2.7 KiB
Network access: ai.home / ai.haylan.ch
Open WebUI is meant to be reachable as ai.home on the LAN and ai.haylan.ch from outside. This stack doesn't run its own reverse proxy — it publishes Open WebUI's port to the host (${WEBUI_PORT:-3000}, see docker-compose.yml) and relies on the existing Nginx Proxy Manager (NPM) instance already fronting other self-hosted services on this network.
What to set up in NPM
Two Proxy Hosts, both pointing at this machine's LAN IP on port ${WEBUI_PORT:-3000} (Open WebUI):
ai.home— internal only, no external DNS/TLS needed unless you want it.ai.haylan.ch— external, reachable via the DMZ already forwarding it to NPM; let NPM issue/manage the TLS cert as it does for other services.
llama.cpp's raw API stays LAN-only — deliberately
The inference API (port ${LLAMA_PORT:-8080}) is not registered in NPM and is not reachable via ai.haylan.ch. It has no authentication of its own (unlike Open WebUI, which has login enabled) — putting it on the public internet would mean an unauthenticated inference endpoint. Coding-agent CLIs (Claude Code, Kimi, OpenCode — see docs/coding-cli-setup.md) reach it directly over the LAN, using this machine's LAN IP or ai.home if your local DNS resolves that hostname straight to the box (bypassing NPM, which only fronts ports 80/443).
If you later want external CLI access too, that's a deliberate scope change — see the map (issue #1) before doing it, since it changes the security posture (the raw API would need its own auth in front of it).
The AI proxy (LiteLLM) — proxy.ai.home / proxy.ai.haylan.ch
Once the gateway from issue #9 is deployed, it gets its own hostnames, same NPM pattern as Open WebUI above:
proxy.ai.home— internal only, fronts the full LiteLLM port (API + Admin UI).proxy.ai.haylan.ch— external, via the DMZ/NPM. Fronts only the inference API paths.
Every proxy call already requires a valid virtual key (Bearer token, see docs/proxy-key-onboarding.md) — the same bar Open WebUI clears with its own login — so no extra NPM-level auth is needed for the external hostname.
LiteLLM's Admin UI (/ui) stays LAN-only, same reasoning as llama.cpp's raw API: it manages every workload's keys and budgets, so it doesn't belong on the public internet. LiteLLM serves /ui on the same port as its API by default, so proxy.ai.haylan.ch's NPM Proxy Host needs an explicit rule denying the /ui path (a "Deny" custom location, same UI as the "Advanced" tab used for other NPM hosts) — proxy.ai.home has no such restriction and reaches both the API and the Admin UI.