poprhythm
cbbcb76fcf
open-webui was sending OAuth credentials via both client_secret_basic (header) and client_secret_post (body) simultaneously, which Authelia rejects. Setting OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post forces a single method and matches the updated Authelia client config. WEBUI_SECRET_KEY is now a stable env var so watchtower image updates no longer invalidate all user sessions.
47 lines
1.2 KiB
YAML
47 lines
1.2 KiB
YAML
services:
|
|
ollama:
|
|
container_name: ollama
|
|
image: ollama/ollama:latest
|
|
restart: unless-stopped
|
|
ports:
|
|
- 127.0.0.1:11434:11434
|
|
environment:
|
|
- NVIDIA_VISIBLE_DEVICES=all
|
|
- NVIDIA_DRIVER_CAPABILITIES=compute,utility
|
|
- TZ=America/New_York
|
|
- OLLAMA_HOST=0.0.0.0
|
|
volumes:
|
|
- /srv/ollama:/root/.ollama
|
|
runtime: nvidia
|
|
networks:
|
|
- npm-network
|
|
|
|
# Optional: Web UI for Ollama
|
|
open-webui:
|
|
container_name: open-webui
|
|
image: ghcr.io/open-webui/open-webui:latest
|
|
restart: unless-stopped
|
|
ports:
|
|
- 3000:8080
|
|
environment:
|
|
- OLLAMA_BASE_URL=http://ollama:11434
|
|
- TZ=America/New_York
|
|
- ENABLE_OAUTH_SIGNUP=true
|
|
- OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
|
|
- OAUTH_PROVIDER_NAME=Authelia
|
|
- OPENID_PROVIDER_URL=https://auth.kolpacksoftware.com/.well-known/openid-configuration
|
|
- OAUTH_CLIENT_ID=open-webui
|
|
- OAUTH_CLIENT_SECRET=${AUTHELIA_OIDC_CLIENT_SECRET_OPEN_WEBUI}
|
|
- OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post
|
|
- WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
|
|
volumes:
|
|
- /srv/open-webui:/app/backend/data
|
|
depends_on:
|
|
- ollama
|
|
networks:
|
|
- npm-network
|
|
|
|
networks:
|
|
npm-network:
|
|
external: true
|