[{"data":1,"prerenderedAt":178},["ShallowReactive",2],{"seo-verification":3,"blog-open-webui-ollama-on-vps-multi-user-interface-for-local-llms-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":13,"excerpt":14,"readTime":15,"views":16,"isPinned":17,"publishedAt":18,"category":19,"categories":25,"featuredImage":27,"bgImage":28,"posterImage":29,"relatedSolution":27,"intro":30,"sections":31,"ctaTitle":123,"ctaBody":124,"ctaButton":125,"ctaUrl":126,"relatedPosts":127},316,"open-webui-ollama-on-vps-multi-user-interface-for-local-llms",{"fr":10,"en":8,"ar":11,"es":12},"open-webui-ollama-vps","واجهة-ويب-open-webui-مع-ollama-على-vps-للفرق","open-webui-ollama-en-vps-interfaz-web-multiusuario-para-llm","Open-WebUI + Ollama on VPS: multi-user interface for local LLMs","Give your entire team a multi-user web interface for your Ollama models: RAG, model management, SSO via OpenID Connect — no cloud dependency.",9,0,false,"2026-08-30T00:00:00+00:00",{"id":20,"name":21,"slug":22,"color":23,"icon":24},1,"Artificial Intelligence","intelligence-artificielle","bg-purple-500\u002F10 text-purple-400","ia",[26],{"id":20,"name":21,"slug":22,"color":23,"icon":24},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fopen-webui-ollama-vps-poster.svg","Ollama serves your language models through a local API. Open-WebUI adds the interface layer: a full web application with user management, document RAG, conversation history and SSO authentication. Deploying both on your VPS gives your entire team access to private LLMs without exposing the raw API or requiring command-line access. This guide covers installation, reverse proxy, SSO and access management.",[32,36,46,49,68,71,74,77,105,108,111,113,120],{"type":33,"title":34,"body":35},"h2","Why add Open-WebUI to your Ollama server","Ollama exposes a REST API compatible with OpenAI — efficient for developers, inaccessible for other team members. Open-WebUI bridges that gap: a complete web interface that connects to Ollama (or any OpenAI-compatible provider) and turns an inference server into a collaborative tool.\n\nWith over 150,000 GitHub stars (MIT licence), Open-WebUI has become the reference frontend for Ollama. Its growth was amplified by Ollama's Series B — 65 million dollars raised in July 2026 — which accelerated adoption of the inference engine in development teams.\n\nThe project is active, continuously maintained, and publishes stable tags (v0.6.x at the time of writing). Its maturity allows it to cover needs well beyond chat: RAG on local files, management of multiple models, user groups and SSO integration via OpenID Connect.",{"type":37,"title":38,"items":39},"ul","What Open-WebUI concretely adds to your Ollama stack",[40,41,42,43,44,45],"**Multi-user interface**: each team member has their own account, history and conversations — without access to the raw API or command line.","**Native RAG**: import PDF, Markdown or Word files directly from the interface; Open-WebUI indexes them and injects them into each conversation's context.","**Model management**: download, delete and activate Ollama models from the web interface, without going through `docker exec`.","**OpenID Connect SSO**: connect Open-WebUI to your identity provider (Keycloak, Authentik, Google Workspace…) for unified access and centralised revocation.","**Groups and roles**: define who can access which models, who can upload files, who has administration rights.","**No cloud dependency**: all tokens, conversations and files stay on your infrastructure.",{"type":33,"title":47,"body":48},"Hardware and software requirements","Open-WebUI runs in a Docker container and connects to Ollama via the internal Docker network. Both can coexist on the same VPS.\n\nFor a team of 5 to 10 people with quantised 7B models (Q4), plan for at minimum:\n\n- **8 GB RAM** (6 GB for the model + headroom for Open-WebUI and the system)\n- **4 vCPU**: CPU inference is slow with fewer cores; move to 8 vCPU for comfortable daily use\n- **30 GB SSD storage** minimum, plus space for your models (a 7B Q4 model ≈ 4.5 GB, a 13B model ≈ 8 GB)\n- **Docker and Docker Compose** installed\n- A **domain name** pointing to your VPS (required for TLS and SSO)\n- A **reverse proxy** with HTTPS — Nginx, Traefik or Caddy (Open-WebUI requires HTTPS for secure session cookies)\n\nIf Ollama is already deployed on your VPS (see the article \u003Ca href=\"\u002Fblog\u002Fheberger-ollama-vps\">How to host Ollama on a VPS\u003C\u002Fa>), you can skip directly to the Open-WebUI installation.",{"type":50,"title":51,"steps":52},"steps","Deploy Open-WebUI and Ollama with Docker Compose",[53,56,59,62,65],{"title":54,"body":55},"Create the Docker Compose file","Create a working directory then write the compose file:\n\n```bash\nmkdir -p \u002Fopt\u002Fopenwebui && cd \u002Fopt\u002Fopenwebui\n```\n\nContent of `compose.yml`:\n\n```bash\nservices:\n  ollama:\n    image: ollama\u002Follama:latest\n    container_name: ollama\n    volumes:\n      - ollama_data:\u002Froot\u002F.ollama\n    restart: unless-stopped\n\n  open-webui:\n    image: ghcr.io\u002Fopen-webui\u002Fopen-webui:main\n    container_name: open-webui\n    depends_on:\n      - ollama\n    ports:\n      - \"127.0.0.1:3000:8080\"\n    environment:\n      - OLLAMA_BASE_URL=http:\u002F\u002Follama:11434\n      - WEBUI_SECRET_KEY=change-this-to-a-random-string\n    volumes:\n      - open_webui_data:\u002Fapp\u002Fbackend\u002Fdata\n    restart: unless-stopped\n\nvolumes:\n  ollama_data:\n  open_webui_data:\n```\n\nThe `WEBUI_SECRET_KEY` must be a long random string: generate it with `openssl rand -hex 32`.",{"title":57,"body":58},"Start the stack","Start both services:\n\n```bash\ndocker compose up -d\n```\n\nCheck that both containers are active:\n\n```bash\ndocker compose ps\n```\n\nOllama may take a few seconds to start. Open-WebUI waits for Ollama to be ready thanks to `depends_on`, but if you see connection errors on first start, wait 15 seconds and reload.",{"title":60,"body":61},"Download a first model","From the host, download a model via Ollama:\n\n```bash\ndocker exec -it ollama ollama pull llama3.1:8b\n```\n\nYou can also do it from the Open-WebUI interface once logged in, under **Administration Panel → Models → Download from Ollama.com**.",{"title":63,"body":64},"Configure the Nginx reverse proxy with HTTPS","Open-WebUI listens on `127.0.0.1:3000`. Create an Nginx virtual host to expose it over HTTPS:\n\n```bash\nserver {\n    listen 443 ssl;\n    server_name openwebui.yourdomain.com;\n\n    ssl_certificate \u002Fetc\u002Fletsencrypt\u002Flive\u002Fopenwebui.yourdomain.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fopenwebui.yourdomain.com\u002Fprivkey.pem;\n\n    location \u002F {\n        proxy_pass http:\u002F\u002F127.0.0.1:3000;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        # WebSocket (required for response streaming)\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection \"upgrade\";\n        proxy_read_timeout 300s;\n    }\n}\n```\n\nObtain the certificate with Certbot:\n\n```bash\ncertbot --nginx -d openwebui.yourdomain.com\n```",{"title":66,"body":67},"Create the administrator account","Open `https:\u002F\u002Fopenwebui.yourdomain.com` in your browser. The **first account created automatically becomes administrator**. Enter an email and password.\n\nFrom the administration panel (**avatar icon → Administration Panel**), you can:\n- define whether new registrants are immediately active or pending validation;\n- create user groups and associate models with them;\n- configure SSO.",{"type":33,"title":69,"body":70},"Configure OpenID Connect SSO","Open-WebUI natively supports authentication via OpenID Connect (OIDC). You can integrate it with Keycloak, Authentik, Authelia, or any compatible provider (including Google Workspace or Microsoft Entra).\n\nIn `compose.yml`, add the following environment variables to the `open-webui` service:\n\n```bash\nenvironment:\n  - OAUTH_CLIENT_ID=your-client-id\n  - OAUTH_CLIENT_SECRET=your-client-secret\n  - OPENID_PROVIDER_URL=https:\u002F\u002Fyour-idp.example.com\u002F.well-known\u002Fopenid-configuration\n  - OAUTH_PROVIDER_NAME=My SSO\n  - ENABLE_OAUTH_SIGNUP=true\n```\n\nThe callback URL to declare in your identity provider is `https:\u002F\u002Fopenwebui.yourdomain.com\u002Foauth\u002Foidc\u002Fcallback`.\n\nRestart the stack after modification:\n\n```bash\ndocker compose up -d\n```",{"type":72,"body":73},"tip","To restrict SSO access to a specific email domain (e.g. `@your-company.com`), configure the restriction directly in your identity provider, not in Open-WebUI. Keycloak and Authentik both allow domain filtering at the OIDC client level — this is the safest control point, as it also covers the API.",{"type":33,"title":75,"body":76},"Enable RAG on your documents","Open-WebUI includes a RAG (Retrieval-Augmented Generation) pipeline that allows you to query your local documents in a conversation. Processing happens entirely on your VPS — no document is sent to an external service.\n\nTo enable RAG:\n\n1. From the interface, click the **paperclip** in the input area of a conversation, or use the **Documents** tab in the side menu.\n2. Import a PDF, Markdown, DOCX or TXT file. Open-WebUI chunks it, vectorises it and stores it in its local database.\n3. In the conversation, prefix your message with `#` followed by the document name to inject it as context.\n\nFor advanced use (multiple documents, thematic collections), the **Workspace → Documents** section allows you to organise files into collections and associate them with specific models.\n\nBy default, Open-WebUI uses its own lightweight embeddings engine. For better performance on a large corpus, you can configure a dedicated Ollama embeddings model (for example `nomic-embed-text`) in **Administration Panel → Documents → Embeddings model**.",{"type":78,"title":79,"headers":80,"rows":84},"comparison","Open-WebUI, AnythingLLM, LibreChat: which interface to choose",[81,82,83],"Criterion","Open-WebUI","AnythingLLM \u002F LibreChat",[85,89,93,97,101],[86,87,88],"LLM backend","Native Ollama + any OpenAI endpoint","OpenAI, Ollama, Azure, LM Studio",[90,91,92],"User management","Built-in, groups, native OIDC","Built-in (AnythingLLM: isolated workspaces)",[94,95,96],"RAG","Native, no configuration required","Native, configurable (LanceDB, pgvector)",[98,99,100],"GitHub stars","150,000+ (MIT)","40,000+ (MIT) \u002F 20,000+ (MIT)",[102,103,104],"Primary use case","Team with Ollama already deployed","Advanced multi-source RAG \u002F multi-backend chat",{"type":33,"title":106,"body":107},"Troubleshooting: common errors","**`Connection refused` on Open-WebUI startup.**\nOllama is not yet ready when Open-WebUI tries to connect. Wait 20 seconds and run `docker compose restart open-webui`. To avoid this on every restart, add a healthcheck on the Ollama service in `compose.yml`.\n\n**Streaming stops after 60 seconds.**\nYour reverse proxy applies a default HTTP timeout. Add `proxy_read_timeout 300s;` in the Nginx `location \u002F` block (or the equivalent `timeout` in Traefik). LLMs sometimes take several minutes to generate a long response.\n\n**`WebSocket connection failed`.**\nVerify that the `Upgrade` and `Connection` headers are correctly forwarded by the reverse proxy. Without them, SSE\u002FWebSocket streaming is blocked and responses don't arrive in real time.\n\n**SSO authentication returns `redirect_uri_mismatch`.**\nThe callback URL declared in your identity provider does not match what Open-WebUI sends. It must be exactly `https:\u002F\u002Fopenwebui.yourdomain.com\u002Foauth\u002Foidc\u002Fcallback` — with the full domain name, no trailing slash.\n\n**An SSO user can log in but has no access to any model.**\nNew accounts created via SSO are placed in the `pending` role by default if `ENABLE_OAUTH_SIGNUP` is not configured. Change their role to `user` in **Administration Panel → Users**, or set `DEFAULT_USER_ROLE=user` in the environment variables.",{"type":33,"title":109,"body":110},"Secure access to the Ollama API","By default, Ollama listens on `0.0.0.0:11434` inside its container. The `compose.yml` configuration proposed above does not publish this port on the host — only Open-WebUI accesses it via the internal Docker network. This is the correct posture.\n\nIf you need to access the Ollama API directly (from an IDE, Jupyter notebook or external application), two options:\n\n1. **SSH tunnel**: `ssh -L 11434:localhost:11434 user@your-vps` — the API is accessible locally without public exposure.\n2. **Reverse proxy with authentication**: expose Ollama behind Nginx with `auth_basic` or a Bearer token, if you have clients that don't support SSH tunnelling.\n\nNever publish port 11434 directly on the public interface without authentication: the Ollama API has no native protection against unauthorised access.",{"type":72,"body":112},"To keep Open-WebUI up to date, change the image from `ghcr.io\u002Fopen-webui\u002Fopen-webui:main` to `ghcr.io\u002Fopen-webui\u002Fopen-webui:v0.6.x` (or the latest stable tag) in your `compose.yml`. The `:main` tag follows continuous development — handy for testing new features, less predictable in production. Check the release notes on GitHub before each update: some versions have introduced database migrations.",{"type":37,"title":114,"items":115},"Advanced features to explore after deployment",[116,117,118,119],"**Pipelines and functions**: Open-WebUI allows writing Python functions that intercept the conversation flow — filters, context enrichers, connectors to external APIs.","**Custom models**: create pre-configured 'models' (system instructions, temperature, context) and share them with specific user groups.","**Image generation**: connect Open-WebUI to a local Stable Diffusion or ComfyUI instance to generate images directly in chat.","**Integration with external tools**: via the MCP (Model Context Protocol) protocol, Open-WebUI can call external tools — databases, REST APIs, web search.",{"type":72,"title":121,"body":122},"Official documentation","For advanced configuration and tool-specific options, refer to the \u003Ca href=\"https:\u002F\u002Fdocs.openwebui.com\">official Open-WebUI documentation\u003C\u002Fa>. This guide covers basic deployment and the most common configurations — parameters specific to your environment (LDAP integration, pipeline configuration, embeddings tuning) are in the project documentation.","A VPS ready for Open-WebUI and Ollama","Open-WebUI with Ollama requires a VPS with root access, Docker, and enough RAM to load your models. ServOrbit Cloud VPS offers the vertical scalability needed to move from a 7B to a 13B model without migration.","See Cloud VPS plans","\u002Fvps-cloud",[128,145,161],{"id":15,"slug":129,"slugs":130,"title":134,"excerpt":135,"readTime":136,"views":16,"isPinned":17,"publishedAt":137,"category":138,"categories":139,"featuredImage":27,"bgImage":28,"posterImage":141,"relatedSolution":142},"how-to-host-anythingllm-on-a-vps",{"fr":131,"en":129,"ar":132,"es":133},"heberger-anythingllm-vps","كيفية-استضافة-anythingllm-على-خادم-vps","como-alojar-anythingllm-en-un-vps","AnythingLLM on VPS: Full Guide with Pitfalls to Avoid","Host AnythingLLM on VPS: Docker, HTTPS, mandatory version pinning. :latest, Gemini v1.16 and Ollama Docker network pitfalls documented.",8,"2026-06-11T00:00:00+00:00",{"id":20,"name":21,"slug":22,"color":23,"icon":24},[140],{"id":20,"name":21,"slug":22,"color":23,"icon":24},"\u002Fblog\u002Fcovers\u002Fheberger-anythingllm-vps-poster.svg",{"categorySlug":143,"appSlug":144},"artificial-intelligence","anything-llm",{"id":146,"slug":147,"slugs":148,"title":152,"excerpt":153,"readTime":136,"views":16,"isPinned":17,"publishedAt":154,"category":155,"categories":156,"featuredImage":27,"bgImage":28,"posterImage":158,"relatedSolution":159},2,"deploying-dify-on-a-vps-ai-workflows-under-control",{"fr":149,"en":147,"ar":150,"es":151},"deployer-dify-vps","نشر-dify-على-vps-سير-عمل-الذكاء-الاصطناعي-تحت-السيطرة","desplegar-dify-en-un-vps","Deploy Dify on a VPS: Complete Guide from Installation to Plugins","Install Dify on a ServOrbit VPS: hardware requirements, Docker Compose setup, offline plugins, reverse proxy and troubleshooting.","2026-02-11T00:00:00+00:00",{"id":20,"name":21,"slug":22,"color":23,"icon":24},[157],{"id":20,"name":21,"slug":22,"color":23,"icon":24},"\u002Fblog\u002Fcovers\u002Fdeployer-dify-vps-poster.svg",{"categorySlug":22,"appSlug":160},"dify",{"id":162,"slug":163,"slugs":164,"title":168,"excerpt":169,"readTime":170,"views":16,"isPinned":17,"publishedAt":171,"category":172,"categories":173,"featuredImage":27,"bgImage":28,"posterImage":175,"relatedSolution":176},177,"self-host-langfuse-on-a-vps-llm-observability-no-saas-bill",{"fr":165,"en":163,"ar":166,"es":167},"self-host-langfuse-vps","استضافة-langfuse-على-vps-مراقبة-llm-بلا-فاتورة-saas","alojar-langfuse-en-un-vps","Self-Host Langfuse on a VPS: LLM Observability, No SaaS Bill","Self-host Langfuse on a VPS — the open-source LLM observability platform. Trace every AI call, evaluate prompts, manage versions and track costs, no SaaS bill.",7,"2026-07-12T00:00:00+00:00",{"id":20,"name":21,"slug":22,"color":23,"icon":24},[174],{"id":20,"name":21,"slug":22,"color":23,"icon":24},"\u002Fblog\u002Fcovers\u002Fself-host-langfuse-vps-poster.svg",{"categorySlug":143,"appSlug":177},"langfuse",1788100067450]