From 23ede8f568a4a149be1439c3bd98fb4b34f39dba Mon Sep 17 00:00:00 2001 From: Code-Egg Date: Thu, 8 Oct 2026 14:58:09 +0800 Subject: [PATCH 1/7] new file: docs/reference/https/openlitespeed.md --- docs/reference/https/openlitespeed.md | 93 +++++++++++++++++++++++++++ 1 file changed, 93 insertions(+) create mode 100644 docs/reference/https/openlitespeed.md diff --git a/docs/reference/https/openlitespeed.md b/docs/reference/https/openlitespeed.md new file mode 100644 index 0000000000..2f76e608cc --- /dev/null +++ b/docs/reference/https/openlitespeed.md @@ -0,0 +1,93 @@ +--- +sidebar_position: 203 +title: "HTTPS using OpenLiteSpeed" +--- + +# HTTPS Using OpenLiteSpeed + +OpenLiteSpeed (OLS) can serve Open WebUI over HTTPS and forward requests to the application running on your server or in Docker. This guide covers two setups: installing OLS on the host with its one-click script, or running the proxy in Docker Compose. + +Choose one setup method. Both use AutoSSL to request and renew a trusted certificate for your domain. + +## Prerequisites + +- A domain name with DNS `A` and/or `AAAA` records pointing to the server. +- Public access to ports `80` and `443` for certificate validation and HTTPS traffic. +- Open WebUI running and reachable by the proxy. +- Docker Engine and the Compose plugin for the Docker Compose method. + +:::warning + +Do not expose the Open WebUI backend port publicly. Once the proxy is working, allow public traffic only through the ports used by OpenLiteSpeed, typically `80` and `443`. + +::: + +## Run the proxy in Docker Compose + +The OpenLiteSpeed proxy container and Open WebUI container must share a Docker network so the proxy can reach the backend by service name. + +### Create the shared network + +Create the external network once: + +```bash +docker network inspect ls-net >/dev/null 2>&1 || docker network create ls-net +``` + +In the Open WebUI Compose project, attach the `open-webui` service to this network. Add the following network declaration at the end of the Compose file: + +```yaml +services: + open-webui: + # Keep your existing image, volumes, environment, and other settings. + networks: + - ls-net + +networks: + ls-net: + name: ls-net + external: true +``` + +If the service already has a `networks` entry, add `ls-net` to that list rather than replacing its existing networks. The proxy will use `open-webui:8080` as its backend address. + +### Configure the OLS proxy container + +Clone the [OpenLiteSpeed proxy Docker Compose project](https://github.com/litespeedtech/ols-proxy-docker-env) and create its environment file: + +```bash +git clone https://github.com/litespeedtech/ols-proxy-docker-env +cd ols-proxy-docker-env +cp .env.example .env +``` + +Edit `.env` and set these values. Use your own domain and an email address for certificate notices: + +```dotenv +OLS_IMAGE=litespeedtech/openlitespeed:latest +BACKEND_IP=open-webui +BACKEND_PORT=8080 +DOMAIN=chat.example.com +PROXY_METHOD=context +PROXY_SOCKET=true +ACME_EMAIL=admin@example.com +``` + +Start the proxy: + +```bash +docker compose up -d +``` + +The proxy project publishes the web ports. Confirm that ports `80` and `443` are allowed through your firewall and that the domain resolves to this server. + +## Verify HTTPS + +Open `https://chat.example.com` in a browser. Open WebUI should load with a valid certificate. Sign in and send a test prompt to confirm that API requests and streamed responses work through the proxy. + +After verification, make sure the backend port is not reachable from the public internet. With Docker, the proxy and backend can communicate over `ls-net` without publishing the backend port to the host. If you need a host port for local access, restrict it to `127.0.0.1` or block public access with your firewall. + +## Optional security settings + +OpenLiteSpeed docker also offers features such as OWASP protection, CAPTCHA, per-client throttling, access control, realms, and security headers. Configure these through the proxy environment file or the WebAdmin Console as appropriate for your setup. Test each setting with Open WebUI before enabling it in production, since some rules can interfere with legitimate application requests. + From ec975d9502d3524cfb95d6b6226d2ac2ead0ad62 Mon Sep 17 00:00:00 2001 From: Code-Egg Date: Thu, 8 Oct 2026 15:31:51 +0800 Subject: [PATCH 2/7] modified: docs/reference/https/openlitespeed.md --- docs/reference/https/openlitespeed.md | 55 +++++++++++++++++++++------ 1 file changed, 44 insertions(+), 11 deletions(-) diff --git a/docs/reference/https/openlitespeed.md b/docs/reference/https/openlitespeed.md index 2f76e608cc..d645436206 100644 --- a/docs/reference/https/openlitespeed.md +++ b/docs/reference/https/openlitespeed.md @@ -5,9 +5,7 @@ title: "HTTPS using OpenLiteSpeed" # HTTPS Using OpenLiteSpeed -OpenLiteSpeed (OLS) can serve Open WebUI over HTTPS and forward requests to the application running on your server or in Docker. This guide covers two setups: installing OLS on the host with its one-click script, or running the proxy in Docker Compose. - -Choose one setup method. Both use AutoSSL to request and renew a trusted certificate for your domain. +OpenLiteSpeed (OLS) can serve Open WebUI over HTTPS and forward requests to the application running on your server or in Docker. This guide covers running the openlitespeed as a reverse proxy, auto apply SSL and enable security features in Docker Compose. ## Prerequisites @@ -39,18 +37,24 @@ In the Open WebUI Compose project, attach the `open-webui` service to this netwo ```yaml services: open-webui: - # Keep your existing image, volumes, environment, and other settings. - networks: - - ls-net + image: ghcr.io/open-webui/open-webui:main + ports: + - "3000:8080" + volumes: + - open-webui:/app/backend/data + #environment: + # - WEBUI_SECRET_KEY=your-secret-key + restart: unless-stopped + +volumes: + open-webui: networks: - ls-net: + default: name: ls-net external: true ``` -If the service already has a `networks` entry, add `ls-net` to that list rather than replacing its existing networks. The proxy will use `open-webui:8080` as its backend address. - ### Configure the OLS proxy container Clone the [OpenLiteSpeed proxy Docker Compose project](https://github.com/litespeedtech/ols-proxy-docker-env) and create its environment file: @@ -79,8 +83,6 @@ Start the proxy: docker compose up -d ``` -The proxy project publishes the web ports. Confirm that ports `80` and `443` are allowed through your firewall and that the domain resolves to this server. - ## Verify HTTPS Open `https://chat.example.com` in a browser. Open WebUI should load with a valid certificate. Sign in and send a test prompt to confirm that API requests and streamed responses work through the proxy. @@ -91,3 +93,34 @@ After verification, make sure the backend port is not reachable from the public OpenLiteSpeed docker also offers features such as OWASP protection, CAPTCHA, per-client throttling, access control, realms, and security headers. Configure these through the proxy environment file or the WebAdmin Console as appropriate for your setup. Test each setting with Open WebUI before enabling it in production, since some rules can interfere with legitimate application requests. +Example security content in the .env file +``` +### Global security controls. These apply to every mapped domain and cannot be set in domains.conf. +THROTTLING=false +RECAPTCHA=false +MODSECURITY=false + +### Per-client throttling values used only when THROTTLING=true. +THROTTLING_STATIC_REQ_PER_SEC=1000 +THROTTLING_DYNAMIC_REQ_PER_SEC=50 +THROTTLING_OUT_BANDWIDTH=0 +THROTTLING_IN_BANDWIDTH=0 +THROTTLING_SOFT_LIMIT=50 +THROTTLING_HARD_LIMIT=100 +THROTTLING_BLOCK_BAD_REQUEST=true +THROTTLING_GRACE_PERIOD=15 +THROTTLING_BAN_PERIOD=60 + +### CAPTCHA values used only when RECAPTCHA=true. Provider keys are optional. +### RECAPTCHA_TYPE: checkbox, invisible, or hcaptcha. +RECAPTCHA_TYPE=checkbox +RECAPTCHA_SITE_KEY= +RECAPTCHA_SECRET_KEY= +RECAPTCHA_MAX_TRIES=10 +RECAPTCHA_ALLOWED_ROBOT_HITS=100 +RECAPTCHA_CONNECTION_LIMIT=100 +RECAPTCHA_SSL_CONNECTION_LIMIT=100 + +### OWASP CRS is baked into the image. Change the version only with: docker compose up -d --build +OWASP_CRS_VERSION=4.21.0 +``` From 353dbfb38defcc02776b8f6af3ce3473831f1d4c Mon Sep 17 00:00:00 2001 From: Code-Egg Date: Thu, 8 Oct 2026 16:11:02 +0800 Subject: [PATCH 3/7] modified: docs/reference/https/index.md modified: docs/reference/https/openlitespeed.md --- docs/reference/https/index.md | 2 ++ docs/reference/https/openlitespeed.md | 37 ++++++++------------------- 2 files changed, 13 insertions(+), 26 deletions(-) diff --git a/docs/reference/https/index.md b/docs/reference/https/index.md index 7d76cbab90..d4dc3a1808 100644 --- a/docs/reference/https/index.md +++ b/docs/reference/https/index.md @@ -26,6 +26,8 @@ Modern browsers block microphone access on non-HTTPS origins. **Voice Calls will | [**Caddy**](/reference/https/caddy) | Self-hosted production, minimal config | Automatic (Let's Encrypt) | | [**HAProxy**](/reference/https/haproxy) | High-availability / load balancing | Manual or Let's Encrypt | | **Cloud load balancers** | AWS ALB, GCP LB, Azure App Gateway | Managed by cloud provider | +| [**OpenLiteSpeed**](/reference/https/openlitespeed) | Self-hosted production, minimal configuration, comprehensive security features + | Automatic (Let's Encrypt) | --- diff --git a/docs/reference/https/openlitespeed.md b/docs/reference/https/openlitespeed.md index d645436206..1470b40683 100644 --- a/docs/reference/https/openlitespeed.md +++ b/docs/reference/https/openlitespeed.md @@ -71,7 +71,7 @@ Edit `.env` and set these values. Use your own domain and an email address for c OLS_IMAGE=litespeedtech/openlitespeed:latest BACKEND_IP=open-webui BACKEND_PORT=8080 -DOMAIN=chat.example.com +DOMAIN=example.com PROXY_METHOD=context PROXY_SOCKET=true ACME_EMAIL=admin@example.com @@ -85,7 +85,7 @@ docker compose up -d ## Verify HTTPS -Open `https://chat.example.com` in a browser. Open WebUI should load with a valid certificate. Sign in and send a test prompt to confirm that API requests and streamed responses work through the proxy. +Open `https://example.com` in a browser. Open WebUI should load with a valid certificate. Sign in and send a test prompt to confirm that API requests and streamed responses work through the proxy. After verification, make sure the backend port is not reachable from the public internet. With Docker, the proxy and backend can communicate over `ls-net` without publishing the backend port to the host. If you need a host port for local access, restrict it to `127.0.0.1` or block public access with your firewall. @@ -93,34 +93,19 @@ After verification, make sure the backend port is not reachable from the public OpenLiteSpeed docker also offers features such as OWASP protection, CAPTCHA, per-client throttling, access control, realms, and security headers. Configure these through the proxy environment file or the WebAdmin Console as appropriate for your setup. Test each setting with Open WebUI before enabling it in production, since some rules can interfere with legitimate application requests. -Example security content in the .env file +Example default security config settings in the .env file ``` ### Global security controls. These apply to every mapped domain and cannot be set in domains.conf. THROTTLING=false RECAPTCHA=false MODSECURITY=false +``` -### Per-client throttling values used only when THROTTLING=true. -THROTTLING_STATIC_REQ_PER_SEC=1000 -THROTTLING_DYNAMIC_REQ_PER_SEC=50 -THROTTLING_OUT_BANDWIDTH=0 -THROTTLING_IN_BANDWIDTH=0 -THROTTLING_SOFT_LIMIT=50 -THROTTLING_HARD_LIMIT=100 -THROTTLING_BLOCK_BAD_REQUEST=true -THROTTLING_GRACE_PERIOD=15 -THROTTLING_BAN_PERIOD=60 - -### CAPTCHA values used only when RECAPTCHA=true. Provider keys are optional. -### RECAPTCHA_TYPE: checkbox, invisible, or hcaptcha. -RECAPTCHA_TYPE=checkbox -RECAPTCHA_SITE_KEY= -RECAPTCHA_SECRET_KEY= -RECAPTCHA_MAX_TRIES=10 -RECAPTCHA_ALLOWED_ROBOT_HITS=100 -RECAPTCHA_CONNECTION_LIMIT=100 -RECAPTCHA_SSL_CONNECTION_LIMIT=100 - -### OWASP CRS is baked into the image. Change the version only with: docker compose up -d --build -OWASP_CRS_VERSION=4.21.0 +To enable Throttling, set THROTTLING in `.env` to `true`: +``` +THROTTLING=true +``` +Recreate the proxy container to apply the change: ``` +docker compose up -d --force-recreate +``` \ No newline at end of file From b604155287ae65d907b81c68d1839d2a11bf9bea Mon Sep 17 00:00:00 2001 From: Code-Egg Date: Thu, 8 Oct 2026 21:21:10 +0800 Subject: [PATCH 4/7] modified: docs/reference/https/openlitespeed.md --- docs/reference/https/openlitespeed.md | 29 ++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/docs/reference/https/openlitespeed.md b/docs/reference/https/openlitespeed.md index 1470b40683..bf270be806 100644 --- a/docs/reference/https/openlitespeed.md +++ b/docs/reference/https/openlitespeed.md @@ -14,11 +14,6 @@ OpenLiteSpeed (OLS) can serve Open WebUI over HTTPS and forward requests to the - Open WebUI running and reachable by the proxy. - Docker Engine and the Compose plugin for the Docker Compose method. -:::warning - -Do not expose the Open WebUI backend port publicly. Once the proxy is working, allow public traffic only through the ports used by OpenLiteSpeed, typically `80` and `443`. - -::: ## Run the proxy in Docker Compose @@ -57,6 +52,8 @@ networks: ### Configure the OLS proxy container +1. Download the repository and enter its directory: + Clone the [OpenLiteSpeed proxy Docker Compose project](https://github.com/litespeedtech/ols-proxy-docker-env) and create its environment file: ```bash @@ -65,29 +62,43 @@ cd ols-proxy-docker-env cp .env.example .env ``` +2. Open `.env` in a text editor and configure the deployment: + Edit `.env` and set these values. Use your own domain and an email address for certificate notices: ```dotenv OLS_IMAGE=litespeedtech/openlitespeed:latest BACKEND_IP=open-webui BACKEND_PORT=8080 -DOMAIN=example.com +DOMAIN=www.example.com PROXY_METHOD=context PROXY_SOCKET=true ACME_EMAIL=admin@example.com ``` -Start the proxy: + | Variable | Description | + | --- | --- | + | `OLS_IMAGE` | OpenLiteSpeed container image to run. | + | `BACKEND_IP` | Backend container name or IP. | + | `BACKEND_PORT` | Port on which the application listens inside its container. | + | `DOMAIN` | Domain name served by OpenLiteSpeed. | + | `PROXY_METHOD` | Method used to configure the OpenLiteSpeed reverse proxy. Supports `context` and `rewrite` values. | + | `PROXY_SOCKET` | Enables WebSocket proxying when set to `true`. | + | `ACME_EMAIL` | Email address used for ACME certificate registration and notifications. | + + +3. Start OpenLiteSpeed: ```bash docker compose up -d ``` + ## Verify HTTPS -Open `https://example.com` in a browser. Open WebUI should load with a valid certificate. Sign in and send a test prompt to confirm that API requests and streamed responses work through the proxy. +Open `https://www.example.com` in a browser. Open WebUI should load with a valid certificate. Sign in and send a test prompt to confirm that API requests and streamed responses work through the proxy. -After verification, make sure the backend port is not reachable from the public internet. With Docker, the proxy and backend can communicate over `ls-net` without publishing the backend port to the host. If you need a host port for local access, restrict it to `127.0.0.1` or block public access with your firewall. +After verification, make sure the backend port is not reachable from the public internet. With Docker, the proxy and backend can communicate over `ls-net` without publishing the backend port to the host. If you need a host port for local access, restrict it to `127.0.0.1` in the compose file or block public access with your firewall. ## Optional security settings From c2796c2eb5306b8b7352c8a823e62532ab1d7f0a Mon Sep 17 00:00:00 2001 From: Code-Egg Date: Thu, 8 Oct 2026 21:39:52 +0800 Subject: [PATCH 5/7] modified: docs/reference/https/openlitespeed.md --- docs/reference/https/openlitespeed.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/reference/https/openlitespeed.md b/docs/reference/https/openlitespeed.md index bf270be806..a1997e82cc 100644 --- a/docs/reference/https/openlitespeed.md +++ b/docs/reference/https/openlitespeed.md @@ -52,7 +52,7 @@ networks: ### Configure the OLS proxy container -1. Download the repository and enter its directory: +#### Step 1. Download the repository and enter its directory: Clone the [OpenLiteSpeed proxy Docker Compose project](https://github.com/litespeedtech/ols-proxy-docker-env) and create its environment file: @@ -62,7 +62,7 @@ cd ols-proxy-docker-env cp .env.example .env ``` -2. Open `.env` in a text editor and configure the deployment: +#### Step 2. Open `.env` in a text editor and configure the deployment: Edit `.env` and set these values. Use your own domain and an email address for certificate notices: @@ -87,7 +87,7 @@ ACME_EMAIL=admin@example.com | `ACME_EMAIL` | Email address used for ACME certificate registration and notifications. | -3. Start OpenLiteSpeed: +#### Step 3. Start OpenLiteSpeed proxy ```bash docker compose up -d From 8d63235eb118c15b76831b182077f5b533fbb67f Mon Sep 17 00:00:00 2001 From: Code-Egg Date: Thu, 8 Oct 2026 21:55:52 +0800 Subject: [PATCH 6/7] modified: docs/reference/https/openlitespeed.md --- docs/reference/https/openlitespeed.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/reference/https/openlitespeed.md b/docs/reference/https/openlitespeed.md index a1997e82cc..2c7ec80212 100644 --- a/docs/reference/https/openlitespeed.md +++ b/docs/reference/https/openlitespeed.md @@ -5,7 +5,7 @@ title: "HTTPS using OpenLiteSpeed" # HTTPS Using OpenLiteSpeed -OpenLiteSpeed (OLS) can serve Open WebUI over HTTPS and forward requests to the application running on your server or in Docker. This guide covers running the openlitespeed as a reverse proxy, auto apply SSL and enable security features in Docker Compose. +OpenLiteSpeed (OLS) can serve Open WebUI over HTTPS and forward requests to the application running on your server or in Docker. This guide covers running OpenLiteSpeed as a reverse proxy, automatically apply SSL certificates, and enabling security features with Docker Compose. ## Prerequisites @@ -21,7 +21,7 @@ The OpenLiteSpeed proxy container and Open WebUI container must share a Docker n ### Create the shared network -Create the external network once: +Create the external network (once): ```bash docker network inspect ls-net >/dev/null 2>&1 || docker network create ls-net @@ -87,7 +87,7 @@ ACME_EMAIL=admin@example.com | `ACME_EMAIL` | Email address used for ACME certificate registration and notifications. | -#### Step 3. Start OpenLiteSpeed proxy +#### Step 3. Start the OpenLiteSpeed proxy ```bash docker compose up -d @@ -102,9 +102,9 @@ After verification, make sure the backend port is not reachable from the public ## Optional security settings -OpenLiteSpeed docker also offers features such as OWASP protection, CAPTCHA, per-client throttling, access control, realms, and security headers. Configure these through the proxy environment file or the WebAdmin Console as appropriate for your setup. Test each setting with Open WebUI before enabling it in production, since some rules can interfere with legitimate application requests. +The OpenLiteSpeed Docker setup also offers features such as OWASP protection, CAPTCHA, per-client throttling, access control, realms, and security headers. Configure these through the proxy environment file or the WebAdmin Console as appropriate for your setup. Test each setting with Open WebUI before enabling it in production, since some rules can interfere with legitimate application requests. -Example default security config settings in the .env file +Example default security settings in the `.env` file ``` ### Global security controls. These apply to every mapped domain and cannot be set in domains.conf. THROTTLING=false From 3dd0ee384cd1520ed813f55a6e96df9ff54be6cc Mon Sep 17 00:00:00 2001 From: Code-Egg Date: Sat, 10 Oct 2026 11:33:19 +0800 Subject: [PATCH 7/7] modified: docs/reference/https/index.md --- docs/reference/https/index.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/reference/https/index.md b/docs/reference/https/index.md index d4dc3a1808..ea00ebdf58 100644 --- a/docs/reference/https/index.md +++ b/docs/reference/https/index.md @@ -26,8 +26,7 @@ Modern browsers block microphone access on non-HTTPS origins. **Voice Calls will | [**Caddy**](/reference/https/caddy) | Self-hosted production, minimal config | Automatic (Let's Encrypt) | | [**HAProxy**](/reference/https/haproxy) | High-availability / load balancing | Manual or Let's Encrypt | | **Cloud load balancers** | AWS ALB, GCP LB, Azure App Gateway | Managed by cloud provider | -| [**OpenLiteSpeed**](/reference/https/openlitespeed) | Self-hosted production, minimal configuration, comprehensive security features - | Automatic (Let's Encrypt) | +| [**OpenLiteSpeed**](/reference/https/openlitespeed) | Self-hosted production, minimal configuration, comprehensive security features | Automatic (Let's Encrypt) | ---