Configuration¶
This page shows where Open WebUI's settings and data live, how to change the container's environment safely, and how to give your team access.
Where configuration lives¶
| Path | What it is |
|---|---|
/etc/open-webui/webui.env |
Environment for the container, written on first boot. Holds the session secret. root:root, mode 0600. |
/var/lib/open-webui |
Open WebUI's data: users, chats and settings. Mounted into the container at /app/backend/data. Owned by the container user, UID and GID 10001, mode 0700. |
/opt/sushi/bin/open-webui-run.sh |
The script open-webui.service runs to start the container. |
/usr/share/doc/open-webui/LICENSE |
The Open WebUI License. |
Most settings, including model connections and users, are made in the UI and
stored in /var/lib/open-webui. First boot writes webui.env only if it is
missing or empty, so your edits are kept across reboots.
The environment file¶
First boot creates /etc/open-webui/webui.env with these settings:
| Variable | Value | Effect |
|---|---|---|
WEBUI_SECRET_KEY |
A random value for this instance | Signs login sessions. |
ENABLE_OLLAMA_API |
False |
Turns off the Ollama connection, since Ollama is not installed. |
HF_HUB_OFFLINE, TRANSFORMERS_OFFLINE |
1 |
Stops downloads from the Hugging Face hub. |
SCARF_NO_ANALYTICS, DO_NOT_TRACK |
true |
Opt out of analytics. |
ANONYMIZED_TELEMETRY |
false |
Opts out of telemetry. |
To add or change a setting, edit the file as root, then restart the
service:
Keep the file root:root with mode 0600. The start script checks this and
refuses to start the container otherwise. See the
Open WebUI documentation for the variables it
supports.
Keep the session secret
Do not remove or change WEBUI_SECRET_KEY unless you mean to sign out
every user. Never paste it into tickets, chat or recordings.
Model connections¶
Add and manage OpenAI-compatible connections in the Admin Panel: the base URL, the API key and the model IDs to offer. You can point Open WebUI at a hosted provider or at a gateway you run, such as an LLM proxy on another instance. The instance needs outbound HTTPS to reach it.
Do not put provider keys in EC2 user data.
Users¶
The first account becomes the administrator. Manage other users, their roles and sign-up settings in the Admin Panel.
Give your team access¶
By design, Open WebUI publishes port 8080 on 127.0.0.1 only. For your own
access, use Session Manager port forwarding, as in
Getting started.
To serve a team, keep the container on loopback and put a reverse proxy with TLS in front of it on the same instance, then open only the proxy's port in the security group, restricted to your users' address ranges. Create the admin account before you open any network access.
Open WebUI's license includes branding conditions for larger deployments.
Read /usr/share/doc/open-webui/LICENSE before you roll it out widely.
Last updated October 13, 2026 · Suggest an improvement