feat: add OpenWebUI AI chat service (ai.xiteng.site)

- New service: OpenWebUI v0.9.5 with Authentik OIDC auth
- compose.yml with Traefik, Homepage, AutoKuma labels
- Network fix: HF_ENDPOINT mirror + custom DNS for China
- Authentik grant_types fix documented in README
- .gitignore: openwebui/data/ and openwebui/.env

.gitignore

@@ -42,3 +42,11 @@ seaweedfs/data/
 
 # 忽略 AI 工具
 .aider*
+
+# 忽略 remark42 数据
+remark42/var/
+remark42/.env
+
+# 忽略 OpenWebUI 数据和密钥
+openwebui/data/
+openwebui/.env

README.md

@@ -17,7 +17,7 @@
                     ▼               ▼                   ▼
               (有 Authentik SSO)  (ForwardAuth)      (免认证)
               Gitea / HedgeDoc    SeaweedFS /        Gitea SSH
-              Homepage            Uptime Kuma
+              Homepage / OpenWebUI Uptime Kuma
 ```
 
 | 入口 | 域名 | 传输 | 延迟 |
@@ -33,9 +33,11 @@
 | Authentik | [auth.xiteng.site](https://auth.xiteng.site) | 自身 | 统一 SSO (v2026.5.0) |
 | Gitea | [gitea.xiteng.site](https://gitea.xiteng.site) | Authentik OAuth2 | 代码托管 |
 | HedgeDoc | [notes.xiteng.site](https://notes.xiteng.site) | Authentik OIDC | Markdown 协作 |
+| OpenWebUI | [ai.xiteng.site](https://ai.xiteng.site) | Authentik OIDC | AI 对话界面 (v0.9.5) |
 | SeaweedFS | [file.xiteng.site](https://file.xiteng.site) | Authentik ForwardAuth | 对象存储 (v4.28) |
 | SeaweedFS S3 | [minio-api.xiteng.site](https://minio-api.xiteng.site) | Access Key | S3 API |
 | Uptime Kuma | [uptime.xiteng.site](https://uptime.xiteng.site) | Authentik ForwardAuth | 服务监控 |
+| Remark42 | [remark.xiteng.site](https://remark.xiteng.site) | Authentik OAuth2 | 评论系统 |
 | Traefik | 内网 | — | 反向代理 |
 
 > **注意**: SeaweedFS 已替代原 MinIO。域名于 2026-05-27 从 `s3.xiteng.site` 迁移至 `file.xiteng.site`。
@@ -55,7 +57,7 @@
                    (proxy container)  (Django)
 ```
 
-- **OAuth2/OIDC**: Gitea、HedgeDoc、Homepage 各自持有 client_id/secret，用户从应用发起登录
+- **OAuth2/OIDC**: Gitea、HedgeDoc、Homepage、OpenWebUI 各自持有 client_id/secret，用户从应用发起登录
 - **ForwardAuth**: SeaweedFS、Uptime Kuma 由 Traefik 中间件在请求到达前拦截验证
 - **独立 Outpost**: SeaweedFS 和 Uptime Kuma 各用独立 proxy outpost 容器（避免 cookie domain 冲突）
 
@@ -83,11 +85,18 @@ homelab/
 ├── homepage/
 │   ├── compose.yml
 │   └── config/
+├── openwebui/
+│   ├── compose.yml
+│   ├── .env                 # OPENWEBUI_SECRET_KEY
+│   └── data/                # gitignore
 ├── outpost/
 │   ├── compose.yml          # Uptime Kuma outpost
 │   └── ...
 ├── outpost-seaweedfs/
 │   └── compose.yml          # SeaweedFS 独立 outpost
+├── remark42/
+│   ├── compose.yml
+│   └── var/                 # gitignore
 ├── seaweedfs/
 │   ├── compose.yml
 │   ├── security.toml        # JWT 已全部注释（社区版 UI 不支持 OIDC）
@@ -116,6 +125,8 @@ docker compose -f hedgedoc/compose.yml up -d
 docker compose -f seaweedfs/compose.yml up -d
 docker compose -f uptime-kuma/compose.yml up -d
 docker compose -f homepage/compose.yml up -d
+docker compose -f openwebui/compose.yml up -d
+docker compose -f remark42/compose.yml up -d
 docker compose -f outpost/compose.yml up -d
 docker compose -f outpost-seaweedfs/compose.yml up -d
 docker compose -f cloudflared/compose.yml up -d

openwebui/compose.yml

@@ -0,0 +1,58 @@
+services:
+  openwebui:
+    image: ghcr.io/open-webui/open-webui:v0.9.5
+    container_name: openwebui
+    restart: unless-stopped
+    volumes:
+      - ./data:/app/backend/data
+    environment:
+      # --- OIDC 认证 (Authentik) ---
+      - WEBUI_AUTH=true
+      - ENABLE_OAUTH_SIGNUP=true
+      - OAUTH_CLIENT_ID=openwebui-63f6865e
+      - OAUTH_CLIENT_SECRET=65cecaf8cc974c7fad55c749c65e50ee06bae0a9c8614252b4a44707a700c188
+      - OPENID_PROVIDER_URL=https://auth.xiteng.site/application/o/openwebui/.well-known/openid-configuration
+      - OAUTH_SCOPES=openid email profile
+      - OAUTH_PROVIDER_NAME=Authentik
+      - WEBUI_URL=https://ai.xiteng.site
+      # --- Session ---
+      - WEBUI_SECRET_KEY=${OPENWEBUI_SECRET_KEY}
+      # --- 网络 (解决国内 IPv6/ghcr 访问问题) ---
+      - HF_ENDPOINT=https://hf-mirror.com
+    dns:
+      - 223.5.5.5
+      - 114.114.114.114
+    labels:
+      # ========== Traefik ==========
+      - "traefik.enable=true"
+      # HTTPS router (cert management)
+      - "traefik.http.routers.openwebui.rule=Host(`ai.xiteng.site`)"
+      - "traefik.http.routers.openwebui.entrypoints=websecure"
+      - "traefik.http.routers.openwebui.tls=true"
+      - "traefik.http.routers.openwebui.tls.certresolver=cfresolver"
+      - "traefik.http.services.openwebui.loadbalancer.server.port=8080"
+      # HTTP router (Cloudflare Tunnel ingress)
+      - "traefik.http.routers.openwebui-http.rule=Host(`ai.xiteng.site`)"
+      - "traefik.http.routers.openwebui-http.service=openwebui"
+      - "traefik.http.routers.openwebui-http.entrypoints=web"
+      # X-Forwarded-Proto middleware
+      - "traefik.http.middlewares.force-https.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.routers.openwebui.middlewares=force-https"
+      - "traefik.http.routers.openwebui-http.middlewares=force-https"
+      # ========== Homepage ==========
+      - "homepage.group=我的服务"
+      - "homepage.name=OpenWebUI"
+      - "homepage.icon=si-openwebui"
+      - "homepage.href=https://ai.xiteng.site"
+      - "homepage.description=AI Chat 界面"
+      # ========== AutoKuma ==========
+      - "kuma.openwebui.http.name=OpenWebUI"
+      - "kuma.openwebui.http.url=http://openwebui:8080"
+      - "kuma.openwebui.http.interval=60"
+      - "kuma.openwebui.http.max_retries=3"
+    networks:
+      - homelab_net
+
+networks:
+  homelab_net:
+    external: true