Configuring Open Webui behind Treafki reverse proxy

[flefevre]

Dear Open Webui community,
I am trying to configure open webui to be accessible not from http://myserver:4000 but from http://myserver/openwebui
I would like to use Traefik reverse proxy.
I have tried to modify my docker-compose file without success.
Do you have any idea why nothing appears on the web page?

`version: '3.9'

services:
#TRAEFIK OPERATIONAL
ollama:
#Get up and running with large language models, locally.
#https://github.com/ollama/ollama
profiles: ["fullstack", "preload", "test"]
image: ollama/ollama:0.1.26
container_name: cnollama
env_file:
- .env
environment:
- OLLAMA_MODELS=/root/.ollama/models
volumes:
- ollama:/root/.ollama
- ./ollama/models:/root/.ollama/models
tty: true
restart: unless-stopped
labels:
#active Traefik pour ce service.
- "traefik.enable=true"
#définit une règle pour router toutes les requêtes qui commencent par /ollama/ vers ce service.
- "traefik.http.routers.ollama.rule=PathPrefix(/ollama/)"
#utilise un middleware pour modifisolateder la requête avant qu'elle n'atteigne votre application.
- "traefik.http.routers.ollama.middlewares=ollama-stripprefix"
#est le middleware qui supprime le préfixe /ollama de l'URL avant de transmettre la requête à votre application.
#Cela est nécessaire car votre application ne s'attend probablement pas à recevoir des requêtes qui commencent par /ollama.
- "traefik.http.middlewares.ollama-stripprefix.stripprefix.prefixes=/ollama"
#indique à Traefik le port interne du service à utiliser pour le routage.
- "traefik.http.services.ollama.loadbalancer.server.port=11434"
# ports:
# - "11434:11434"
networks:
- netiagen4springisolated
# depends_on:
# - nginx
deploy:
resources:
reservations:
devices:
- driver: nvidia
count: 1
capabilities: [gpu]

openwebui:
#extensible, feature-rich, and user-friendly self-hosted WebUI designed to operate entirely offline
#https://github.com/open-webui/open-webui
profiles: ["fullstack", "test"]
image: ghcr.io/open-webui/open-webui:git-2fa9495
container_name: cnopenwebui
volumes:
- ./open-webui/open-webui:/app/backend/data
depends_on:
- ollama
#- traefik
labels:
- "traefik.enable=true"
- "traefik.http.routers.openwebui.rule=PathPrefix(/openwebui/)"
#- "traefik.http.middlewares.add-open-webui.addprefix.prefix=/open-webui"
- "traefik.http.routers.openwebui.middlewares=openwebui-stripprefix"
- "traefik.http.middlewares.openwebui-stripprefix.stripprefix.prefixes=/openwebui"
- "traefik.http.services.openwebui.loadbalancer.server.port=8080"
ports:
- ${OPEN_WEBUI_PORT-4000}:8080
env_file:
- .env
environment:
- 'OLLAMA_BASE_URL=http://ollama:11434'
#- 'OLLAMA_BASE_URLS=http://ollama:11434;http://ollama2:11435'
- 'WEBUI_SECRET_KEY='
extra_hosts:
- host.docker.internal:host-gateway
restart: unless-stopped
networks:
- netiagen4springisolated

traefik:
#
profiles: ["test"]
image: "traefik:v3.0"
container_name: cntraefik
command:
- "--log.level=INFO"
#Traefik will listen on port 8080 by default for API request.
- "--api.insecure=true"
#Enabling Docker provider
- "--providers.docker=true"
#Do not expose containers unless explicitly told so
- "--providers.docker.exposedbydefault=false"
#Traefik will listen to incoming request on the port 80 (HTTP)
- "--entrypoints.web.address=:80"
#Traefik dashboard activation
- "--api.dashboard=true"
ports:
- "80:80"
- "8080:8080"
- "443:443"
labels:
- "traefik.enable=true"
- "traefik.http.routers.api.entryPoints=traefik"
- "traefik.http.routers.api.rule=PathPrefix(/api) || PathPrefix(/dashboard)"
- "traefik.http.routers.api.service=api@internal"
- "traefik.http.routers.api.middlewares=api-auth"
- "traefik.http.middlewares.api-auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/" # test:test
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- ./traefik:/etc/traefik
networks:
- netiagen4springisolated
- netiagen4springinternet

whoami2:
profiles: ["test"]
image: "traefik/whoami:v1.7.1"
container_name: cnsimpleservice2
env_file:
- .env
labels:
- traefik.enable=true
- traefik.constraint-label-stack=${TRAEFIK_TAG?Variable not set}
- traefik.http.routers.${STACK_NAME?Variable not set}-whoami2-http.rule=PathPrefix(/api/v1) || PathPrefix(/docs)
- traefik.http.services.${STACK_NAME?Variable not set}-whoami2.loadbalancer.server.port=80
#- "traefik.http.middlewares.auth.basicauth.users=user:$$apr1$$q8eZFHjF$$Fvmkk//V6Btlaf2i/ju5n/" # user/password
networks:
- netiagen4springisolated
depends_on:
- traefik

networks:
netiagen4springisolated:
driver: bridge
internal: true
netiagen4springinternet:
driver: bridge

volumes:
ollama:
database_data:
driver: local
v1:
v2:
fooocus-data:`

[flefevre]

Dear Open Webui community,

a friend with technical skills told me there a mis configuration of Open WebUi in it usage of FastApi.
Open WebUI uses the FastAPI python project as a backend. And FastAPI has a doc which describes the problem quite well: Behind a Proxy - FastAPI (tiangolo.com)

In summary, Open WebUI does not currently allow you to configure the FastAPI “root_path” parameter which in your case should be positioned at “/openwebui”. (the offending line of code is here: open-webui/backend/main.py at main · open-webui/open-webui · GitHub)

do you have any time to solve the problem?

[skint007]

I've been using open-webui behind my traefik reverse proxy for a couple of months now without issue. Incase this helps, this is an example of what my yaml config file looks like:

http:
  routers:
    ollama-webuiprivate:
      entryPoints:
        - websecure
      rule: "Host(`chat.local.mydomain`)"
      middlewares:
        - local-ipwhitelist
        - secHeaders
      service: ollama-webuiservice
      tls:
        certResolver: linode
    ollama-webuipublic:
      entryPoints:
        - websecure
      rule: "Host(`chat.mydomain`)"
      middlewares:
        - secHeaders
      service: ollama-webuiservice
      tls:
        certResolver: linode

  services:
    ollama-webuiservice:
      loadBalancer:
        servers:
          - url: "http://ollama-webui:8080"

[diegosayron]

@skint007 Could you show us your ollama.yaml? I can access the WebUI behind the traefik, but with no connection with api url. Thank you for your contribution!

[skint007]

@diegosayron Sure thing 😊

ollama.yaml

http:
  routers:
    ollamaprivate:
      entryPoints:
        - websecure
      rule: "Host(`ollama.local.mydomain`)"
      middlewares:
        - local-ipwhitelist
        - secHeaders
      service: ollamaservice
      tls:
        certResolver: linode

  services:
    ollamaservice:
      loadBalancer:
        servers:
          - url: "http://ollama:11434"

In case it helps, this is how my docker stack for open-webui is configured. We join them all to the same network (reverseproxy-network) instead of letting them create their own individual network. This allows us to use the hostnames to connect to other containers like in the service example above. Also, we never expose any ports to the host in our environment for security hardening. Traefik is the only container that is allowed to have mapped ports to the host system (80/443).

Docker compose for open-webui/ollama stack in portainer.io

services:
  ollama:
    container_name: ollama
    hostname: ollama
    image: ollama/ollama
    restart: unless-stopped
    runtime: nvidia # Expose NVIDIA GPUs
    stop_grace_period: 30s
    environment:
      - TZ=America/Los_Angeles
    volumes:
      - ollama-data-share:/root/.ollama
    networks:
      - reverseproxy-network
    deploy:
      resources:
        limits:
          cpus: '28'
          memory: 69G
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities:
                - gpu

  open-webui:
    container_name: open-webui
    hostname: open-webui
    image: ghcr.io/open-webui/open-webui:main
    restart: unless-stopped
    stop_grace_period: 30s
    depends_on:
      - ollama
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
      - TZ=America/Los_Angeles
    volumes:
      - /opt/ollama-webui-data:/app/backend/data
    networks:
      - reverseproxy-network

I hope this helps 🙂

[diegosayron]

@skint007 Thank you very much!
It worked like a charm.
My server runs in swarm mode.
I just commented the container name declaration (deprecated), added hostname lines as in your file, and (most important!) changed OLLAMA_API_BASE_URL to OLLAMA_BASE_URL.

Again, Thank you!

[skint007]

Ah yeah that tripped me up when I had updated a while back, and I don't think they showed the change logs in the webui at the time, so you had to go digging around to find it!
Glad it helped 🙂

[flefevre]

Thanks a lot.
I have used your template and it works like a charm. I close the discussion and thanks you again.