haylanandClaude-Bot
c01ef8965d
Resolves wayfinder ticket #8. The stack is reached over LAN/WAN hostnames, not localhost: - Open WebUI: ai.home (LAN) and ai.haylan.ch (external, via DMZ) routed through the existing Nginx Proxy Manager instance to the published WEBUI_PORT — no new reverse-proxy service needed in this repo. - llama.cpp's raw API stays LAN-only and unregistered in NPM (no auth of its own); coding CLIs reach it via the box's LAN IP or ai.home directly. New docs/network-access.md documents the NPM proxy-host setup and the LAN-only decision. coding-cli-setup.md and README updated to stop referencing localhost. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1.6 KiB
Network access: ai.home / ai.haylan.ch
Open WebUI is meant to be reachable as ai.home on the LAN and ai.haylan.ch from outside. This stack doesn't run its own reverse proxy — it publishes Open WebUI's port to the host (${WEBUI_PORT:-3000}, see docker-compose.yml) and relies on the existing Nginx Proxy Manager (NPM) instance already fronting other self-hosted services on this network.
What to set up in NPM
Two Proxy Hosts, both pointing at this machine's LAN IP on port ${WEBUI_PORT:-3000} (Open WebUI):
ai.home— internal only, no external DNS/TLS needed unless you want it.ai.haylan.ch— external, reachable via the DMZ already forwarding it to NPM; let NPM issue/manage the TLS cert as it does for other services.
llama.cpp's raw API stays LAN-only — deliberately
The inference API (port ${LLAMA_PORT:-8080}) is not registered in NPM and is not reachable via ai.haylan.ch. It has no authentication of its own (unlike Open WebUI, which has login enabled) — putting it on the public internet would mean an unauthenticated inference endpoint. Coding-agent CLIs (Claude Code, Kimi, OpenCode — see docs/coding-cli-setup.md) reach it directly over the LAN, using this machine's LAN IP or ai.home if your local DNS resolves that hostname straight to the box (bypassing NPM, which only fronts ports 80/443).
If you later want external CLI access too, that's a deliberate scope change — see the map (issue #1) before doing it, since it changes the security posture (the raw API would need its own auth in front of it).