all repos — nixfiles @ 9a14aa9e3be24712ed48847f1303d0b1d13e6d38

System and user configuration, managed by nix and home-manager

linde: configure open-webui

Alan Pearce
commit

9a14aa9e3be24712ed48847f1303d0b1d13e6d38

parent

a62ba91858244702f950a346150bda825f1c131e

3 files changed, 38 insertions(+), 0 deletions(-)

changed files
A secrets/open-webui.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 cvV2sw Jj/fu2PxnJb6GdcSOi+XqMcS3s5NDP2lkcXwlDuNaWI
+G/u6xM0l0NyKSDGT8kH72UOawhRTHe+p6z1HQmikAnA
+-> piv-p256 VBDKjg AolxFwoIGqntKFHgVPz1ihp+edYeuy7ngmfif4ULxtlf
+G8jBoXH/TLj3GaetbJbyLvav8B0bJv235OxdVleNrsw
+--- HrDcwbWJbNFzB10mDPO1GjT3Ouf7pDptcAstXRczAm8
+%ۭSb0CĜ>I b]ye=񕓓^iϴw%÷SA$3hY(^p+[VuL+.b<",<qҌ	Ҁv^k@J¢SW~ǍX/M֯p#DےV\W
M secrets/secrets.nix → secrets/secrets.nix
@@ -29,6 +29,7 @@ cifs-transmission = [ linde ];
     cifs-jellyfin = [ linde ];
     ntfy = [ linde ];
     readeck = [ linde ];
+    open-webui = [ linde ];
 
     dyndns = [ nano ];
     syncthing = [ nano ];
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -57,6 +57,7 @@ forgejo-actions-runner.file = ../../secrets/forgejo-actions-runner.age;
     ntfy.file = ../../secrets/ntfy.age;
     pocket-id.file = ../../secrets/pocket-id.age;
     readeck.file = ../../secrets/readeck.age;
+    open-webui.file = ../../secrets/open-webui.age;
   };
 
   boot.loader.efi.efiSysMountPoint = "/boot/efi";

@@ -810,10 +811,39 @@ header_up Remote-User {http.auth.user.tailscale_login}
             }
           '';
         };
+        "chat.${ts-domain}" = {
+          extraConfig = ''
+            bind tailscale/chat
+            tailscale_auth
+            reverse_proxy localhost:${toString config.services.open-webui.port} {
+              header_up X-Webauth-User {http.auth.user.tailscale_login}
+              header_up X-Webauth-Email {http.auth.user.tailscale_user}
+              header_up X-Webauth-Name {http.auth.user.tailscale_name}
+            }
+          '';
+        };
       };
   };
   systemd.services.caddy.serviceConfig = {
     UMask = "007";
+  };
+
+  services.open-webui = {
+    enable = true;
+    environment = {
+      ANONYMIZED_TELEMETRY = "False";
+      DO_NOT_TRACK = "True";
+      ENABLE_VERSION_UPDATE_CHECK = "False";
+
+      ENABLE_API_KEYS = "True";
+      WEBUI_URL = "https://chat.${ts-domain}";
+      WEBUI_AUTH_TRUSTED_EMAIL_HEADER = "X-Webauth-Email";
+      WEBUI_AUTH_TRUSTED_NAME_HEADER = "X-Webauth-User";
+      WEBUI_AUTH = "False";
+      CORS_ALLOW_ORIGIN = "https://chat.${ts-domain}";
+
+      OPENAI_API_BASE_URL = "https://openrouter.ai/api/vi";
+    };
   };
 
   services.goaccess = {