nginx with internal docker network #1203
Replies: 3 comments 10 replies
-
|
I added then environment variable for FORWARDED_ALLOW_IPS to address Here's the updated docker-compose yaml |
Beta Was this translation helpful? Give feedback.
-
|
Also looking thru the open-webui code backend/start.sh, --forwarded-allow-ips '*' was already applied... just missing the --proxy-headers |
Beta Was this translation helpful? Give feedback.
-
|
According to Uvicorn,
|
Beta Was this translation helpful? Give feedback.
-
|
ok...this turned out to be a browser caching issue. refreshed cache and the open-webui displays and is functional. here's nginx minimal config that worked: |
Beta Was this translation helpful? Give feedback.
-
|
After getting the portal to function, it was having the issue that it couldn't connect to host.docker.internal:11434. This required changing the host's host.docker.internal to a hard-coded internal docker IP. Here's the compose yaml to create an internal network w/ specific subnet and assign an IP from that subnet to ollama container: Finally...both the ollama and open-webui containers are restricted to internal access and open-webui is reverse proxied thru nginx (see nginx config above). @tjbck: this docker compose file and nginx config may be useful to some others that really want to lock down local llms. |
Beta Was this translation helpful? Give feedback.
-
|
I guess I’m not understanding. I also tried commenting out extra_hosts completely but that didn’t work either. Might be best to post an example of what you’re saying. I’m not the best at docker. |
Beta Was this translation helpful? Give feedback.
-
version: '3.8'
services:
ollama:
deploy:
resources:
reservations:
devices:
- driver: nvidia
count: all
capabilities:
- gpu
container_name: ollama
image: ollama/ollama
restart: unless-stopped
networks:
isolated:
open-webui:
container_name: open-webui
restart: unless-stopped
image: ghcr.io/open-webui/open-webui:main
environment:
- 'OLLAMA_BASE_URL=http://ollama:11434'
depends_on:
- ollama
networks:
- isolated
nginx:
container_name: nginx
ports:
- "80:80"
image: nginx:latest
depends_on:
- open-webui
restart: unless-stopped
networks:
- isolated
- internet
networks:
isolated:
driver: bridge
internal: true
internet:
driver: bridgeI've made a few adjustments to your Docker Compose file to enhance the isolation between
These changes aim to simplify your Docker setup, enhance security through isolation, and leverage Docker's built-in features for service discovery and networking. This approach reduces the complexity of your configuration and makes your services more secure and easier to manage. |
Beta Was this translation helpful? Give feedback.
-
|
Ok, gotcha. I tested and that works perfectly. Also the |
Beta Was this translation helpful? Give feedback.
-
|
EDIT: I've just realized that your previous example compose that I modified is lacking the volume mounts for Ollama and WebUI to persist their data, you're going to lose this as soon as you To be straightforward, if your aim is to restrict external access to the |
Beta Was this translation helpful? Give feedback.
-
|
Yeah you’re right, the goal is to block self hosted apps from calling home. Trust but verify 🤷. The ip/subnet solution works for any docker that doesn’t require online access. The I think this compose yaml makes the strongest statement for privacy: open-webui will never share your data. It can’t. Your help here shows your dedication to that goal. Thank you! Finally…yeah my comments redacted all the Thank you for the work on open-webui! |
Beta Was this translation helpful? Give feedback.
-
I'm attempting to run open-webui in docker on an internal network. Since the network's internal it can't access the host/internet, I'm also attempting to reverse proxy to the host via nginx. I'm successfully able to serve up static pages from open-webui (eg favicon.png) using nginx but not the dynamic pages. Also open-webui works without using this internal network and reverse proxy.
Although this is a docker/nginx question, the reason I'm asking this here is because it appears that open-webui is running on Uvicorn. According to Uvicorn's documentation (https://www.uvicorn.org/deployment/#running-behind-nginx) these settings may need to be set:
--forwarded-allow-ips='*'and--proxy-headers.My questions:
I'm not an expert at any of this so I'm sure I have the wrong configuration somewhere.
Here's my docker-compose yaml:
Here's my nginx config (copied from https://www.uvicorn.org/deployment/#running-behind-nginx):
here are open-webui container logs
here are nginx container logs:```
Beta Was this translation helpful? Give feedback.
All reactions