Run Open WebUI with Ollama on a VPS

Ollama answers over an API and a command line, with no accounts and no chat window. Open WebUI adds both: a web interface with user accounts, chat history, and model management for Ollama, so a team can use your models from a browser.

This guide runs Open WebUI in Docker next to an Ollama installed with systemd, as in the Ollama self-host guide. Ollama stays on 127.0.0.1, and Caddy serves Open WebUI over HTTPS. Prefer one click? Deploy Ollama from the VeloxaHost marketplace first, then add Open WebUI with these steps.

What you need

• Ollama on Ubuntu 24.04, listening on its default 127.0.0.1:11434, with at least one model pulled.
• Docker Engine, installed from Docker's apt repository as in the Docker section of the self-host guide.
• For HTTPS, a domain such as chat.example.com and a dedicated IPv4 address. Caddy needs ports 80 and 443; the shared IPv4 address every server gets has no 80 or 443, only a block of forwarded ports. A dedicated IPv4 is a paid add-on (the console shows the current price). Without one, use the SSH tunnel at the end of the next section.

Open WebUI's docs measured its slim image at about 300 MiB of RAM at idle, without model inference; the standard image used here also carries local embedding and speech models. The model needs memory on top. For 1B to 3B models, a Veloxa 2 (2 vCPU, 4 GB RAM, 80 GB disk) at $15 a month, billed at $0.03 an hour and capped at the monthly price, is a starting point. For 7B and 8B models, a Veloxa 4 (4 vCPU, 8 GB RAM, 160 GB disk) at $30 a month, billed at $0.05 an hour. Choosing a model size goes into the numbers.

Run Open WebUI

Open WebUI's :main tag is a rolling build. Its docs recommend pinning a version tag for production; the latest release when checked is 0.12.3.

1. Generate a secret key, as Open WebUI's docs say. Without a fixed key, every recreated container logs everyone out:

   openssl rand -hex 32
   

2. Start the container. This is the host-network command from Open WebUI's connection docs, pinned to v0.12.3 and with four of its documented settings added:

   docker run -d --network=host -v open-webui:/app/backend/data \
     -e OLLAMA_BASE_URL=http://127.0.0.1:11434 \
     -e WEBUI_SECRET_KEY=your-secret-key \
     -e WEBUI_URL=https://chat.example.com \
     -e CORS_ALLOW_ORIGIN=https://chat.example.com \
     -e FORWARDED_ALLOW_IPS=127.0.0.1 \
     --name open-webui --restart always \
     ghcr.io/open-webui/open-webui:v0.12.3
   

   Why host networking: Open WebUI's docs say that when it cannot reach Ollama, the cause is usually Ollama listening only on 127.0.0.1. One fix is OLLAMA_HOST=0.0.0.0, which would publish Ollama's API on every interface. The other is --network=host, which lets the container reach Ollama on loopback, so Ollama stays private. Open WebUI then listens on port 8080 of the server.

   The settings: WEBUI_URL is where users reach it; CORS_ALLOW_ORIGIN should list every address users open it from, or chats can fail over WebSockets; FORWARDED_ALLOW_IPS trusts the client address only from the proxy, which is Caddy on the same server.

3. Check the start in the logs:

   docker logs open-webui 2>&1 | head -20
   

Private use without a domain. Skip Caddy and tunnel in through the first port of your block, which forwards to SSH (ours), then open http://localhost:8080:

ssh -p 20000 -L 8080:127.0.0.1:8080 root@203.0.113.10

Serve it over HTTPS

Add the dedicated IPv4 to the interface and point an A record for chat.example.com at it, as in the self-host guide. VeloxaHost has no IPv6 in US East, so add no AAAA record. Install Caddy from its apt repository (the commands are in the self-host guide), then set /etc/caddy/Caddyfile to Open WebUI's example:

chat.example.com {
  reverse_proxy localhost:8080
}

sudo systemctl reload caddy

Open WebUI's docs note that Caddy handles WebSocket upgrades and streamed responses on its own, so nothing more is needed. If Caddy already serves the Ollama API from the API key guide, add this as a second site block in the same file.

Then set the firewall. With host networking, port 8080 listens on every interface, so it must stay closed. In the console, go to Firewalls, New Firewall, Add Rule. Allow TCP 80 and 443 from 0.0.0.0/0 and TCP 22 only from YOUR.IP/32, then attach the firewall on the server's page. Until one is attached, all traffic is allowed.

First login

Open https://chat.example.com. The first screen offers Create Admin Account, and that first account is the administrator, so create it right away. Sign-up then switches itself off. To let others join, turn on New Sign Ups under your avatar, Settings, Admin, Authentication; new accounts wait as Pending until you approve them.

Your Ollama models appear in the model selector. To pull more, go to Settings, Admin, Connections, find your Ollama connection and select Manage.

Leave the num_ctx parameter unset in Open WebUI. Its docs warn that a num_ctx set anywhere overrides Ollama's OLLAMA_CONTEXT_LENGTH, and switching the control on fills in 2048 tokens, which silently cuts long prompts. Set the context on the Ollama side instead.

Verify it works

Check that Open WebUI answers locally, then through Caddy (both ours):

curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8080/health
curl -I https://chat.example.com

The first prints 200. Then sign in, pick a model and send a message: the reply should stream in word by word. Open WebUI's docs suggest one more check: in the browser's developer tools, filter the Network tab by "WS" and confirm a WebSocket connection is open.

Back up and update

Chats, users, settings and uploads live in the open-webui volume. Back it up with Open WebUI's command, before every update and on a schedule:

docker run --rm -v open-webui:/data -v $(pwd):/backup \
  alpine tar czf /backup/openwebui-$(date +%Y%m%d).tar.gz /data

To update, read the release notes, take a VeloxaHost snapshot (server page, Snapshots, name, Create), remove the container and pull the new version tag:

docker rm -f open-webui
docker pull ghcr.io/open-webui/open-webui:vX.Y.Z

Then run the same docker run command with the new tag. The docs warn that database migrations are one-way: rolling back to an older tag after a migration needs the backup.

Troubleshooting

No models in the selector. Open WebUI cannot reach Ollama. On the server, check that curl http://127.0.0.1:11434/api/tags lists models (ours), that the container runs with --network=host, and that OLLAMA_BASE_URL is http://127.0.0.1:11434.

A wrong Ollama URL was saved and the settings page will not load. Settings saved in the interface take precedence over environment variables. Start the container once with -e RESET_CONFIG_ON_START=true.

Everyone is logged out after an update. WEBUI_SECRET_KEY changed or was missing. Use the same key every time.

Empty {} replies or WebSocket errors. Set WEBUI_URL and CORS_ALLOW_ORIGIN to the exact HTTPS address users open.

"Open WebUI backend required". The page loaded but /api/config did not reach the backend. Check that Caddy proxies to port 8080, then clear the browser cache.

FAQ

Can I use the smaller slim image?

Yes. Open WebUI's docs list :slim at about 197 MB to download instead of 1.62 GB for :main. It leaves out local embedding, speech and document extraction, so documents need an embedding provider, such as RAG_EMBEDDING_ENGINE set to ollama. The :slim tag follows main, so it is not pinned to a release.

Why not use the image with Ollama bundled?

Open WebUI's :ollama image runs both in one container, which is simpler for a chat-only server. Keeping Ollama separate, as here, lets the same Ollama also serve its API to other tools, and lets you update each on its own schedule.

Where are chats stored?

In the open-webui volume on your server, in a SQLite database by default, with uploads beside it. Prompts go from Open WebUI to Ollama on the same server. Back the volume up with the command above.

Can I let people use it without accounts?

Open WebUI has a single-user mode with no login, set with WEBUI_AUTH=False, but its docs warn you cannot switch back to accounts afterwards. On a server reachable from the internet, keep accounts on.