From cbbcb76fcf11e373951f172fefb4dbf9208f6f44 Mon Sep 17 00:00:00 2001
From: poprhythm <james.kolpack@gmail.com>
Date: Thu, 2 Jul 2026 02:26:26 +0000
Subject: [PATCH] ollama/open-webui: fix OIDC auth loop and session key
 persistence

open-webui was sending OAuth credentials via both client_secret_basic
(header) and client_secret_post (body) simultaneously, which Authelia
rejects. Setting OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post
forces a single method and matches the updated Authelia client config.

WEBUI_SECRET_KEY is now a stable env var so watchtower image updates
no longer invalidate all user sessions.
---
 ollama/docker-compose.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ollama/docker-compose.yml b/ollama/docker-compose.yml
index 82540d3..3cbbc0b 100644
--- a/ollama/docker-compose.yml
+++ b/ollama/docker-compose.yml
@@ -32,6 +32,8 @@ services:
       - OPENID_PROVIDER_URL=https://auth.kolpacksoftware.com/.well-known/openid-configuration
       - OAUTH_CLIENT_ID=open-webui
       - OAUTH_CLIENT_SECRET=${AUTHELIA_OIDC_CLIENT_SECRET_OPEN_WEBUI}
+      - OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post
+      - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
     volumes:
       - /srv/open-webui:/app/backend/data
     depends_on: