Open WebUI

Open WebUI is a self-hosted web chat interface for large language models. This module runs Open WebUI on NethServer 8 and connects it to an external Ollama instance. Login with Active Directory / LDAP accounts is supported.

The Open WebUI app announcement TBA

Open WebUI is a community application from the tebbiworld repository. Documentation and source can be found on Github

• Included: the Open WebUI front end (chat interface, user management, conversation history, document upload).
• Not included: Ollama and the language models. They run on a separate host that you size and operate yourself (GPU, RAM, model storage), for example a virtual machine or a container on your hypervisor.

This separation keeps the NS8 node free of the inference load. The node only needs network access to the Ollama API.

• One rootless container, image ghcr.io/open-webui/open-webui:main.
• The container listens on the node loopback only: 127.0.0.1:<allocated port> is forwarded to container port 8080. Traefik publishes it on the configured host name and handles TLS and WebSocket.
• Open WebUI connects to Ollama through the configured Ollama base URL.
• One named volume, openwebui-data, mounted at /app/backend/data. It holds the SQLite database (users, chats), uploaded files, the RAG vector store and avatars.

• Ollama must be reachable from the NS8 node on its API port, by default 11434.
• Ollama binds to 127.0.0.1 only. To accept connections from the network, set OLLAMA_HOST on the Ollama host, for example OLLAMA_HOST=0.0.0.0:11434 (see the Ollama FAQ).
• Restrict access to that port, on the Ollama host or in your firewall, to the machines that need it.

On a NethServer 8 node:

add-module ghcr.io/tebbiworld/openwebui:latest 1

All settings are made on the settings page of the module in the NS8 cluster-admin.

The module starts Open WebUI with ENABLE_PERSISTENT_CONFIG=false. The values from the module settings therefore apply at every start.

Consequence: settings changed in the Open WebUI admin panel are kept only until the next container restart and then fall back to the values from the module settings. This also applies to self-registration. Open WebUI switches self-registration off after the first account has been created, but after a restart the value from the module settings applies again. Switch Allow self-registration off in the module settings.

1. Set the host name and the Ollama base address in the module settings and save.
2. Open the published address. The first account that logs in becomes administrator, whether it is a local signup or the first AD/LDAP login. Create this account immediately after the installation, before anyone else can reach the address.
3. Switch Allow self-registration off in the module settings.
4. Select a model in the chat. Models are downloaded and executed on the Ollama host, not on the NS8 node.

• The LDAP bind password and the session key WEBUI_SECRET_KEY are stored in the module configuration (state/environment) and in the container environment file state/openwebui.env. Use a dedicated read-only bind account.
• Keep Default role for new accounts on pending unless everyone who can reach the address may use the models.
• Protect the Ollama API port on the network, see Prerequisites.

The module does not list its volume for the NS8 backup; there is no state-include.conf. An NS8 backup of this module contains the module environment only, not the users, chats and uploaded files in openwebui-data. Back up that volume separately until this is added to the module.

The module references the upstream tag open-webui:main, which moves with upstream releases. Which Open WebUI version runs depends on when the image was pulled. For reproducible deployments, pin the image to a fixed version in build-images.sh.

c't 16/2026 covers the same scenario in its article Einer fürs Team (p. 114 ff., section KI-Modelle selbst betreiben): setting up an Open WebUI server for a small working group. The article argues that a self-operated server keeps the data on the machine and therefore also suits sensitive data, and that relying entirely on an external provider's infrastructure carries a risk — written after the export restriction on a commercial language model in June 2026. Alongside the setup it covers the administrative side: updates, security and monitoring. The NS8 module takes over the deployment part of that; the operational questions remain.

• c't 16/2026, p. 114: Einer fürs Team (paid)

• Open WebUI documentation
• Ollama
• Bug reports

Private hobby project, shared as-is. No warranty, no guaranteed support, use at your own risk. Unofficial community package, not affiliated with or endorsed by the Open WebUI or Ollama projects. The module's own code is licensed GPL-3.0-or-later.