r8s
AI & Chat

open-webui

Open WebUI — chat frontend for OpenAI-compatible backends, Postgres persistence, uploads/RAG storage, OIDC SSO, optional Redis cache

@r8s/open-webui

open-webuichatllmai

Components (1)

01

OpenWebui

Open WebUI — self-hosted chat frontend for OpenAI-compatible backends.

import { Platform } from '@r8s/recipes'
import { OpenWebui } from '@r8s/open-webui'

export default (
  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
    <OpenWebui name="chat" host="chat.example.com" version="v0.6.5" storage="10Gi" />
  </Platform>
)
namestringOptional—

Resource name (defaults to 'open-webui')

namespacestringOptional—

Kubernetes namespace (defaults to 'default')

versionstringOptional—

Container image tag (defaults to 'latest' — pin a version in production)

hoststringRequired—

Public hostname for the chat UI (required)

replicasnumberOptional—

Number of replicas (defaults to 1). Multiple replicas need a shared object store for uploads/RAG (this recipe errors when storage is set with replicas > 1 — its PVC is ReadWriteOnce) and Redis-backed websocket coordination (WEBSOCKET_MANAGER=redis + REDIS_URL).

storagestringOptional—

PVC size for uploads and RAG document storage (e.g. '10Gi'). When set, a ${name}-uploads PersistentVolumeClaim is rendered and mounted at /app/backend/data. WebService cannot express volume mounts, which is why this component composes a raw Deployment (probes /health:8080). The PVC is ReadWriteOnce — combining this with replicas > 1 throws (single-node attach); multi-replica installs must move files/RAG to an S3-compatible store and set WEBSOCKET_MANAGER=redis.

backendstringOptional—

OpenAI-compatible API base URL for the model backend (defaults to 'https://api.berget.ai/v1'). The key itself is never passed as a prop — it arrives via secretKeyRef from the secrets bundle below.

secretsNamestringOptional—

Name of an existing Secret holding modelApiKey (the key used to call backend) and secretKey (the WEBUI_SECRET_KEY used to sign auth tokens). Required unless a secrets backend (openbao/vault) is configured on the surrounding Platform — the backend then provisions both keys automatically. Plaintext keys are not supported.

sso{ issuer: string, clientId: string, clientSecretRef: SecretRef, scopes?: string }Optional—

OAuth/OIDC SSO client — register Open WebUI as a client in Keycloak (the Auth recipe) and reference the client secret through the backend. Uses the upstream OAUTH_* env names; OPENID_PROVIDER_URL carries the issuer (Open WebUI appends /.well-known/openid-configuration itself).

cachebooleanOptional—

Provision a redis-backed replication group for caching/events (default: false)

offlinebooleanOptional—

Air-gapped installs: sets OFFLINE_MODE (disable runtime model/param fetches), removes the update checks and disables the native Ollama API — only OpenAI-compatible backends are served (default: false).

resources{ requests?: { cpu?: string, memory?: string }, limits?: { cpu?: string, memory?: string } }Optional—

Requested resources

tls{ secretName: string, clusterIssuer: string }Optional—

TLS configuration (defaults to letsencrypt-prod cluster issuer)

←All packages