From 557b0eca331d7b536b5ec88b4d7a1c4ee00fea90 Mon Sep 17 00:00:00 2001 From: xiteng Date: Mon, 1 Jun 2026 08:42:58 +0800 Subject: [PATCH] feat: add OpenWebUI AI chat service (ai.xiteng.site) - New service: OpenWebUI v0.9.5 with Authentik OIDC auth - compose.yml with Traefik, Homepage, AutoKuma labels - Network fix: HF_ENDPOINT mirror + custom DNS for China - Authentik grant_types fix documented in README - .gitignore: openwebui/data/ and openwebui/.env --- .gitignore | 8 ++++++ README.md | 15 +++++++++-- openwebui/compose.yml | 58 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 79 insertions(+), 2 deletions(-) create mode 100644 openwebui/compose.yml diff --git a/.gitignore b/.gitignore index 32ed9a2..6a0b585 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,11 @@ seaweedfs/data/ # 忽略 AI 工具 .aider* + +# 忽略 remark42 数据 +remark42/var/ +remark42/.env + +# 忽略 OpenWebUI 数据和密钥 +openwebui/data/ +openwebui/.env diff --git a/README.md b/README.md index 515f6c2..5fb7fe0 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ ▼ ▼ ▼ (有 Authentik SSO) (ForwardAuth) (免认证) Gitea / HedgeDoc SeaweedFS / Gitea SSH - Homepage Uptime Kuma + Homepage / OpenWebUI Uptime Kuma ``` | 入口 | 域名 | 传输 | 延迟 | @@ -33,9 +33,11 @@ | Authentik | [auth.xiteng.site](https://auth.xiteng.site) | 自身 | 统一 SSO (v2026.5.0) | | Gitea | [gitea.xiteng.site](https://gitea.xiteng.site) | Authentik OAuth2 | 代码托管 | | HedgeDoc | [notes.xiteng.site](https://notes.xiteng.site) | Authentik OIDC | Markdown 协作 | +| OpenWebUI | [ai.xiteng.site](https://ai.xiteng.site) | Authentik OIDC | AI 对话界面 (v0.9.5) | | SeaweedFS | [file.xiteng.site](https://file.xiteng.site) | Authentik ForwardAuth | 对象存储 (v4.28) | | SeaweedFS S3 | [minio-api.xiteng.site](https://minio-api.xiteng.site) | Access Key | S3 API | | Uptime Kuma | [uptime.xiteng.site](https://uptime.xiteng.site) | Authentik ForwardAuth | 服务监控 | +| Remark42 | [remark.xiteng.site](https://remark.xiteng.site) | Authentik OAuth2 | 评论系统 | | Traefik | 内网 | — | 反向代理 | > **注意**: SeaweedFS 已替代原 MinIO。域名于 2026-05-27 从 `s3.xiteng.site` 迁移至 `file.xiteng.site`。 @@ -55,7 +57,7 @@ (proxy container) (Django) ``` -- **OAuth2/OIDC**: Gitea、HedgeDoc、Homepage 各自持有 client_id/secret，用户从应用发起登录 +- **OAuth2/OIDC**: Gitea、HedgeDoc、Homepage、OpenWebUI 各自持有 client_id/secret，用户从应用发起登录 - **ForwardAuth**: SeaweedFS、Uptime Kuma 由 Traefik 中间件在请求到达前拦截验证 - **独立 Outpost**: SeaweedFS 和 Uptime Kuma 各用独立 proxy outpost 容器（避免 cookie domain 冲突） @@ -83,11 +85,18 @@ homelab/ ├── homepage/ │ ├── compose.yml │ └── config/ +├── openwebui/ +│ ├── compose.yml +│ ├── .env # OPENWEBUI_SECRET_KEY +│ └── data/ # gitignore ├── outpost/ │ ├── compose.yml # Uptime Kuma outpost │ └── ... ├── outpost-seaweedfs/ │ └── compose.yml # SeaweedFS 独立 outpost +├── remark42/ +│ ├── compose.yml +│ └── var/ # gitignore ├── seaweedfs/ │ ├── compose.yml │ ├── security.toml # JWT 已全部注释（社区版 UI 不支持 OIDC） @@ -116,6 +125,8 @@ docker compose -f hedgedoc/compose.yml up -d docker compose -f seaweedfs/compose.yml up -d docker compose -f uptime-kuma/compose.yml up -d docker compose -f homepage/compose.yml up -d +docker compose -f openwebui/compose.yml up -d +docker compose -f remark42/compose.yml up -d docker compose -f outpost/compose.yml up -d docker compose -f outpost-seaweedfs/compose.yml up -d docker compose -f cloudflared/compose.yml up -d diff --git a/openwebui/compose.yml b/openwebui/compose.yml new file mode 100644 index 0000000..481b80e --- /dev/null +++ b/openwebui/compose.yml @@ -0,0 +1,58 @@ +services: + openwebui: + image: ghcr.io/open-webui/open-webui:v0.9.5 + container_name: openwebui + restart: unless-stopped + volumes: + - ./data:/app/backend/data + environment: + # --- OIDC 认证 (Authentik) --- + - WEBUI_AUTH=true + - ENABLE_OAUTH_SIGNUP=true + - OAUTH_CLIENT_ID=openwebui-63f6865e + - OAUTH_CLIENT_SECRET=65cecaf8cc974c7fad55c749c65e50ee06bae0a9c8614252b4a44707a700c188 + - OPENID_PROVIDER_URL=https://auth.xiteng.site/application/o/openwebui/.well-known/openid-configuration + - OAUTH_SCOPES=openid email profile + - OAUTH_PROVIDER_NAME=Authentik + - WEBUI_URL=https://ai.xiteng.site + # --- Session --- + - WEBUI_SECRET_KEY=${OPENWEBUI_SECRET_KEY} + # --- 网络 (解决国内 IPv6/ghcr 访问问题) --- + - HF_ENDPOINT=https://hf-mirror.com + dns: + - 223.5.5.5 + - 114.114.114.114 + labels: + # ========== Traefik ========== + - "traefik.enable=true" + # HTTPS router (cert management) + - "traefik.http.routers.openwebui.rule=Host(`ai.xiteng.site`)" + - "traefik.http.routers.openwebui.entrypoints=websecure" + - "traefik.http.routers.openwebui.tls=true" + - "traefik.http.routers.openwebui.tls.certresolver=cfresolver" + - "traefik.http.services.openwebui.loadbalancer.server.port=8080" + # HTTP router (Cloudflare Tunnel ingress) + - "traefik.http.routers.openwebui-http.rule=Host(`ai.xiteng.site`)" + - "traefik.http.routers.openwebui-http.service=openwebui" + - "traefik.http.routers.openwebui-http.entrypoints=web" + # X-Forwarded-Proto middleware + - "traefik.http.middlewares.force-https.headers.customrequestheaders.X-Forwarded-Proto=https" + - "traefik.http.routers.openwebui.middlewares=force-https" + - "traefik.http.routers.openwebui-http.middlewares=force-https" + # ========== Homepage ========== + - "homepage.group=我的服务" + - "homepage.name=OpenWebUI" + - "homepage.icon=si-openwebui" + - "homepage.href=https://ai.xiteng.site" + - "homepage.description=AI Chat 界面" + # ========== AutoKuma ========== + - "kuma.openwebui.http.name=OpenWebUI" + - "kuma.openwebui.http.url=http://openwebui:8080" + - "kuma.openwebui.http.interval=60" + - "kuma.openwebui.http.max_retries=3" + networks: + - homelab_net + +networks: + homelab_net: + external: true