forked from open-webui/open-webui
Merge pull request #501 from oliverbob/main
Idiot-Proof level HTTPS doc for apache
This commit is contained in:
Timothy Jaeryang Baek
GitHub
commit
55ba5e6258
1 changed files with 204 additions and 0 deletions
204
docs/apache.md
Normal file
204
docs/apache.md
Normal file
|
|
@ -0,0 +1,204 @@
|
|||
# Hosting UI and Models separately
|
||||
|
||||
Sometimes, its beneficial to host Ollama, separate from the UI, but retain the RAG and RBAC support features shared across users:
|
||||
|
||||
# Ollama WebUI Configuration
|
||||
|
||||
## UI Configuration
|
||||
|
||||
For the UI configuration, you can set up the Apache VirtualHost as follows:
|
||||
|
||||
```
|
||||
# Assuming you have a website hosting this UI at "server.com"
|
||||
<VirtualHost 192.168.1.100:80>
|
||||
ServerName server.com
|
||||
DocumentRoot /home/server/public_html
|
||||
|
||||
ProxyPass / http://server.com:3000/ nocanon
|
||||
ProxyPassReverse / http://server.com:3000/
|
||||
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
Enable the site first before you can request SSL:
|
||||
|
||||
`a2ensite server.com.conf` # this will enable the site. a2ensite is short for "Apache 2 Enable Site"
|
||||
|
||||
|
||||
```
|
||||
# For SSL
|
||||
<VirtualHost 192.168.1.100:443>
|
||||
ServerName server.com
|
||||
DocumentRoot /home/server/public_html
|
||||
|
||||
ProxyPass / http://server.com:3000/ nocanon
|
||||
ProxyPassReverse / http://server.com:3000/
|
||||
|
||||
SSLEngine on
|
||||
SSLCertificateFile /etc/ssl/virtualmin/170514456861234/ssl.cert
|
||||
SSLCertificateKeyFile /etc/ssl/virtualmin/170514456861234/ssl.key
|
||||
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
|
||||
|
||||
SSLProxyEngine on
|
||||
SSLCACertificateFile /etc/ssl/virtualmin/170514456865864/ssl.ca
|
||||
</VirtualHost>
|
||||
|
||||
```
|
||||
|
||||
I'm using virtualmin here for my SSL clusters, but you can also use certbot directly or your preferred SSL method. To use SSL:
|
||||
|
||||
### Prerequisites.
|
||||
|
||||
Run the following commands:
|
||||
|
||||
`snap install certbot --classic`
|
||||
`snap apt install python3-certbot-apache` (this will install the apache plugin).
|
||||
|
||||
Navigate to the apache sites-available directory:
|
||||
|
||||
`cd /etc/apache2/sites-available/`
|
||||
|
||||
Create server.com.conf if it is not yet already created, containing the above `<virtualhost>` configuration (it should match your case. Modify as necessary). Use the one without the SSL:
|
||||
|
||||
Once it's created, run `certbot --apache -d server.com`, this will request and add/create an SSL keys for you as well as create the server.com.le-ssl.conf
|
||||
|
||||
|
||||
# Configuring Ollama Server
|
||||
|
||||
On your latest installation of Ollama, make sure that you have setup your api server from the official Ollama reference:
|
||||
|
||||
[Ollama FAQ](https://github.com/jmorganca/ollama/blob/main/docs/faq.md)
|
||||
|
||||
|
||||
### TL;DR
|
||||
|
||||
The guide doesn't seem to match the current updated service file on linux. So, we will address it here:
|
||||
|
||||
Unless when you're compiling Ollama from source, installing with the standard install `curl https://ollama.ai/install.sh | sh` creates a file called `ollama.service` in /etc/systemd/system. You can use nano to edit the file:
|
||||
|
||||
```
|
||||
sudo nano /etc/systemd/system/ollama.service
|
||||
```
|
||||
|
||||
Add the following lines:
|
||||
```
|
||||
Environment="OLLAMA_HOST=0.0.0.0:11434" # this line is mandatory. You can also specify
|
||||
```
|
||||
|
||||
For instance:
|
||||
|
||||
```
|
||||
[Unit]
|
||||
Description=Ollama Service
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/local/bin/ollama serve
|
||||
Environment="OLLAMA_HOST=0.0.0.0:11434" # this line is mandatory. You can also specify 192.168.254.109:DIFFERENT_PORT, format
|
||||
Environment="OLLAMA_ORIGINS=http://192.168.254.106:11434,https://models.server.city" # this line is optional
|
||||
User=ollama
|
||||
Group=ollama
|
||||
Restart=always
|
||||
RestartSec=3
|
||||
Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/s>
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
```
|
||||
|
||||
|
||||
Save the file by pressing CTRL+S, then press CTRL+X
|
||||
|
||||
When your computer restarts, the Ollama server will now be listening on the IP:PORT you specified, in this case 0.0.0.0:11434, or 192.168.254.106:11434 (whatever your local IP address is). Make sure that your router is correctly configured to serve pages from that local IP by forwarding 11434 to your local IP server.
|
||||
|
||||
|
||||
# Ollama Model Configuration
|
||||
## For the Ollama model configuration, use the following Apache VirtualHost setup:
|
||||
|
||||
|
||||
Navigate to the apache sites-available directory:
|
||||
|
||||
`cd /etc/apache2/sites-available/`
|
||||
|
||||
`nano models.server.city.conf` # match this with your ollama server domain
|
||||
|
||||
Add the folloing virtualhost containing this example (modify as needed):
|
||||
|
||||
```
|
||||
|
||||
# Assuming you have a website hosting this UI at "models.server.city"
|
||||
<IfModule mod_ssl.c>
|
||||
<VirtualHost 192.168.254.109:443>
|
||||
DocumentRoot "/var/www/html/"
|
||||
ServerName models.server.city
|
||||
<Directory "/var/www/html/">
|
||||
Options None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ProxyRequests Off
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
SSLProxyEngine on
|
||||
|
||||
ProxyPass / http://server.city:1000/ nocanon # or port 11434
|
||||
ProxyPassReverse / http://server.city:1000/ # or port 11434
|
||||
|
||||
SSLCertificateFile /etc/letsencrypt/live/models.server.city/fullchain.pem
|
||||
SSLCertificateKeyFile /etc/letsencrypt/live/models.server.city/privkey.pem
|
||||
Include /etc/letsencrypt/options-ssl-apache.conf
|
||||
</VirtualHost>
|
||||
</IfModule>
|
||||
```
|
||||
|
||||
You may need to enable the site first (if you haven't done so yet) before you can request SSL:
|
||||
|
||||
`a2ensite models.server.city.conf`
|
||||
|
||||
#### For the SSL part of Ollama server
|
||||
|
||||
Run the following commands:
|
||||
|
||||
Navigate to the apache sites-available directory:
|
||||
|
||||
`cd /etc/apache2/sites-available/`
|
||||
`certbot --apache -d server.com`
|
||||
|
||||
```
|
||||
<VirtualHost 192.168.254.109:80>
|
||||
DocumentRoot "/var/www/html/"
|
||||
ServerName models.server.city
|
||||
<Directory "/var/www/html/">
|
||||
Options None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
ProxyRequests Off
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
SSLProxyEngine on
|
||||
|
||||
ProxyPass / http://server.city:1000/ nocanon # or port 11434
|
||||
ProxyPassReverse / http://server.city:1000/ # or port 11434
|
||||
|
||||
RewriteEngine on
|
||||
RewriteCond %{SERVER_NAME} =models.server.city
|
||||
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
|
||||
</VirtualHost>
|
||||
|
||||
```
|
||||
|
||||
Don't forget to restart/reload Apache with `systemctl reload apache2`
|
||||
|
||||
Open your site at https://server.com!
|
||||
|
||||
**Congratulations**, your _**Open-AI-like Chat-GPT style UI**_ is now serving AI with RAG, RBAC and multimodal features! Download Ollama models if you haven't yet done so!
|
||||
|
||||
If you encounter any misconfiguration or errors, please file an issue or engage with our discussion. There are a lot of friendly developers here to assist you.
|
||||
|
||||
Let's make this UI much more user friendly for everyone!
|
||||
|
||||
Thanks for making ollama-webui your UI Choice for AI!
|
||||
|
||||
|
||||
This doc is made by **Bob Reyes**, your **Ollama-Web-UI** fan from the Philippines.
|
||||
Loading…
Add table
Add a link
Reference in a new issue