noonghunnaandClaude Opus 4.8
092b7c7a46
Hardening from the live cutover validation: - ComfyUI pinned to a known-good commit (COMFYUI_REF default cb9f6394… — has Ideogram-4) instead of floating HEAD, so an upstream change can't silently break users. Set COMFYUI_REF=HEAD to float. Entrypoint is now mounted into the container so pin/bootstrap edits apply on `up` without a 30-min image rebuild (kept +x — a non-exec mounted entrypoint = OCI "permission denied", caught in validation). - OWUI WEBUI_SECRET_KEY no longer hardcoded to "change-this-secret-key" (a shared, forgeable secret); now empty → OWUI generates+persists a strong per-deployment key in the data volume. Override via host env only to share sessions across replicas. Live-validated on the committed compose: end-to-end gen OWUI :8080 → ComfyUI → Ideogram-4 (81 s); boot log confirms "pinned to cb9f6394" + GPU0 pin; OWUI on the persisted key file. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
57 lines
2.5 KiB
YAML
57 lines
2.5 KiB
YAML
services:
|
|
open-webui:
|
|
# Pinned (was :main) — v0.9.6 live-validated 2026-06-09: image-gen + chat config
|
|
# survive the migration. Bump deliberately, re-validate the image-gen wiring.
|
|
image: ghcr.io/open-webui/open-webui:v0.9.6
|
|
container_name: open-webui
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- open-webui-data:/app/backend/data
|
|
env_file:
|
|
# Image generation: Ideogram-4 → ComfyUI (:8188). PersistentConfig — applies on a
|
|
# FRESH volume; on an existing volume set it in Admin → Settings → Images instead.
|
|
- ./imagegen.env
|
|
environment:
|
|
# Chat model — DEFAULT: gemma-4-12b on the spare GPU (coexists with ComfyUI image gen).
|
|
# Bring it up with `gpu-mode image-studio`; it serves an OpenAI API on :8069 (no auth).
|
|
- OPENAI_API_BASE_URL=http://host.docker.internal:8069/v1
|
|
- OPENAI_API_KEY=sk-noauth
|
|
# Alternative — route chat through LiteLLM (the full catalog, but GPU-mutex with
|
|
# ComfyUI). Swap the two lines above for these:
|
|
# - OPENAI_API_BASE_URL=http://host.docker.internal:4000/v1
|
|
# - OPENAI_API_KEY=sk-litellm-master-key
|
|
- OLLAMA_BASE_URL=http://host.docker.internal:11434
|
|
# Leave empty → Open WebUI generates a strong random key on first boot and persists it
|
|
# in the data volume (.webui_secret_key). NEVER ship a hardcoded shared secret (it would
|
|
# let anyone forge session tokens). Override via the host env only to share sessions
|
|
# across replicas: WEBUI_SECRET_KEY=<your-secret> docker compose up -d
|
|
- WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY:-}
|
|
|
|
# --- Web search / RAG ---
|
|
- ENABLE_RAG_WEB_SEARCH=true
|
|
- RAG_WEB_SEARCH_ENGINE=searxng
|
|
- RAG_WEB_SEARCH_RESULT_COUNT=5
|
|
- RAG_WEB_SEARCH_CONCURRENT_REQUESTS=5
|
|
- SEARXNG_QUERY_URL=http://host.docker.internal:8088/search?q=<query>&format=json
|
|
|
|
# Fallback / additional providers (keys loaded if set in env)
|
|
- BRAVE_SEARCH_API_KEY=${BRAVE_SEARCH_API_KEY:-}
|
|
- TAVILY_API_KEY=${TAVILY_API_KEY:-}
|
|
- GOOGLE_PSE_API_KEY=${GOOGLE_PSE_API_KEY:-}
|
|
- GOOGLE_PSE_ENGINE_ID=${GOOGLE_PSE_ENGINE_ID:-}
|
|
- SERPER_API_KEY=${SERPER_API_KEY:-}
|
|
- JINA_API_KEY=${JINA_API_KEY:-}
|
|
|
|
# --- URL-paste / page loading ---
|
|
- ENABLE_RAG_LOCAL_WEB_FETCH=true
|
|
|
|
# --- Image/file upload, document RAG ---
|
|
- ENABLE_RAG_HYBRID_SEARCH=true
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
|
|
volumes:
|
|
open-webui-data:
|