From 232f8eb2e2c3ad4ea5a2377926602f542a2a531b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey?= Date: Sat, 7 Mar 2026 22:35:52 -0800 Subject: [PATCH 1/4] feat(glyph): add Open WebUI service Enable Open WebUI on port 8888 with Ollama API disabled, configured for use with external API providers (Anthropic, OpenAI). Co-Authored-By: Claude Opus 4.6 --- hosts/glyph/services/default.nix | 1 + hosts/glyph/services/open-webui.nix | 14 ++++++++++++++ modules/base/unfree-packages.nix | 1 + 3 files changed, 16 insertions(+) create mode 100644 hosts/glyph/services/open-webui.nix diff --git a/hosts/glyph/services/default.nix b/hosts/glyph/services/default.nix index 1f8ea9ea..392efbb2 100644 --- a/hosts/glyph/services/default.nix +++ b/hosts/glyph/services/default.nix @@ -9,6 +9,7 @@ ./filebrowser.nix ./jellyfin.nix ./nfs.nix + ./open-webui.nix ./prometheus.nix ./samba.nix ./torrents.nix diff --git a/hosts/glyph/services/open-webui.nix b/hosts/glyph/services/open-webui.nix new file mode 100644 index 00000000..e494fbdc --- /dev/null +++ b/hosts/glyph/services/open-webui.nix @@ -0,0 +1,14 @@ +{ + config, + pkgs, + ... +}: { + services.open-webui = { + enable = true; + port = 8888; + host = "0.0.0.0"; + environment = { + ENABLE_OLLAMA_API = "False"; + }; + }; +} diff --git a/modules/base/unfree-packages.nix b/modules/base/unfree-packages.nix index 7e2b7e9f..7850d1c3 100644 --- a/modules/base/unfree-packages.nix +++ b/modules/base/unfree-packages.nix @@ -12,6 +12,7 @@ "fastscripts" "graphite-cli" "mochi" + "open-webui" "plexmediaserver" "roon-server" "slack" From 8594db47a23fcf5537a906593136c59ed4b4e44a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey?= Date: Sat, 7 Mar 2026 22:37:25 -0800 Subject: [PATCH 2/4] feat(glyph): add Open WebUI state to restic backup Co-Authored-By: Claude Opus 4.6 --- hosts/glyph/services/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/hosts/glyph/services/default.nix b/hosts/glyph/services/default.nix index 392efbb2..2eeca607 100644 --- a/hosts/glyph/services/default.nix +++ b/hosts/glyph/services/default.nix @@ -78,6 +78,7 @@ enable = true; paths = [ "/var/lib/basic-memory" + "/var/lib/open-webui" "/var/lib/roon-server/backup" ]; }; From 1941945405cdc64bf16fcada686b218fd388c75f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey?= Date: Mon, 9 Mar 2026 08:49:21 -0700 Subject: [PATCH 3/4] feat(glyph): configure Open WebUI security and API secrets Add agenix-managed environment file for WEBUI_SECRET_KEY and API keys. Harden configuration: disable signup, set session cookie secure flag, configure CORS and WEBUI_URL for chat.zx.dev, and disable persistent config to enforce env-var-only settings. Co-Authored-By: Claude Opus 4.6 --- hosts/glyph/secrets/open-webui-env.age | Bin 0 -> 579 bytes hosts/glyph/services/open-webui.nix | 14 +++++++++----- lib/secrets/glyph.nix | 1 + 3 files changed, 10 insertions(+), 5 deletions(-) create mode 100644 hosts/glyph/secrets/open-webui-env.age diff --git a/hosts/glyph/secrets/open-webui-env.age b/hosts/glyph/secrets/open-webui-env.age new file mode 100644 index 0000000000000000000000000000000000000000..1cbbd5e7e150523357bdbc8eb8351202334f4ab1 GIT binary patch literal 579 zcmV-J0=)fUXJsvAZewzJaCB*JZZ2fgAZ$@9Ze?R+VrNEHM=wY-Y&SG*XKrd{GhpKRb3|@93T0SO zNic0iZDdYmXF@YdXLdqYD^W>#S!^&#N;5ZfOK>l2PgrPmZ!>gj3N0-yAXhg;d3Y-~ zb#_uKQZi#hb1-ODSWq={Hc)OeR#j$WYkDzEZE0C$GeKE%3T5cw$?YjDpi1Uw%UsVg zvFpwhXm5R)78^j4FYd>MlPQt-gxs=3u3Mh`Bji&JKk#y=#Mb-kufN1={C z(utDz*B!|-A<~CoRnBZxu{ym^YHnTgTSTze zJ!qz6g1^%gD}1e9|IgERsGlaFr@K~f!}CjC&o7lJC2q0&hm227(Iy(T{w~QOE9e*n R@Th~5r-k-f{Und8Vb`D+^eX@W literal 0 HcmV?d00001 diff --git a/hosts/glyph/services/open-webui.nix b/hosts/glyph/services/open-webui.nix index e494fbdc..d7a1aa6f 100644 --- a/hosts/glyph/services/open-webui.nix +++ b/hosts/glyph/services/open-webui.nix @@ -1,14 +1,18 @@ -{ - config, - pkgs, - ... -}: { +{config, ...}: { + age.secrets.open-webui-env.file = ./../secrets/open-webui-env.age; + services.open-webui = { enable = true; port = 8888; host = "0.0.0.0"; + environmentFile = config.age.secrets.open-webui-env.path; environment = { ENABLE_OLLAMA_API = "False"; + ENABLE_SIGNUP = "False"; + ENABLE_PERSISTENT_CONFIG = "False"; + WEBUI_URL = "https://chat.zx.dev"; + WEBUI_SESSION_COOKIE_SECURE = "True"; + CORS_ALLOW_ORIGIN = "https://chat.zx.dev"; }; }; } diff --git a/lib/secrets/glyph.nix b/lib/secrets/glyph.nix index 7c5b4dea..89741c57 100644 --- a/lib/secrets/glyph.nix +++ b/lib/secrets/glyph.nix @@ -6,4 +6,5 @@ in { "hosts/glyph/secrets/pushover-user-token.age".publicKeys = keys; "hosts/glyph/secrets/kagi-api-key.age".publicKeys = keys; "hosts/glyph/secrets/context7-api-key.age".publicKeys = keys; + "hosts/glyph/secrets/open-webui-env.age".publicKeys = keys; } From 68a0ec140af462e8b5ae441ae230a567affa9e1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey?= Date: Mon, 9 Mar 2026 08:58:13 -0700 Subject: [PATCH 4/4] feat(glyph): configure Open WebUI security, secrets, and OIDC auth Add agenix-managed environment file for WEBUI_SECRET_KEY, API keys, and OAuth credentials. Harden configuration: disable signup and password login, set session cookie secure flag, configure CORS and WEBUI_URL for chat.zx.dev. Add Pocket ID OIDC integration with role and group management. Co-Authored-By: Claude Opus 4.6 --- hosts/glyph/secrets/open-webui-env.age | Bin 579 -> 659 bytes hosts/glyph/services/open-webui.nix | 14 ++++++++++++++ 2 files changed, 14 insertions(+) diff --git a/hosts/glyph/secrets/open-webui-env.age b/hosts/glyph/secrets/open-webui-env.age index 1cbbd5e7e150523357bdbc8eb8351202334f4ab1..6b4154489d02b4c50435b41d944f2adac0d21565 100644 GIT binary patch delta 626 zcmV-&0*(E{1d|1jEPrJybY^gEL~&O{baGlkO?o+0R8?9{QY&&*JPGd(x zN>o*DYYIeSNm(y5VN^qUSvYWWNl{vGHflIjN=$8VM|LzeQAcV?cs4gyH(^dxFbXX` zAaiqQEoEdfH8n9gATvc*Xl_v;H%@IsYBEe^Hf3-yGGR(NaDOW}R6{XmNv(#Nrzk|pqg!zcfhnOTTa(@FDxK1lzwu_@E= zHc@h!gKOIRgfo;eFR~A5e)dqQuwJ>kt;R^4EJ$-ar-d8A`_?%fmlHEb-#vJ(CvAwRC>Nnu3Iki M=JIiE@|=ePfiT|+HUIzs delta 546 zcmV+-0^R+S1;Yf8EPr@1H%?ehFjP!xT3Ki}FLzZmW-D?=S6X*3H*8RDV@h;kWOs0G zV^mi%V+vFGw?NH-9v3XKrd{GhpKRb3|@93T0SONic0iZDdYmXF@YdXLdqYD^W>#S!^&#N;5ZfOK>l2PgrPm zZ!>gj3N0-yAXhg;d3Y-~b#_uKQZi#hb1-ODSWq={Hc)OeR#j$WYkDzEZE0C$GeKE% z3T5cw$?YjDpnpo{XvCf zkZ~ABt5{fb*qtz}Pj-fPF24oyeU!nvCNY*n#3y-#XxUGrN+u-83kreuP@(-bRwtzQ4n(|4$!CZMOgR&T@eOJ2_}l_@1| kvHXXOPa96rCK|Q=F3BM)=okg?sDqNHh4xzgB#*0M*Ut>