services:
  openwebui:
    image: ghcr.io/open-webui/open-webui:main
    ports:
      - "4000:8080"
    volumes:
      - open-webui:/app/backend/data
    environment:
      WEBUI_URL: https://ai.${DOMAIN}
      ENABLE_OPENAI_API: true
      OPENAI_API_BASE_URL: http://open-webui.home:12345
      ENABLE_OLLAMA_API: false
      ENABLE_WEB_SEARCH: true
      WEB_SEARCH_ENGINE: searxng
      SEARXNG_QUERY_URL: https://search.${DOMAIN}/search?q=<query>
      OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID}
      OAUTH_CLIENT_SECRET: ${OAUTH_CLIENT_SECRET}
      OAUTH_PROVIDER_NAME: authentik
      OPENID_PROVIDER_URL: https://auth.${DOMAIN}/application/o/openwebui/.well-known/openid-configuration
      OPENID_REDIRECT_URI: https://ai.${DOMAIN}/oauth/oidc/callback
      ENABLE_OAUTH_SIGNUP: true
      ENABLE_LOGIN_FORM: false
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

volumes:
  open-webui: