extract open webui to role (without importing—build failure)
1 file changed, 42 insertions(+), 0 deletions(-)
changed files
A system/roles/chat.nix
@@ -0,0 +1,42 @@ +{ + config, + ... +}: +let + ts-domain = "fin-marlin.ts.net"; +in +{ + age.secrets.open-webui.file = ../../secrets/open-webui.age; + + services.open-webui = { + enable = true; + environment = { + ANONYMIZED_TELEMETRY = "False"; + DO_NOT_TRACK = "True"; + ENABLE_VERSION_UPDATE_CHECK = "False"; + + ENABLE_API_KEYS = "True"; + WEBUI_URL = "https://chat.${ts-domain}"; + WEBUI_AUTH_TRUSTED_EMAIL_HEADER = "X-Webauth-Email"; + WEBUI_AUTH_TRUSTED_NAME_HEADER = "X-Webauth-User"; + WEBUI_AUTH = "False"; + CORS_ALLOW_ORIGIN = "https://chat.${ts-domain}"; + + OPENAI_API_BASE_URL = "https://openrouter.ai/api/vi"; + }; + }; + + services.caddy.virtualHosts = { + "chat.${ts-domain}" = { + extraConfig = '' + bind tailscale/chat + tailscale_auth + reverse_proxy localhost:${toString config.services.open-webui.port} { + header_up X-Webauth-User {http.auth.user.tailscale_login} + header_up X-Webauth-Email {http.auth.user.tailscale_user} + header_up X-Webauth-Name {http.auth.user.tailscale_name} + } + ''; + }; + }; +}