services:
  openwebui:
    image: ghcr.io/open-webui/open-webui:v0.9.5
    container_name: openwebui
    restart: unless-stopped
    volumes:
      - ./data:/app/backend/data
    environment:
      # --- OIDC 认证 (Authentik) ---
      - WEBUI_AUTH=true
      - ENABLE_OAUTH_SIGNUP=true
      - OAUTH_CLIENT_ID=openwebui-63f6865e
      - OAUTH_CLIENT_SECRET=65cecaf8cc974c7fad55c749c65e50ee06bae0a9c8614252b4a44707a700c188
      - OPENID_PROVIDER_URL=https://auth.xiteng.site/application/o/openwebui/.well-known/openid-configuration
      - OAUTH_SCOPES=openid email profile
      - OAUTH_PROVIDER_NAME=Authentik
      - WEBUI_URL=https://ai.xiteng.site
      # --- Session ---
      - WEBUI_SECRET_KEY=${OPENWEBUI_SECRET_KEY}
      # --- 网络 (解决国内 IPv6/ghcr 访问问题) ---
      - HF_ENDPOINT=https://hf-mirror.com
    dns:
      - 223.5.5.5
      - 114.114.114.114
    labels:
      # ========== Traefik ==========
      - "traefik.enable=true"
      # HTTPS router (cert management)
      - "traefik.http.routers.openwebui.rule=Host(`ai.xiteng.site`)"
      - "traefik.http.routers.openwebui.entrypoints=websecure"
      - "traefik.http.routers.openwebui.tls=true"
      - "traefik.http.routers.openwebui.tls.certresolver=cfresolver"
      - "traefik.http.services.openwebui.loadbalancer.server.port=8080"
      # HTTP router (Cloudflare Tunnel ingress)
      - "traefik.http.routers.openwebui-http.rule=Host(`ai.xiteng.site`)"
      - "traefik.http.routers.openwebui-http.service=openwebui"
      - "traefik.http.routers.openwebui-http.entrypoints=web"
      # X-Forwarded-Proto middleware
      - "traefik.http.middlewares.force-https.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.openwebui.middlewares=force-https"
      - "traefik.http.routers.openwebui-http.middlewares=force-https"
      # ========== Homepage ==========
      - "homepage.group=我的服务"
      - "homepage.name=OpenWebUI"
      - "homepage.icon=si-openwebui"
      - "homepage.href=https://ai.xiteng.site"
      - "homepage.description=AI Chat 界面"
      # ========== AutoKuma ==========
      - "kuma.openwebui.http.name=OpenWebUI"
      - "kuma.openwebui.http.url=http://openwebui:8080"
      - "kuma.openwebui.http.interval=60"
      - "kuma.openwebui.http.max_retries=3"
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true