selfhost(ai): OpenWebUI + model management — Ollama browser UI + model library

[JSONbored]

Part of #1029.

Context

Ollama (--profile ollama) runs local LLM inference but has no management UI — operators must use the CLI to pull models, switch between them, or monitor GPU usage. OpenWebUI provides a polished, self-hosted chat and model management interface that connects directly to Ollama. It also serves as a quick sanity-check: operators can test a model with a prompt before wiring it into gittensory's review pipeline.

This is UI-only: it has zero dependency on gittensory's codebase, no src/** changes, and no coverage obligation.

Easy on/off

# Enable (requires --profile ollama to be useful, but not strictly required):
docker compose --profile ollama --profile ai-ui up -d

# Disable: stop the profile. No impact on gittensory or Ollama.

Implementation

docker-compose.yml

open-webui:
  image: ghcr.io/open-webui/open-webui:main
  profiles: ["ai-ui"]
  restart: unless-stopped
  ports:
    - "8080:8080"
  volumes:
    - open-webui-data:/app/backend/data
  environment:
    OLLAMA_BASE_URL: http://ollama:11434
    WEBUI_AUTH: ${OPEN_WEBUI_AUTH:-true}           # false = no login (local-only LAN use)
    WEBUI_SECRET_KEY: ${OPEN_WEBUI_SECRET:?Set OPEN_WEBUI_SECRET in .env}
    WEBUI_NAME: "Gittensory AI"
    DEFAULT_MODELS: ${AI_MODEL:-llama3.2}          # pre-select the same model gittensory uses
  depends_on:
    - ollama                                        # soft dep — works if ollama isn't in profile too

Auto-pull the configured model on start

Add a one-shot init container or startup script that calls POST /api/pull on Ollama for ${AI_MODEL:-llama3.2} so the model is ready without a manual docker exec ollama ollama pull ... step:

ollama-model-pull:
  image: curlimages/curl:latest
  profiles: ["ollama"]
  restart: "no"
  command: >
    sh -c "sleep 5 && curl -sf -X POST http://ollama:11434/api/pull -d '{\"name\":\"${AI_MODEL:-llama3.2}\"}'"
  depends_on:
    - ollama

.env.example additions

# OpenWebUI model management UI (--profile ai-ui; pairs with --profile ollama)
# OPEN_WEBUI_SECRET=changeme   # REQUIRED when using --profile ai-ui; signs sessions
# OPEN_WEBUI_AUTH=true         # false disables login (fine for LAN-only setups)
# UI at http://localhost:8080 — first signup becomes the admin account

Model pull helper script (scripts/selfhost/pull-model.sh)

#!/usr/bin/env bash
MODEL=${1:-llama3.2}
docker compose exec ollama ollama pull "$MODEL"
echo "Model $MODEL pulled. Update AI_MODEL=$MODEL in .env and restart gittensory."

Acceptance criteria

• docker compose --profile ollama --profile ai-ui up starts OpenWebUI at port 8080
• OpenWebUI connects to Ollama at http://ollama:11434 automatically
• AI_MODEL env var sets the default model pre-selected in the UI
• WEBUI_AUTH=false disables the login gate (local LAN use)
• ollama-model-pull init container pulls the configured model on first start
• scripts/selfhost/pull-model.sh helper checked in
• .env.example updated with OPEN_WEBUI_SECRET and OPEN_WEBUI_AUTH
• No changes to src/** (no Codecov obligation)
• npm run test:ci green