feat(open-webui): add chat+image frontend, bypass omniroute for comfyui

OmniRoute's built-in comfyui provider hardcodes a CheckpointLoaderSimple
(single-file-checkpoint) workflow with no override (confirmed by
reading open-sse/handlers/imageGeneration/providers/comfyUI.ts
upstream), so it can't drive Qwen-Image 2.1's split unet/text-encoder/
vae GGUF loader chain. Open WebUI's own ComfyUI image backend is fully
generic instead — any exported workflow_api.json with arbitrary node
IDs mapped to parameters — so it can point straight at comfyui:8188.

Chat still goes through omniroute like every other client, via a
per-workload key (OPENWEBUI_OMNIROUTE_KEY, minted by hand same as
always). Published on host port 8008 per user request.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -126,6 +126,13 @@ COMFYUI_DIFFUSION_MODEL_FILE=qwen-image-2.1-UC-Q4_K_M.gguf
 COMFYUI_TEXT_ENCODER_FILE=qwen3vl_8b_int8_convrot.safetensors
 COMFYUI_VAE_FILE=qwen_image_2.1_vae_bf16.safetensors
 
+# --- Open WebUI (chat + ComfyUI image-gen frontend) ---
+# Chat backend goes through omniroute like every other client — mint this
+# key by hand in the omniroute dashboard per docs/proxy-key-onboarding.md
+# (label it openwebui-chat), no scripted mint yet. Image generation talks
+# to comfyui directly, no key needed there.
+OPENWEBUI_OMNIROUTE_KEY=
+
 # --- RAG databases (qdrant + neo4j, see wayfinder notes) ---
 # No auth on qdrant (its default) — same trust boundary as llama-server:
 # ai-stack is not exposed off-box. Random, filled in automatically:

docker-compose.yml

@@ -397,6 +397,45 @@ services:
     restart: unless-stopped
     networks: [ai-stack]
 
+  # Chat + image-generation frontend. Talks to ComfyUI directly for images —
+  # NOT through omniroute: OmniRoute's built-in `comfyui` provider hardcodes
+  # a CheckpointLoaderSimple (single-file-checkpoint) workflow in
+  # open-sse/handlers/imageGeneration/providers/comfyUI.ts with no override,
+  # so it can't drive Qwen-Image 2.1's split unet/text-encoder/vae GGUF
+  # loader chain. Open WebUI's ComfyUI backend is fully generic instead —
+  # you upload the exact workflow_api.json exported from ComfyUI's own
+  # graph editor and map arbitrary node IDs to parameters.
+  #
+  # Chat backend still goes through omniroute (OpenAI-compatible), same
+  # gateway every other client uses — mint OPENWEBUI_OMNIROUTE_KEY by hand
+  # per docs/proxy-key-onboarding.md, same as any other workload.
+  #
+  # ponytail: only wires the base ComfyUI URL + chat backend via env vars.
+  # COMFYUI_WORKFLOW/COMFYUI_WORKFLOW_NODES env vars exist but are reported
+  # flaky upstream — set the actual workflow JSON by hand in Settings >
+  # Images in the web UI instead, once you've exported it from ComfyUI.
+  open-webui:
+    image: ghcr.io/open-webui/open-webui:main
+    container_name: open-webui
+    depends_on:
+      comfyui:
+        condition: service_started
+      omniroute:
+        condition: service_started
+    environment:
+      - OPENAI_API_BASE_URL=http://omniroute:${OMNIROUTE_API_PORT:-20129}/v1
+      - OPENAI_API_KEY=${OPENWEBUI_OMNIROUTE_KEY:-}
+      - ENABLE_IMAGE_GENERATION=True
+      - IMAGE_GENERATION_ENGINE=comfyui
+      - COMFYUI_BASE_URL=http://comfyui:8188
+      - WEBUI_AUTH=True
+    volumes:
+      - open-webui-data:/app/backend/data
+    ports:
+      - "8008:8080"
+    restart: unless-stopped
+    networks: [ai-stack]
+
 networks:
   ai-stack:
 
@@ -406,3 +445,4 @@ volumes:
   comfyui-data:
   qdrant-data:
   neo4j-data:
+  open-webui-data: