for the owner · written for your network, your IPs

OPENWEBUI INTEGRATION

One thing to know first: this page uses <BOX-IP> as a placeholder for this machine's address on your network. The build was done on a different network; when the machine comes to you, find its address once with:

ip -br addr show enp191s0     # run on the box — note the inet address

Assign it whatever static IP you want on your network (your router's static-lease or the box's NetworkManager — nmtui works). Then replace every <BOX-IP> below with it. Also note: the box runs Tailscale and it stays on the machine — the builder keeps admin access over the tailnet (no root on the box; key-auth SSH only). Your OpenWebUI connection below works over your LAN either way.

1. Install OpenWebUI (on any machine on your network)

Two supported routes — pick one:

Option A: Docker (recommended, simplest upgrades)

docker run -d -p 3000:8080 \
  -v open-webui:/app/backend/data \
  --name open-webui --restart always \
  ghcr.io/open-webui/open-webui:main

Then browse to http://<openwebui-machine>:3000 and create your admin account (first login is the admin).

Option B: Python (no Docker)

pip install open-webui
open-webui serve   # serves on port 8080 of that machine

2. Connect it to this box

In OpenWebUI: Settings → Admin Settings → Connections → OpenAI API:

Click save — all six chat models appear in the model picker: qwen38-27b (fast daily driver, vision, tools) · flashnext-iq1s and flashnext-fp4 (176B MoE) · glm53-flash (313B deep reasoning) · dsv4-flash (284B, 1M context) · llama-3.3-70b.

Context lengths are pre-set to each model's maximum (262K–1M tokens) — no per-model tuning needed on your side.

3. Documents / RAG (his files, his machine)

OpenWebUI has built-in RAG: Workspace → Documents — upload PDFs/notes, they become queryable knowledge in chat via the # mention.

For best retrieval quality, point its embedding model at this box: Admin Settings → Documents → embedding model engine openai, URL http://<BOX-IP>:8081/v1, model embed. Optionally set the reranker: http://<BOX-IP>:18190/v1/rerank (BGE reranker, runs on this box's CPU).

4. Image generation (ComfyUI on this box)

ComfyUI runs on this box at port 8188 (models staged: Qwen-Image, Z-Image-Turbo, uncensored picks). In OpenWebUI: Admin Settings → Images → engine ComfyUI, base URL http://<BOX-IP>:8188. Then image generation works from any chat via the image button. Note: image models load into the same 128G pool as the LLMs — if the pool is busy with a large language model, ComfyUI may need it swapped out first (the box manages this; generation just takes longer when models swap).

5. Tool calling

Verified working on this endpoint for: qwen38-27b, flashnext-iq1s, flashnext-fp4, dsv4-flash, llama-3.3-70b. GLM-5.3-Flash works with a template fix already applied on the box.

OpenWebUI's built-in tools (web search, code execution via Jupyter, custom function tools) all pass through the OpenAI tool schema — define them in Workspace → Tools and they work with the models above.

6. Memory + grounding (the gateway)

The gateway service on this box layers persistent memory (mem0 + Qdrant), tracing, and a server-side persona on top of every model — for every client, not just OpenWebUI. Status: INSTALLED + verified 2026-09-11 — use http://<BOX-IP>:8081/v1 as the connection URL; everything else stays the same. The raw lane :8080/v1 also works but skips memory/tracing (admin/benchmark use only). API key required on both.

7. Web search

Already working out of the box (builder's instance, Sept 2026): web search is enabled with the DuckDuckGo engine — no API key, no extra install. In a chat, click the ＋ (plus) → Web Search toggle (or enable it per-chat from the input bar) and the model's answers get grounded with live results. OpenWebUI does the searching itself and injects results — this works with every model on the box, including ones that are shaky at tool-calling.

Recommended upgrades, in order of effort:

Agent-side search (MCP): the endpoint itself also carries two MCP web tools (web-search via DuckDuckGo + web-fetch) registered on the qwen38-27b and glm53-flash entries — agents using the raw OpenAI tool-calling API can call them. Note (honest caveat): llama.cpp's MCP layer is experimental — tool registration is verified, but structured tool_calls emission varies by model (Qwen3.8 tends to emit the call JSON as plain content). Harnesses that parse leniently handle it; OpenWebUI's own web search (above) does not depend on it at all.

8. Firewall note (for your network)

This box ships with a restrictive firewall: only SSH (22) plus the AI ports (8080, 8081, 8188, 9621, 18190) are relevant, and the AI ports are scoped to the build network's range. On your network, allow your subnet once:

sudo firewall-cmd --permanent --zone=public \
  --add-rich-rule='rule family="ipv4" source address=<YOUR-SUBNET> accept'
sudo firewall-cmd --reload

Replace <YOUR-SUBNET> with your network (e.g. 192.168.1.0/24). Or scope it tighter to just the ports, same pattern as the shipped rules.

Troubleshooting