# Open WebUI and Ollama Example - Link: https://www.agilicus.com/anyx-guide/open-webui-and-ollama-example/ - Published: 2025-01-12T18:53:37+00:00 - Author: Don Bowman 1. [Home](https://www.agilicus.com/) 2. Open WebUI and Ollama Example ![Open WebUI with Ollama: Run and manage local AI models like Llama 3. Agilicus provides secure access and management for your AI infrastructure. Example showing Open WebUI connected to Ollama.](https://www.agilicus.com/www/b490a237-open-webui- ollama-1024x538.webp) ## Open WebUI: Authentication and Access See how to use Agilicus AnyX to safely use your Open WebUI remotely, with single- sign-on authentication and no port-forwarding or firewall rules. Use your GPU and AI remotely, safely, simple, securely. [CONTACT](https://www.agilicus.com/contact-us/) [TRY NOW](https://www.agilicus.com/anyx-guide/signup/) ## Open WebUI And Ollama Overview [Open WebUI](https://github.com/open-webui/open-webui) is an extensible, feature- rich, and user-friendly self-hosted AI platform designed to operate entirely offline. It supports LLM runners like [Ollama](https://ollama.com/), with built-in inference engine for [RAG](https://en.wikipedia.org/wiki/Retrieval-augmented_generation). Given that is designed to operate offline, it is commonly used in home and office environments. Open WebUI by default is entirely insecure: any user who can reach the port it is running on can use it. Thus it is not suitable for a simple port-forward (and, in addition, some networks have restrictive firewalls or NAT which don’t allow inbound access) to use remotely. In this example using Agilicus AnyX, we will show how to safely, securely, simply use Open WebUI from a remote network, assigning permissions to individual users with single-sign-on, optional with multi-factor authentication, without modifying the local firewall config. ## Installation Instructions ### Overview ![Open WebUI and Ollama Integration: Diagram illustrating the seamless connection between Open WebUI, a user-friendly interface, and Ollama, a platform for running large language models locally. The diagram showcases data flow and interaction points, highlighting the ease of deploying and managing LLMs with Open WebUI for an enhanced user experience. Perfect for local AI model deployment and management.](https:// www.agilicus.com/www/91e57eb5-open-webui-ollama.drawio.svg) If you have not already, [sign up](https://www.agilicus.com/anyx-guide/signup/) for Agilicus AnyX. In the below instructions, we will refer to _ _MYDOMAIN_ _, this is the domain you chose during the Agilicus AnyX sign up process. If you have navigated to this page from the Agilicus admin console (https://admin.__MYDOMAIN__), this will be filled in automatically. Once setup, the data flow will be as shown to the right. The user will have a new URL available (https://openwebui.__MYDOMAIN__). On navigating there, they will be required to sign in (in the same way as Sign in with Google or Sign in with Microsoft on other sites). Once done, they will see the Open WebUI directly, no client software is required, no changes are needed on the firewall. Later, you can add an api key and directly access Ollama from elsewhere if needed. ### Concepts Agilicus Connector: this software installs as a service on some device in your network. It can support multiple operating systems. Each connector can support an arbitrary number of resources (web applications, shares, VNC, RDP, etc.). In general you need one connector per site. Authentication: attesting you are who you say you are. Agilicus AnyX uses OpenID Connect, and supports zero-config of Microsoft, Google, Yahoo, Linkedin, or, you can configure your own such as Okta. Identity: who you are. This is external to the Agilicus AnyX system. Resource: an individually accessible and permissionable endpoint. In this example, Open WebUI Permission: assigning a role and access rules per person<->resource pair. 1. Install Connector [Overview](https://www.agilicus.com/anyx-guide/open-webui-and-ollama-example/#All) [Linux](https://www.agilicus.com/anyx-guide/open-webui-and-ollama-example/#Linux) [Windows](https://www.agilicus.com/anyx-guide/open-webui-and-ollama-example/#Windows) For details see [Agilicus Connector](https://www.agilicus.com/anyx-guide/agilicus-connector/). In this example, we are assuming you will install the Connector on the same machine as Open WebUI. Select the appropriate tab for your Operating System. Navigate to the admin console (https://admin.__MYDOMAIN__). Sign in with the credentials you used during sign up. Select resoures/connectors/new, and give the new connector a name (here we are using ‘openwebui’). Select ‘Install Connector’. In the dialog that comes up, select Linux at the top, and then copy the command line. Paste this into a root shell. Depending on your Linux distribution, this will install a service with systemd, upstart, init.d, etc. These instructions should also work on embedded devices (e. g. Raspberry pi). When complete, the dialog should dismiss itself. We can now check the connector status in Resources/Connectors/Overview, and see it will go ‘good’. If the connector doesn’t come online, check that the service is running and check for any errors in its log. Common errors include: 1. NTP / timesync is not setup 2. Outbound firewall prevents connections to port 443 (the Connector can support MITM proxies in corporate environments if needed) ![connector-1](https://www.agilicus.com/www/42613c30-connector-1-1024x650.png) ![Agilicus Connector Installation on GL-RM1 KVM: This screenshot illustrates the Agilicus AnyX connector setup process on a GL-RM1 KVM. It shows the user interface with key configuration options highlighted, emphasizing ease of deployment and secure connectivity for remote access solutions.](https://www.agilicus.com/www/985d8b79- connector-2-1024x646.png) ![connector-3](https://www.agilicus.com/www/9d04c2e7-connector-3-1024x651.png) ![linux-connector-1](https://www.agilicus.com/www/d92cdd75-linux-connector-1-1024x741. png) ![Agilicus AnyX Linux Connector Installation on GL-RM1 KVM: Screenshot of the AnyX connector interface on a Linux system, highlighting the steps for installation and configuration within a KVM environment, specifically using the GL-RM1 router. Shows the connector's user interface with options for setup and management, emphasizing ease of integration for secure access.](https://www.agilicus.com/www/59f86f1c-linux- connector-2-1024x661.png) ![Agilicus AnyX Connector Installation on GL-RM1 KVM. Screenshot showing the AnyX Connector interface with options for configuring network settings, server address, and authentication for secure remote access.](https://www.agilicus.com/www/7ea89eb2- connector-4-1024x556.png) (For more details, see [Agilicus Connector – Microsoft Windows](https://www.agilicus.com/anyx-guide/agilicus-connector-microsoft-windows/)) Navigate to the admin console (https://admin.__MYDOMAIN__). Sign in with the credentials you used during sign up. Select resoures/connectors/new, and give the new connector a name (here we are using ‘openwebui’). Select ‘Install Connector’. In the dialog that comes up, select Windows-CMD at the top, and then copy the command line. Paste this into an Administrator cmd interface (e.g. on start menu, type ‘ cmd’, and then select ‘Administrative shell’ on the right). When complete, the dialog should dismiss itself. We can now check the connector status in Resources/Connectors/Overview, and see it will go ‘good’. If the connector doesn’t come online, check that the service is running and check for any errors in eventvwr. Common errors include: 1. NTP / timesync is not setup 2. Outbound firewall prevents connections to port 443 (the Connector can support MITM proxies in corporate environments if needed) ![connector-1](https://www.agilicus.com/www/42613c30-connector-1-1024x650.png) ![Agilicus Connector Installation on GL-RM1 KVM: This screenshot illustrates the Agilicus AnyX connector setup process on a GL-RM1 KVM. It shows the user interface with key configuration options highlighted, emphasizing ease of deployment and secure connectivity for remote access solutions.](https://www.agilicus.com/www/985d8b79- connector-2-1024x646.png) ![connector-3](https://www.agilicus.com/www/9d04c2e7-connector-3-1024x651.png) ![linux-connector-1](https://www.agilicus.com/www/d92cdd75-linux-connector-1-1024x741. png) ![image](https://www.agilicus.com/www/d4b23776-image-1024x837.png) ![Rockwell Automation PanelView VNC Access via AnyX: Securely connect to your HMI from anywhere. This image shows the AnyX interface providing remote access to a Rockwell PanelView, enhancing operational efficiency and control.](https://www.agilicus. com/www/457280d5-image.png) ![Agilicus AnyX Connector Installation on GL-RM1 KVM. Screenshot showing the AnyX Connector interface with options for configuring network settings, server address, and authentication for secure remote access.](https://www.agilicus.com/www/7ea89eb2- connector-4-1024x556.png) 2. Create Open WebUI Web Application In this example we assume you already have Open WebUI running, in the default mode listening on port 8080. ```wp-elements-2 don@office[ca-1]:~$ open-webui serve WARNING: CORS_ALLOW_ORIGIN IS SET TO '*' - NOT RECOMMENDED FOR PRODUCTION DEPLOYMENTS. ___ __ __ _ _ _ ___ / _ \ _ __ ___ _ __ \ \ / /__| |__ | | | |_ _| | | | | '_ \ / _ \ '_ \ \ \ /\ / / _ \ '_ \| | | || | | |_| | |_) | __/ | | | \ V V / __/ |_) | |_| || | \___/| .__/ \___|_| |_| \_/\_/ \___|_.__/ \___/|___| |_| v0.5.3 - building the best open-source AI user interface. https://github.com/open-webui/open-webui INFO: Started server process [2151942] INFO: Waiting for application startup. INFO: Application startup complete. INFO: Uvicorn running on http://0.0.0.0:8080 (Press CTRL+C to quit) ``` We will create a Web Application in Agilicus AnyX. This will create a new URL, https:// openwebui.__MYDOMAIN__, and, any user navigating there will be forced to authenticate via OpenID Connect and have a permission assigned. This means it is both publicly accessible on the Internet, and, secure. Network data will from from the user, through the Agilicus AnyX cloud, to the Agilicus Connector, and onward to the Open WebUI. This will be TLS encrypted from the user to the Connector, making it secure and non interceptable (including by Agilicus). First, navigate to resources/applications/new. Give this a name (it will become a hostname so no spaces or special characters). Here we use ‘openwebui’. Second select the Access method (from your premises via a connector). Select the connector you installed in the previous step. Third, configure the ‘upstream services’ (the local http://localhost:8080 information). Fourth, configure how your application is authenticated. Here we configure authentication via proxy, if you wish to do more configuration you can integrate your applications directly via OpenID Connect. But ‘authenticated by proxy’ will work for all web applications. Optional, configure a pass-through logout (/api/v1/auths/signout) so that signing out of the web app also signs out of the proxy. Configure how users are assigned permissions. Here we select ‘named users, single role’, to allow us to control who can use this application. You will be presented with a Summary. Hit APPLY. Now, we will assign initial permissions to access this application to our user. You can also do this later under Access/Application Permissions. At this stage we can navigate to https://profile.__MYDOMAIN__ (the end-user interface), hit refresh, and should see an icon for openwebui. We can also directly navigate to https://openwebui.__MYDOMAIN__ directly from your browser. ![image](https://www.agilicus.com/www/63162f9d-image-1024x590.png) ![image](https://www.agilicus.com/www/8b5ab66d-image-1024x595.png) ![image](https://www.agilicus.com/www/c247f937-image-1024x598.png) ![image](https://www.agilicus.com/www/29a2fb3f-image-1024x590.png) ![image](https://www.agilicus.com/www/65c68a4c-image-1024x593.png) ![image](https://www.agilicus.com/www/17d8ed28-image-1024x593.png) 3. Add a second user (optional) We can now add a second user to share. Enter their email address (this must match that given by the Identity Provider, e.g. user@gmail, user@outlook.com, user@google- workspace-domain, user@office365-domain etc. (See below in ‘Next Steps: Single Sign On’ for configuring Open WebUI to automatically accept the user via the “WEBUI_AUTH_TRUSTED_EMAIL_HEADER” environment variable) ![image](https://www.agilicus.com/www/06c90c5b-image-1024x588.png) Now, add permissions to the user. If you have a lot of applications or a lot of users, consider using Groups. ![image](https://www.agilicus.com/www/836a0fd8-image-1024x585.png) ### Next Steps Open WebUI supports a “WEBUI_AUTH_TRUSTED_EMAIL_HEADER”. See “[Include User Context Headers](https://www.agilicus.com/anyx-guide/proxy/)” which allows setting “X-Gateway-User-Email”. If you set the environment variable WEBUI_AUTH_TRUSTED_EMAIL_HEADER=X-Gateway-User-Email, users will be automatically signed into Open WebUI. ![image](https://www.agilicus.com/www/2fe36742-image-1024x540.png) ![image](https://www.agilicus.com/www/2ea54b30-image-1024x843.png)