Self-host Open WebUI with a public URL

This deploys Open WebUI as a Docker Compose app and gives it a public HTTPS endpoint via Nethera, see /docs for the full introduction to how that works.

Why Open WebUI

Open WebUI on its own only runs where you start it. Left on a home machine, it's reachable on your local network and nowhere else, which means no access from your phone, no access while traveling, and no access without VPNing back into your own house. Getting past that normally means port forwarding, dynamic DNS, or a reverse proxy you maintain yourself. Deploying it through Nethera skips that setup and gives you a stable public URL for the same instance, so the chat interface you've configured, and the history in it, is usable from anywhere without exposing your home network directly to the internet.

Requirements

• Nethera CLI installed
• A machine running nethera agent

See /docs/quickstart for setup of both.

nethera.yml

appName: open-webui
services:
  web:
    image: ghcr.io/open-webui/open-webui:main
    volumes:
      - open-webui:/app/backend/data
    nethera:
      public: 8080       # exposes this service's port 8080 as a public HTTPS endpoint
      auth: login         # protects first admin signup behind Nethera login
volumes:
  open-webui:

Deploy

$neth init
$neth deploy

Open and verify

Open the HTTPS endpoint printed by neth deploy. Nethera will require login before Open WebUI loads. Create the first Open WebUI account immediately; that account becomes the admin.

Lock down normal use

After the first admin account exists, change the service's Nethera auth to none if you want Open WebUI's own accounts to be the only access layer:

nethera:
  public: 8080
  auth: none

Then redeploy:

$neth deploy

Data and config notes

• The open-webui volume holds everything under /app/backend/data, including chat history, user accounts, and settings. It persists across redeploys as long as the volume isn't renamed or removed.
• Open WebUI's first created account becomes the admin account. This recipe keeps that first signup behind Nethera login.
• This deploy doesn't include a model backend. Open WebUI needs something to talk to (Ollama, an OpenAI-compatible API, etc.), which you connect after logging in under Settings > Connections.

Troubleshooting

• Chat screen loads but nothing responds / no models listed: no model backend is connected yet. Add one under Settings > Connections.
• Someone else's account shows up as admin: during the initial setup phase, auth: login should prevent this unless someone else has access to your Nethera account/team. If it happens, reset the open-webui volume before storing real data.
• Data missing after a redeploy: check that the volume name in your nethera.yml wasn't changed between deploys, Compose treats a renamed volume as a new one.

FAQ

Can I use my self-hosted Open WebUI from outside my home network, like on my phone? Yes. The public: 8080 field gives the service a stable HTTPS URL independent of your home network, so it's reachable anywhere without a VPN back to the machine it's running on.

Why not just use a VPN, like Tailscale or WireGuard?

A VPN works well if it's just you, or a small group who already have a client installed. Nethera's endpoint is a normal HTTPS link instead, useful once you want to share access without asking someone to install anything. auth: login still gates who's let through if you want that.

Is this Open WebUI instance password protected? During first setup, yes: Nethera login protects the initial signup. After you switch to auth: none, Open WebUI's own account system becomes the access layer.

Do I need Ollama running for this to work? You need some LLM backend, Ollama or an OpenAI-compatible API. It's not part of this Compose file and isn't deployed for you, you add the connection inside Open WebUI after first login.

Can I redeploy or update this without SSHing into the machine?

Yes, neth deploy from your project directory redeploys in place. If you're managing more than one machine, the same command and nethera.yml work whether you're targeting one or several, see fleet management for pairing multiple machines under one workspace.

Notes

• Start with auth: login for first admin creation. Switch to auth: none only after the admin account exists.
• No model backend is bundled, the app is unusable for chat until you connect one.
• The volume covers accounts, settings, and chat history, not any external model weights or Ollama data if you run that separately.