> ## Documentation Index
> Fetch the complete documentation index at: https://controlplanecorporation-majid-docs-content-expansion.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Open WebUI

> Deploy Open WebUI on Control Plane using the Template Catalog. Self-hosted, ChatGPT-style chat interface for LLMs, backed by an in-GVC Ollama server and any OpenAI-compatible API, with users, RAG, and model management on a persistent volume. Private by default — you claim the admin account before publishing the UI.

## Overview

Open WebUI is a self-hosted, ChatGPT-style chat interface for large language models with user accounts, RAG (chat grounded in your uploaded documents), and model management. This template deploys a single stateful workload that keeps all of its state on a persistent volume and connects to your models through an in-GVC [Ollama](/template-catalog/templates/ollama) server and/or any OpenAI-compatible endpoint.

The install is **private by default**: `publicAccess.enabled` is `false` and self-registration is closed, because the first account registered on a fresh install becomes the administrator. You reach the UI over a port-forward, claim that admin account, and then opt in to publishing it — see [First Run](#first-run).

### Architecture

* **Open WebUI** — A single-replica stateful workload serving the web UI and API on port `8080`. A mounted start script sets its public `WEBUI_URL` from the canonical endpoint at boot, so links resolve correctly with no manual configuration.
* **Embedded SQLite on a persistent volume** — All durable state (the `webui.db` database, uploaded files, the default Chroma vector store used for RAG, and cache) lives on the workload's volume set at `/app/backend/data`. SQLite is single-writer, so there is no external database dependency and the workload runs as exactly one replica.
* **Model backends** — Chat completions are served by an existing Ollama workload in the same GVC (default), an OpenAI-compatible API (optional), or both. Neither backend is bundled by this template — you point it at model providers you run or subscribe to.
* **No template-created credential** — The key that signs sessions and JWTs lives only in a secret you create yourself, so it never enters the Helm release.

### What Gets Created

* **Stateful Open WebUI Workload** — A single replica serving the web UI and API on port `8080`.
* **Volume Set** — A 10 GiB persistent volume mounted at `/app/backend/data` holding the SQLite database, uploaded files, the RAG vector store, and cache. Scheduled snapshots protect the data, and a final snapshot is kept on delete.
* **Start-Script Secret** — An opaque secret whose boot script sets `WEBUI_URL` from the canonical endpoint.
* **Identity & Policy** — An identity bound to the workload with a least-privilege policy granting `reveal` access to exactly the secrets it mounts: your session-key secret, the start-script secret, and your OpenAI-key secret only when you configure one.

<Note>
  This template does not create a GVC. You must deploy it into an existing GVC.
</Note>

## Prerequisites

**One [opaque secret](/guides/create-secret/opaque) must exist before you install.** The key that signs every session and JWT is a long-lived credential, so it is not a value — a value would sit in the Helm release for the life of the install.

<Steps>
  <Step title="Create the session signing key secret">
    Generate a random key and store it as the secret's payload:

    ```bash theme={null}
    printf '%s' "$(openssl rand -base64 32)" | cpln secret create-opaque --name my-openwebui-secret-key --encoding plain -f -
    ```

    Set `auth.secretKeyName` to the name you used.
  </Step>

  <Step title="Keep it forever">
    Back the key up somewhere safe outside Control Plane. It is never rotated: replacing it invalidates every issued session and JWT, logging every user out.
  </Step>
</Steps>

<Warning>
  **A missing prerequisite secret wedges the install rather than failing it.** `cpln helm install` still exits 0 and reports success, but the workload never starts: it sits at zero replicas with the message `The secret <name> no longer exists. Workload updates are paused until the secret is added or the reference to the secret removed.` Create the secret first, and after installing confirm with `cpln workload get-deployments {release}-open-webui --gvc {gvc}` rather than trusting the Helm output.
</Warning>

These are optional and only needed for the corresponding feature:

| Feature                            | What you must create first                                                                                                                                               |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Ollama models (enabled by default) | An existing [Ollama](/template-catalog/templates/ollama) workload in the same GVC. Set its workload name in `ollama.workloadName`                                        |
| OpenAI-compatible backend          | An [opaque secret](/guides/create-secret/opaque) with encoding `plain` holding your API key, named in `openai.apiKeySecretName`. Empty (default) leaves this backend off |
| Custom domain                      | A Control Plane [domain](/guides/configure-domain) and its DNS records. `customDomain` alone does not create one — see [Access](#access)                                 |

**License awareness** — Open WebUI ships under the "Open WebUI License" (BSD-3-Clause plus a branding-protection clause). It is free to self-host and run in production at any scale, but you must keep the "Open WebUI" branding visible in the UI **unless** your deployment serves 50 or fewer users, or you obtain enterprise permission. See [Important Notes](#important-notes).

Once the secret exists, install the template using your preferred method:

<CardGroup cols={2}>
  <Card title="UI" href="/template-catalog/install-manage/ui" icon="laptop">
    Browse, install, and manage templates visually
  </Card>

  <Card title="CLI" href="/template-catalog/install-manage/cli" icon="terminal">
    Manage templates from your terminal
  </Card>

  <Card title="Terraform" href="/template-catalog/install-manage/terraform" icon={<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128"><g fill-rule="evenodd"><path d="M77.941 44.5v36.836L46.324 62.918V26.082zm0 0" fill="#5c4ee5"/><path d="M81.41 81.336l31.633-18.418V26.082L81.41 44.5zm0 0" fill="#4040b2"/><path d="M11.242 42.36L42.86 60.776V23.941L11.242 5.523zm0 0M77.941 85.375L46.324 66.957v36.82l31.617 18.418zm0 0" fill="#5c4ee5"/></g></svg>}>
    Declare templates in your Terraform configurations
  </Card>

  <Card
    title="Pulumi"
    href="/template-catalog/install-manage/pulumi"
    icon={<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" id="Pulumi-Icon--Streamline-Svg-Logos" height="24" width="24">
    <desc>
        Pulumi Icon Streamline Icon: https://streamlinehq.com
    </desc>
    <path fill="#f26e7e" d="M4.683025 13.3318c0.869125 -0.5018 0.870575 -2.1264 0.003225 -3.62865s-2.27504 -2.313275 -3.1441725 -1.811475C0.672945 8.3935 0.6715 10.0181 1.53885 11.52035c0.86735 1.502275 2.27505 2.313275 3.144175 1.81145Zm0.0052 3.2167c0.86735 1.502275 0.865925 3.126875 -0.003225 3.628675 -0.86915 0.5018 -2.2768275 -0.309225 -3.144175 -1.81145 -0.8673525 -1.50225 -0.8659075 -3.126875 0.003225 -3.628675 0.8691325 -0.5018 2.276825 0.309225 3.144175 1.81145Zm5.922875 3.4243c0.86735 1.50225 0.8659 3.126775 -0.003225 3.62875 -0.869125 0.501775 -2.27685 -0.309325 -3.1442 -1.81155 -0.867325 -1.50225 -0.865875 -3.12685 0.00325 -3.628675 0.869125 -0.5018 2.276825 0.309225 3.144175 1.811475Zm-0.001925 -6.845275c0.86735 1.50225 0.8659 3.12685 -0.003225 3.628675 -0.869125 0.5018 -2.276825 -0.309225 -3.144175 -1.811475 -0.86735 -1.50225 -0.8659 -3.12685 0.003225 -3.62865 0.869125 -0.501825 2.276825 0.3092 3.144175 1.81145Z" stroke-width="0.25"></path>
    <path fill="#8a3391" d="M22.45775 11.524125c0.86725 -1.502225 0.865925 -3.12685 -0.003225 -3.62865 -0.869125 -0.501825 -2.276825 0.3092 -3.144175 1.811475 -0.86735 1.50225 -0.8659 3.126825 0.003225 3.62865 0.869125 0.501825 2.276825 -0.3092 3.144175 -1.811475Zm0.000175 3.2151c0.869075 0.5018 0.870625 2.1264 0.003225 3.62865 -0.86735 1.50225 -2.27505 2.313275 -3.144175 1.81145 -0.869125 -0.5018 -0.870575 -2.126425 -0.003225 -3.62865 0.86735 -1.50225 2.27505 -2.313275 3.144175 -1.81145ZM16.536225 18.157875c0.86915 0.501825 0.8706 2.126425 0.00325 3.628675 -0.86735 1.502125 -2.275075 2.313225 -3.1442 1.81145 -0.869125 -0.50175 -0.870575 -2.126425 -0.003225 -3.62865 0.867375 -1.502275 2.27505 -2.3133 3.144175 -1.811475Zm-0.003325 -6.843775c0.869125 0.5018 0.870575 2.126425 0.003225 3.628675s-2.27505 2.313275 -3.1442 1.811475c-0.869125 -0.501825 -0.870575 -2.126425 -0.003225 -3.628675 0.86735 -1.502275 2.27505 -2.313275 3.1442 -1.811475Z" stroke-width="0.25"></path>
    <path fill="#f7bf2a" d="M15.138225 2.06721c0 1.003615 -1.40625 1.817215 -3.14095 1.817215 -1.7347 0 -3.14095 -0.8136 -3.14095 -1.817215C8.856325 1.06359 10.262575 0.25 11.997275 0.25c1.7347 0 3.14095 0.81359 3.14095 1.81721ZM9.2166 5.482375c0 1.003625 -1.40625 1.8172 -3.14095 1.8172 -1.7347 0 -3.14095 -0.813575 -3.14095 -1.8172s1.40625 -1.817225 3.14095 -1.817225c1.7347 0 3.14095 0.8136 3.14095 1.817225Zm8.71005 1.8172c1.7347 0 3.14095 -0.813575 3.14095 -1.8172s-1.40625 -1.817225 -3.14095 -1.817225c-1.7347 0 -3.14095 0.8136 -3.14095 1.817225s1.40625 1.8172 3.14095 1.8172Zm-2.788425 1.605625c0 1.003625 -1.40625 1.8172 -3.14095 1.8172 -1.7347 0 -3.14095 -0.813575 -3.14095 -1.8172 0 -1.0036 1.40625 -1.8172 3.14095 -1.8172 1.7347 0 3.14095 0.8136 3.14095 1.8172Z" stroke-width="0.25"></path>
    </svg>}
  >
    Declare templates in your Pulumi programs
  </Card>
</CardGroup>

## First Run

A default install is closed on every side: the canonical endpoint returns `403` to the internet, and `internalAccess.type: none` blocks other workloads in the GVC. Claim the admin account through a port-forward first, then publish the UI.

<Steps>
  <Step title="Install with the defaults">
    Install with `auth.secretKeyName` pointing at the secret you created, and leave `publicAccess.enabled: false` and `auth.enableSignup: false` alone. Wait for the workload to report ready:

    ```bash theme={null}
    cpln workload get-deployments {release}-open-webui --gvc {gvc}
    ```
  </Step>

  <Step title="Register the admin account over a port-forward">
    Forward the UI to your own machine:

    ```bash theme={null}
    cpln port-forward {release}-open-webui 8080:8080 --gvc {gvc}
    ```

    Then open `http://localhost:8080`, which shows Open WebUI's "create admin account" screen. Port forwarding reaches the workload even though it is closed to both the internet and the GVC, and the account you create there is the administrator.

    If you would rather not leave the terminal, the same registration works over the container's own loopback address:

    ```bash theme={null}
    cpln workload exec {release}-open-webui --gvc {gvc} --container open-webui -- \
      curl -sS -X POST http://localhost:8080/api/v1/auths/signup \
      -H 'Content-Type: application/json' \
      -d '{"name":"Admin","email":"admin@example.com","password":"YOUR-STRONG-PASSWORD"}'
    ```

    The response carries `"role":"admin"`. A second registration attempt returns `403`, because only the first account is exempt from `auth.enableSignup: false`.
  </Step>

  <Step title="Publish the UI">
    Now that the admin account is claimed, upgrade the release with `publicAccess.enabled: true` and sign in at the canonical endpoint. Allow up to a couple of minutes for the firewall change to take effect — a measured toggle moved through `403` → `503` → `200` over about 143 seconds.
  </Step>
</Steps>

<Warning>
  **Do not plan to close sign-ups later with an upgrade — it does nothing.** `auth.enableSignup` is read only while no account exists. Creating the first account writes the setting into `webui.db`, and from then on the stored value wins over the environment: an upgrade can neither open nor close self-registration. Add users, or re-open self-service sign-ups, from **Admin Settings → Users** in the UI.
</Warning>

## Configuration

The default `values.yaml` for this template:

```yaml theme={null}
# ─── Image & Resources ────────────────────────────────────────────────────────
image: ghcr.io/open-webui/open-webui:v0.11.0

resources:
  cpu: 1        # max vCPU
  memory: 2Gi   # max memory (RAG loads a local embedding model into RAM on first use)
  minCpu: 500m
  minMemory: 1Gi

# ─── Persistence ──────────────────────────────────────────────────────────────
# One per-replica volume holds everything durable: SQLite webui.db, uploaded
# files, the default Chroma vector store (RAG), and cache. Mounts /app/backend/data.
volumeset:
  capacity: 10 # GiB (platform minimum 10)

# ─── Backup ───────────────────────────────────────────────────────────────────
# Platform-managed crash-consistent snapshots (no cloud account/bucket needed).
# SQLite recovers cleanly from a snapshot. A final snapshot is taken on uninstall.
backup:
  enabled: true
  schedule: "0 3 * * *" # cron in UTC — daily 03:00 (hourly is the platform max)
  retention: 7d         # how long each snapshot is kept (e.g. 7d, 720h, 30d)

# ─── Authentication ───────────────────────────────────────────────────────────
auth:
  # REQUIRED opaque secret (encoding: plain) holding the session/JWT signing key.
  # It must EXIST BEFORE INSTALL — the deployment wedges waiting on it otherwise —
  # and must stay the same forever: replacing it logs every user out.
  # Create it with: printf '%s' "$(openssl rand -base64 32)" | cpln secret create-opaque --name my-openwebui-secret-key --encoding plain -f -
  secretKeyName: my-openwebui-secret-key
  # false = nobody can create their own account. The FIRST account is exempt, so
  # you can still register the admin on a fresh install (see the README first-run
  # steps); invite everyone else from Admin Settings → Users.
  enableSignup: false

# ─── Model backends ───────────────────────────────────────────────────────────
# Point at an existing `ollama` template deployment in this same GVC.
ollama:
  enabled: true
  workloadName: ollama # the ollama workload's name in this GVC
  port: 11434
  # → OLLAMA_BASE_URL = http://{workloadName}.{gvc}.cpln.local:{port}

# Optional OpenAI-compatible provider. The API key is a PREREQUISITE opaque
# secret (encoding: plain) you create BEFORE install; reference it by name here.
# Empty apiKeySecretName = this backend is off.
openai:
  baseUrl: https://api.openai.com/v1 # any OpenAI-compatible endpoint
  apiKeySecretName: "" # e.g. my-openwebui-openai-key ; empty = OpenAI backend off

# ─── Access ───────────────────────────────────────────────────────────────────
# Sets WEBUI_URL only — it does NOT create a cpln domain. Create and verify the
# domain separately, or the hostname will not resolve. Read at FIRST BOOT ONLY
# (see Important Notes); set it at install, not in a later upgrade.
customDomain: "" # full URL, e.g. https://chat.example.com ; empty = canonical *.cpln.app

publicAccess:
  # false = not reachable from the internet. Turning this on publishes the chat
  # UI, and its sign-in/sign-up form, to the whole internet — so register your
  # admin account FIRST (see the README first-run steps), then turn it on.
  enabled: false

internalAccess: # inbound firewall scope for in-GVC callers of the Open WebUI API
  type: none # options: none, same-gvc, same-org, workload-list
  workloads: [] # used with workload-list
  # workloads:
  #   - //gvc/GVC_NAME/workload/WORKLOAD_NAME
```

### Instance & Resources

* `image` — The Open WebUI container image.
* `resources` — CPU and memory for the container. RAG loads a local embedding model into RAM on first use, so keep memory at or above the default.
* `volumeset.capacity` — Volume size in GiB (minimum 10) for the SQLite database, uploads, RAG vector store, and cache.

### Backup

Scheduled, crash-consistent snapshots of the data volume, managed by the platform — no cloud account or bucket is required. See [Backing Up](#backing-up) for how snapshots work and [Restoring a Backup](#restoring-a-backup) for the manual restore procedure.

* `backup.enabled` — Take periodic snapshots of the data volume (default `true`).
* `backup.schedule` — Cron expression in UTC (default `0 3 * * *`, daily at 03:00). The platform does not accept schedules more frequent than hourly.
* `backup.retention` — How long each snapshot is kept, e.g. `7d`, `720h`, `30d`.

### Authentication

* `auth.secretKeyName` — Name of the opaque secret holding the session and JWT signing key. It must exist **before** you install (see [Prerequisites](#prerequisites)) and must never change afterward.
* `auth.enableSignup` — Whether users can create their own accounts (default `false`). The **first** account on a fresh install is exempt, so a default install is still usable — that is how you create the admin in [First Run](#first-run).

<Warning>
  `auth.enableSignup` only has an effect while no account exists. Once the first account is created the value is stored in `webui.db` and the stored setting wins permanently, so changing this knob in a later `helm upgrade` has no effect in either direction. Manage users and self-registration from **Admin Settings → Users**.
</Warning>

### Model Backends

At least one backend is needed to actually chat. The Ollama backend is on by default; the OpenAI-compatible backend is off until you supply a key secret. You can enable both.

* `ollama.enabled` — Connect to an existing Ollama workload in this GVC (default `true`).
* `ollama.workloadName` — The Ollama workload's name in this GVC. The base URL is derived as `http://{workloadName}.{gvc}.cpln.local:{port}`.
* `ollama.port` — The Ollama API port (default `11434`).
* `openai.baseUrl` — Any OpenAI-compatible endpoint (default `https://api.openai.com/v1`). The workload's outbound firewall is open, so hosted providers such as `api.openai.com` are reachable.
* `openai.apiKeySecretName` — Name of your pre-created opaque secret holding the API key (see [Prerequisites](#prerequisites)). Empty (default) leaves the OpenAI backend off, and the policy grants no access to any key secret.

<Warning>
  **Backend settings apply on the first boot only, and a later change fails silently.** `ollama.*`, `openai.*` and `customDomain` are read from the environment the first time the workload starts and are then stored in `webui.db`; a later `helm upgrade` is ignored. The danger is that nothing looks wrong — the **original backend keeps working**, so a user who "retargets" their model provider by upgrade sees the upgrade succeed and keeps talking to the old provider. Set these at install, and change model connections afterward from the admin UI under **Settings → Connections**.
</Warning>

### Access

* `customDomain` — Full URL of a custom domain, e.g. `https://chat.example.com`. The scheme is required; the chart fails the render without it. Empty (default) uses the canonical `*.cpln.app` endpoint.
* `publicAccess.enabled` — Serve the UI over public HTTPS on the canonical `*.cpln.app` endpoint (default `false`). While it is off, external requests are rejected at the edge with `403` and only in-GVC callers reach the workload, per `internalAccess`.
* `internalAccess.type` — Internal firewall scope for in-GVC callers of the Open WebUI API:

| Type            | Description                                                            |
| --------------- | ---------------------------------------------------------------------- |
| `none`          | No internal access (default).                                          |
| `same-gvc`      | Allow access from all workloads in the same GVC.                       |
| `same-org`      | Allow access from all workloads in the same organization.              |
| `workload-list` | Allow access only from workloads listed in `internalAccess.workloads`. |

<Warning>
  **`customDomain` sets `WEBUI_URL` and nothing else.** It does not create a Control Plane [domain](/guides/configure-domain), and the install succeeds with no error or warning if none exists — the hostname simply never resolves, and the canonical endpoint remains the only way in. Create and verify the domain separately. Because it is also frozen after the first boot, set it at install rather than adding it to a running release.
</Warning>

An access change takes effect at the edge after a short propagation delay — allow up to a couple of minutes before concluding a firewall knob did not work.

## Connecting

| What                                | Value                                                                                                                                     |
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| Web UI (public)                     | `https://<canonical>.cpln.app` — only with `publicAccess.enabled: true`; read `status.canonicalEndpoint` of `{release}-open-webui`        |
| From your machine, no public access | `cpln port-forward {release}-open-webui 8080:8080 --gvc {gvc}`, then `http://localhost:8080` — works regardless of both firewall settings |
| Internal API                        | `http://{release}-open-webui.{gvc}.cpln.local:8080` — only when `internalAccess.type` allows the caller                                   |
| Ollama backend                      | `http://{ollama.workloadName}.{gvc}.cpln.local:11434` (the existing Ollama workload)                                                      |
| Login                               | The account you register at first run — the first registration becomes the admin                                                          |
| Session signing key                 | The payload of your `auth.secretKeyName` secret; never in the Helm release                                                                |

### Using a Model Backend

Deploy the [Ollama](/template-catalog/templates/ollama) template into the same GVC and pull at least one model, then install Open WebUI with `ollama.workloadName` set to that workload's name — its models appear in the model picker automatically. To use a hosted provider instead, create the API-key secret (see [Prerequisites](#prerequisites)), set `openai.apiKeySecretName`, and Open WebUI lists that provider's models.

If a configured Ollama backend is unreachable the UI still boots and simply shows no Ollama models — an empty model list is the symptom of a wrong `ollama.workloadName`. Confirm it names a `ready` Ollama workload in the same GVC.

## Backing Up

Backups are **scheduled volume snapshots** managed by the platform — no cloud account or bucket is required. On the configured cron schedule the platform takes a crash-consistent snapshot of the data volume; SQLite recovers cleanly from one. Snapshots are pruned automatically after `backup.retention`, and a final snapshot is always taken when the release is uninstalled.

* **Default schedule** — Daily at 03:00 UTC (`backup.schedule: "0 3 * * *"`), kept for 7 days (`backup.retention: 7d`).
* **Minimum interval** — The platform does not accept schedules more frequent than hourly.

List the snapshots for the release's volume set:

```bash theme={null}
cpln volumeset snapshot get {release}-open-webui-data --gvc {gvc} -o yaml
```

<Note>
  Snapshots live in the platform storage layer alongside the volume, not off-site. They protect against data corruption and accidental changes, but losing the whole GVC would lose them too.
</Note>

## Restoring a Backup

**There is no automated restore.** `backup.enabled` only takes snapshots; recovering from one is a manual, deliberate operation you run yourself. Restore is **in-place** on the release's own volume set: the platform provisions a fresh volume from the chosen snapshot and swaps it in, then the workload restarts to remount it.

<Warning>
  Restoring reverts the volume to the exact snapshot state, so **everything written after the snapshot is gone — including user accounts**. A user who registered after the snapshot was taken can no longer sign in. It also restarts the single-replica workload, so the UI is unavailable during the swap.
</Warning>

<Steps>
  <Step title="Find the snapshot to restore">
    List snapshots and note the `name`, `location`, and `volumeIndex` of the one you want:

    ```bash theme={null}
    cpln volumeset snapshot get {release}-open-webui-data --gvc {gvc} -o yaml
    ```
  </Step>

  <Step title="Restore it in place">
    Provision a fresh volume from the snapshot and swap it in. The workload restarts to remount it:

    ```bash theme={null}
    cpln volumeset snapshot restore {release}-open-webui-data \
      --snapshot-name <snapshot-name> \
      --location <location> \
      --volume-index 0 \
      --gvc {gvc}
    ```

    A measured restore took about 2.5 minutes end to end, of which roughly 40 seconds was workload downtime.
  </Step>

  <Step title="Verify">
    Once the workload is ready again, sign in and confirm your chats and settings are present.
  </Step>
</Steps>

## Important Notes

* **Create the session-key secret before installing, and never change it.** `auth.secretKeyName` only names the secret; the workload wedges waiting on one that does not exist. The key signs every session and JWT, so replacing it logs every user out.
* **The first account registered becomes the administrator.** That is why the UI ships private with sign-ups closed — an unclaimed admin account on a public URL belongs to whoever finds it first. Claim it over a port-forward before turning `publicAccess.enabled` on; see [First Run](#first-run).
* **`auth.enableSignup` is only read while no account exists.** After the first account it is stored in `webui.db` and the stored value wins, so a later `helm upgrade` can neither open nor close sign-ups. Use **Admin Settings → Users** instead.
* **`ollama.*`, `openai.*` and `customDomain` apply at install, then persist in the app database.** A later `helm upgrade` is ignored and the old backend keeps working, so there is no symptom to warn you. Change model connections from the admin UI under **Settings → Connections**.
* **`customDomain` does not create a domain.** It sets `WEBUI_URL` only; create the Control Plane domain and its DNS separately, or the hostname will not resolve while the install reports success.
* **Restoring a snapshot is manual and loses post-snapshot data**, including accounts created after it was taken. See [Restoring a Backup](#restoring-a-backup).
* **Single replica, by design.** The embedded SQLite is single-writer and the volume set is per-replica, so the workload is pinned to one replica with no `replicas` knob. A restart or upgrade is a brief full outage of about a minute — including the first `helm upgrade` after an install, which re-applies the workload even when nothing changed.
* **Data lives only on the volume set.** Uninstall deletes it (a final snapshot is taken first); a reinstall starts empty, including the admin account. Your own prerequisite secrets are not deleted, since the chart does not own them.
* **Ollama unreachable is non-fatal.** The UI boots and shows no Ollama models rather than failing, so check the model list after install.
* **License / branding clause** — You must keep the "Open WebUI" branding visible in the UI **unless** your deployment serves 50 or fewer users, or you have enterprise permission. Removing the branding outside those cases violates the license; it is not a template setting.

## External References

<CardGroup cols={2}>
  <Card title="Open WebUI on GitHub" icon="github" href="https://github.com/open-webui/open-webui">
    Upstream source repository
  </Card>

  <Card title="Open WebUI Documentation" icon="book" href="https://docs.openwebui.com/">
    Official documentation and getting-started guides
  </Card>

  <Card title="Environment Variable Reference" icon="gear" href="https://docs.openwebui.com/reference/env-configuration/">
    Full list of supported configuration variables
  </Card>

  <Card title="License" icon="scale-balanced" href="https://github.com/open-webui/open-webui/blob/main/LICENSE">
    The Open WebUI License and its branding clause
  </Card>

  <Card title="Ollama Template" icon="server" href="/template-catalog/templates/ollama">
    Deploy the in-GVC Ollama model backend
  </Card>

  <Card title="Open WebUI Template" icon="github" href="https://github.com/controlplane-com/templates/tree/main/open-webui">
    View the source files, default values, and chart definition
  </Card>
</CardGroup>