|
# Chat UI for the LLM fleet. It runs on the CPU image (dankclaw is CPU-only, so
|
|
# the :cuda image would waste a large pull for a GPU it cannot use) and points
|
|
# its OpenAI connection at the live llama.cpp backend on this host via the
|
|
# host LAN IP (192.168.0.143:7770, model frank-default-large). It publishes 3005
|
|
# (3000 is Gitea's HTTP port). Data persists under
|
|
# /home/dank/Containers/open-webui/data. See serverAppConfigs-docs/Dankclaw/OpenWebUI.md.
|
|
#
|
|
# Network history (2026-08-22): this unit used Network=slirp4netns. When the
|
|
# slirp4netns helper process died, the container kept running but lost its tap
|
|
# interface: a zombie that accepted TCP and reset every request, and chat
|
|
# served empty responses for ~2 days with no error anywhere. It now runs on a
|
|
# pinned bridge network (open-webui.network), which has no per-container
|
|
# helper to die. The LLM is reached via the host LAN IP (192.168.0.143):
|
|
# the bridge gateway lives in the rootless netns, not the host netns where
|
|
# llama-server runs. The healthcheck probes /health (app liveness) and
|
|
# requires a non-loopback interface (network liveness).
|
|
|
|
[Unit]
|
|
Description=open-webui chat UI container
|
|
After=network.target
|
|
|
|
[Container]
|
|
ContainerName=open-webui
|
|
Network=open-webui.network
|
|
Image=ghcr.io/open-webui/open-webui:main
|
|
PublishPort=3005:8080
|
|
Environment=OPENAI_API_BASE_URL=http://192.168.0.143:7770
|
|
Environment=ANONYMIZED_TELEMETRY=False
|
|
Environment=DO_NOT_TRACK=True
|
|
|
|
# SSO via authentik (OIDC authorization-code flow, 2026-09-24). The OAuth
|
|
# client (application slug "open-webui") lives in authentik; the client
|
|
# SECRET stays off-repo in the git-ignored host env file (mode 600). The
|
|
# container reaches the IdP over the public URL: Caddy publishes 0.0.0.0:443
|
|
# and Pi-hole resolves auth.franksdank.cloud to the host LAN IP, so the
|
|
# server-side code exchange works from this bridge. Roles come from the
|
|
# "Open WebUI roles" scope mapping (entitlements "Open WebUI Users" /
|
|
# "Open WebUI Admins"); OAUTH_MERGE_ACCOUNTS_BY_EMAIL folds SSO logins into
|
|
# the existing local account (frank8465@protonmail.com). The OAuth vars are
|
|
# read directly from the environment at runtime (the per-key config DB holds
|
|
# only Admin-Panel overrides, so nothing is seeded on the live data dir).
|
|
# NOTE: the OAUTH_SCOPES value MUST stay quoted — systemd splits unquoted
|
|
# Environment= values on whitespace (unquoted, only "openid" survived).
|
|
EnvironmentFile=/home/dank/Containers/open-webui/env
|
|
Environment=OAUTH_CLIENT_ID=KmtzKc0bjWjaIFeM0puYudI1CLXR2p0jnPCSf4N0
|
|
Environment=OAUTH_PROVIDER_NAME=authentik
|
|
Environment=OPENID_PROVIDER_URL=https://auth.franksdank.cloud/application/o/open-webui/.well-known/openid-configuration
|
|
Environment=OPENID_REDIRECT_URI=https://ai.franksdank.cloud/oauth/oidc/callback
|
|
Environment=WEBUI_URL=https://ai.franksdank.cloud
|
|
Environment=ENABLE_OAUTH_SIGNUP=true
|
|
Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
|
|
Environment="OAUTH_SCOPES=openid email profile roles"
|
|
Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true
|
|
|
|
# Web search -> SearXNG, reached over the host-published port (NOT the
|
|
# search.franksdank.cloud vhost): the Anubis->Authentik guard chain is a
|
|
# browser mechanism and a plain HTTP client cannot solve it. The internal
|
|
# port bypasses Caddy entirely. These env vars SEED the per-key config DB on
|
|
# first run (fill-missing only); once the keys exist in /app/backend/data the
|
|
# DB is authoritative, so this block documents the intent and makes a fresh
|
|
# data dir come up wired. SearXNG's limiter exempts this source (the bridge
|
|
# egress 10.89.x is in pass_ip), so the 4-req/IP/hour JSON cap never applies.
|
|
Environment=ENABLE_WEB_SEARCH=True
|
|
Environment=WEB_SEARCH_ENGINE=searxng
|
|
Environment=SEARXNG_QUERY_URL=http://192.168.0.143:8081/search
|
|
Environment=SEARXNG_LANGUAGE=all
|
|
Environment=WEB_SEARCH_RESULT_COUNT=6
|
|
Volume=/home/dank/Containers/open-webui/data:/app/backend/data
|
|
|
|
# App liveness (/health) AND network liveness (a non-loopback interface must
|
|
# exist; a dead tap leaves only "lo" behind).
|
|
HealthCmd=CMD-SHELL python -c 'import os,urllib.request,sys; urllib.request.urlopen("http://127.0.0.1:8080/health",timeout=5).read(); sys.exit(0 if any(i!="lo" for i in os.listdir("/sys/class/net")) else 1)'
|
|
HealthInterval=30s
|
|
HealthTimeout=10s
|
|
HealthRetries=3
|
|
HealthStartPeriod=300s
|
|
|
|
[Service]
|
|
TimeoutStartSec=900
|
|
Restart=always
|
|
|
|
[Install]
|
|
WantedBy=default.target
|