# OpenWebUI

OpenWebUI is exposed at `https://openwebui.noxxos.nl` and connects to LiteLLM at
`http://litellm.litellm.svc.cluster.local:4000/v1`.

LiteLLM then routes requests to the OpenAI-compatible llama.cpp endpoint at
`http://framework-llm.open-webui.svc.cluster.local:8080/v1`.

## Authentik

Create an Authentik OAuth2/OIDC provider and application with slug
`open-webui`.

Allowed redirect URI:

```text
https://openwebui.noxxos.nl/oauth/oidc/callback
```

Create the OIDC client secret in Kubernetes before syncing the app:

```bash
kubectl create namespace open-webui
kubectl -n open-webui create secret generic open-webui-oidc \
  --from-literal=client-id='<authentik-client-id>' \
  --from-literal=client-secret='<authentik-client-secret>'
```

OpenWebUI also reads its OpenAI-compatible API keys from the `litellm-secrets`
Secret in the `open-webui` namespace. Keep it in sync with the `litellm`
namespace copy:

```bash
kubectl -n open-webui create secret generic litellm-secrets \
  --from-literal=openwebui-api-keys='0p3n-w3bu!;sk-<litellm-master-key>'
```