linde: configure open-webui
1 file changed, 30 insertions(+), 0 deletions(-)
changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -57,6 +57,7 @@ forgejo-actions-runner.file = ../../secrets/forgejo-actions-runner.age; ntfy.file = ../../secrets/ntfy.age; pocket-id.file = ../../secrets/pocket-id.age; readeck.file = ../../secrets/readeck.age; + open-webui.file = ../../secrets/open-webui.age; }; boot.loader.efi.efiSysMountPoint = "/boot/efi";@@ -810,10 +811,39 @@ header_up Remote-User {http.auth.user.tailscale_login} } ''; }; + "chat.${ts-domain}" = { + extraConfig = '' + bind tailscale/chat + tailscale_auth + reverse_proxy localhost:${toString config.services.open-webui.port} { + header_up X-Webauth-User {http.auth.user.tailscale_login} + header_up X-Webauth-Email {http.auth.user.tailscale_user} + header_up X-Webauth-Name {http.auth.user.tailscale_name} + } + ''; + }; }; }; systemd.services.caddy.serviceConfig = { UMask = "007"; + }; + + services.open-webui = { + enable = true; + environment = { + ANONYMIZED_TELEMETRY = "False"; + DO_NOT_TRACK = "True"; + ENABLE_VERSION_UPDATE_CHECK = "False"; + + ENABLE_API_KEYS = "True"; + WEBUI_URL = "https://chat.${ts-domain}"; + WEBUI_AUTH_TRUSTED_EMAIL_HEADER = "X-Webauth-Email"; + WEBUI_AUTH_TRUSTED_NAME_HEADER = "X-Webauth-User"; + WEBUI_AUTH = "False"; + CORS_ALLOW_ORIGIN = "https://chat.${ts-domain}"; + + OPENAI_API_BASE_URL = "https://openrouter.ai/api/vi"; + }; }; services.goaccess = {