initial commit

2026-02-23 20:34:35 +01:00 · 2026-02-23 20:34:35 +01:00 · 95a533c876
commit 95a533c876
451 changed files with 18255 additions and 0 deletions
--- a/modules/nixos/open-webui-oci/default.nix
+++ b/modules/nixos/open-webui-oci/default.nix
@ -0,0 +1,168 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.open-webui-oci;
+
+  defaultEnv = {
+    ANONYMIZED_TELEMETRY = "False";
+    BYPASS_MODEL_ACCESS_CONTROL = "True";
+    DEFAULT_LOCALE = "en";
+    DEFAULT_USER_ROLE = "user";
+    DO_NOT_TRACK = "True";
+    ENABLE_DIRECT_CONNECTIONS = "True";
+    ENABLE_IMAGE_GENERATION = "True";
+    ENABLE_PERSISTENT_CONFIG = "False";
+    ENABLE_SIGNUP = "False";
+    ENABLE_SIGNUP_PASSWORD_CONFIRMATION = "True";
+    ENABLE_USER_WEBHOOKS = "True";
+    ENABLE_WEBSEARCH = "True";
+    ENV = "prod";
+    SCARF_NO_ANALYTICS = "True";
+    USER_AGENT = "OpenWebUI";
+    USER_PERMISSIONS_FEATURES_DIRECT_TOOL_SERVERS = "True";
+    WEB_SEARCH_ENGINE = "DuckDuckGo";
+  };
+
+  inherit (lib)
+    concatStringsSep
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkOverride
+    optional
+    types
+    ;
+in
+{
+  options.services.open-webui-oci = {
+    enable = mkEnableOption "Open WebUI container with Podman.";
+    externalUrl = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = literalExpression "http://${config.networking.domain}";
+      description = "Public URL to add to CORS.";
+    };
+    port = mkOption {
+      type = types.port;
+      default = 3000;
+      description = "Which port the Open-WebUI server listens to.";
+    };
+    environment = mkOption {
+      default = { };
+      type = types.attrsOf types.str;
+      description = ''
+        Extra environment variables for Open-WebUI.
+        For more details see <https://docs.openwebui.com/getting-started/advanced-topics/env-configuration/>
+      '';
+    };
+    environmentFile = mkOption {
+      description = "Environment file to be passed to the Open WebUI container.";
+      type = types.nullOr types.path;
+      default = null;
+      example = "config.sops.templates.open-webui-env.path";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    virtualisation.podman = {
+      enable = true;
+      autoPrune.enable = true;
+      dockerCompat = true;
+    };
+
+    networking.firewall.interfaces =
+      let
+        matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+      in
+      {
+        "${matchAll}".allowedUDPPorts = [ 53 ];
+      };
+
+    virtualisation.oci-containers.backend = "podman";
+
+    virtualisation.oci-containers.containers."open-webui" = {
+      image = "ghcr.io/open-webui/open-webui:main";
+      environment =
+        defaultEnv
+        // cfg.environment
+        // {
+          PORT = "${toString cfg.port}";
+          CORS_ALLOW_ORIGIN = concatStringsSep ";" (
+            [
+              "http://localhost:${toString cfg.port}"
+              "http://127.0.0.1:${toString cfg.port}"
+              "http://0.0.0.0:${toString cfg.port}"
+            ]
+            ++ optional (cfg.externalUrl != null) cfg.externalUrl
+          );
+        };
+      environmentFiles = optional (cfg.environmentFile != null) cfg.environmentFile;
+      volumes = [
+        "open-webui_open-webui:/app/backend/data:rw"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network=host"
+      ];
+    };
+    systemd.services."podman-open-webui" = {
+      serviceConfig = {
+        Restart = mkOverride 90 "always";
+      };
+      after = [
+        "podman-network-open-webui_default.service"
+        "podman-volume-open-webui_open-webui.service"
+      ];
+      requires = [
+        "podman-network-open-webui_default.service"
+        "podman-volume-open-webui_open-webui.service"
+      ];
+      partOf = [
+        "podman-compose-open-webui-root.target"
+      ];
+      wantedBy = [
+        "podman-compose-open-webui-root.target"
+      ];
+    };
+
+    systemd.services."podman-network-open-webui_default" = {
+      path = [ pkgs.podman ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStop = "podman network rm -f open-webui_default";
+      };
+      script = ''
+        podman network inspect open-webui_default || podman network create open-webui_default
+      '';
+      partOf = [ "podman-compose-open-webui-root.target" ];
+      wantedBy = [ "podman-compose-open-webui-root.target" ];
+    };
+
+    systemd.services."podman-volume-open-webui_open-webui" = {
+      path = [ pkgs.podman ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      script = ''
+        podman volume inspect open-webui_open-webui || podman volume create open-webui_open-webui
+      '';
+      partOf = [ "podman-compose-open-webui-root.target" ];
+      wantedBy = [ "podman-compose-open-webui-root.target" ];
+    };
+
+    systemd.targets."podman-compose-open-webui-root" = {
+      unitConfig = {
+        Description = "Root target generated by compose2nix.";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+}