How to Self-Host Open WebUI on a VPS (2026 Guide)

To self-host Open WebUI you need a Ubuntu LTS VPS with roughly 12GB of RAM, Docker, and a domain name. You run Open WebUI as a single Docker container with a persistent volume, point it at either a local Ollama model or an OpenAI-compatible API, and put it behind an nginx reverse proxy with a Let’s Encrypt certificate. This guide walks through each step, from a fresh server to your first locked-down admin login.

Open WebUI is the de-facto standard self-hosted AI chat interface - around 140,000 GitHub stars and growing. It gives you a polished chat UI with RAG document search, web search, image generation, voice, and enterprise authentication, all running on infrastructure you control. Best of all, it does not care where the model lives: local via Ollama, or any hosted OpenAI-compatible endpoint.

What Do You Need Before You Start?

Three things: a VPS, a domain, and a model backend.

• A VPS. Any Ubuntu LTS server works. Open WebUI itself is light, but plan for 12GB or more of RAM if you want headroom, and considerably more if you intend to run local models on the same machine (more on that below).
• A domain or subdomain (for example ai.yourdomain.com) pointed at your server’s IP, so certbot can issue a real TLS certificate.
• A model backend. Either a local model served by Ollama, or an API key for any OpenAI-compatible provider. You can add both later; you only need one to get started.

Step 1: Provision and Harden the VPS

Create a Ubuntu LTS server from your provider of choice. Before installing anything, harden it. We cover this in depth in our OpenClaw security guide, and the same fundamentals apply here.

Create a non-root user, add your SSH key, and set up the firewall:

adduser deploy
usermod -aG sudo deploy
# copy your SSH key to the new user, then log back in as deploy

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH
sudo ufw allow 80/tcp    # HTTP (Let's Encrypt + redirect)
sudo ufw allow 443/tcp   # HTTPS
sudo ufw enable

Do not open a port for Open WebUI itself. The container will bind to localhost and only nginx will reach it.

Step 2: Install Docker

Open WebUI runs in Docker, so install Docker Engine. The official convenience script is the quickest path on a fresh Ubuntu box:

curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER
# log out and back in so the group change takes effect
docker run hello-world

If hello-world prints its welcome message, Docker is ready.

Step 3: Run the Open WebUI Container

Now start Open WebUI. The key details are a persistent named volume so your data survives upgrades, and binding to 127.0.0.1 so the container is not exposed directly to the internet:

docker run -d \
  --name open-webui \
  -p 127.0.0.1:3000:8080 \
  -v open-webui:/app/backend/data \
  --restart unless-stopped \
  ghcr.io/open-webui/open-webui:main

A few things worth understanding:

• -p 127.0.0.1:3000:8080 maps the container’s internal port to localhost port 3000 only. Nothing outside the server can reach it yet - that is deliberate.
• -v open-webui:/app/backend/data stores all users, chats, settings, and uploaded documents in a Docker volume, so docker pull and re-run never wipe your data.
• --restart unless-stopped brings the container back after a reboot or crash.

Confirm it is running:

docker ps
curl -I http://127.0.0.1:3000

You should see the container listed and an HTTP response from localhost.

Step 4: Connect a Model Backend

Open WebUI is just the interface - it needs a model to talk to. You have two paths.

Option A: A Hosted OpenAI-Compatible API (Lightest)

The simplest and lightest setup: point Open WebUI at any OpenAI-compatible API. No model runs on your VPS, so RAM stays low. Pass the endpoint and key as environment variables when you run the container:

docker run -d \
  --name open-webui \
  -p 127.0.0.1:3000:8080 \
  -v open-webui:/app/backend/data \
  -e OPENAI_API_BASE_URL=https://api.your-provider.com/v1 \
  -e OPENAI_API_KEY=sk-your-key-here \
  --restart unless-stopped \
  ghcr.io/open-webui/open-webui:main

You can also add and edit connections later from the admin settings, so you are not locked into what you set at launch.

Option B: Local Models with Ollama (Self-Contained)

If you want fully local inference with Ollama - no external API, everything on your own hardware - install Ollama and pull a model:

curl -fsSL https://ollama.com/install.sh | sh
ollama pull llama3

Then tell Open WebUI where Ollama lives (by default http://host.docker.internal:11434, or the host IP), either via the admin settings or an OLLAMA_BASE_URL environment variable on the container.

A Note on RAM and Local Models

Here is the honest tradeoff. Open WebUI on its own is happy with 12GB of RAM. But local models are hungry: a small 7B model wants roughly 8GB on top of everything else, and larger models climb fast and really want a GPU to be usable. Running local models on the same VPS as your interface is doable for experimentation, but for a responsive daily-driver setup, most people either give inference its own beefy machine or - more commonly - point Open WebUI at a hosted API and skip local models entirely. Decide based on your priorities: privacy and full control push you toward Ollama, cost and simplicity push you toward a hosted API.

Step 5: Add an Nginx Reverse Proxy with TLS

Open WebUI is running on localhost, but nothing public can reach it yet - and that is correct. Put it behind nginx with a real certificate. This mirrors our OpenClaw nginx reverse proxy guide; the pattern is identical, only the upstream port changes.

Install nginx and certbot:

sudo apt-get install -y nginx certbot python3-certbot-nginx

Create /etc/nginx/sites-available/open-webui:

server {
    listen 80;
    server_name ai.yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:3000;

        # WebSocket upgrade - Open WebUI streams responses over WebSockets
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Standard proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Keep streaming responses alive
        proxy_read_timeout 300s;
    }
}

The WebSocket upgrade headers are not optional - Open WebUI streams model output over WebSockets, and without them responses stall or the UI feels broken. Enable the site and get a certificate:

sudo ln -s /etc/nginx/sites-available/open-webui /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d ai.yourdomain.com

Certbot installs a free Let’s Encrypt certificate, rewrites the config for HTTPS, adds an HTTP-to-HTTPS redirect, and sets up automatic renewal. Your instance is now live at https://ai.yourdomain.com.

Step 6: Create the Admin Account and Lock Down Signups

Open https://ai.yourdomain.com in your browser. The first account you register becomes the administrator - so do this immediately, before anyone else finds the URL.

Once you are in as admin, go to the admin settings and disable open signups. By default Open WebUI lets anyone register; on a public instance that means strangers creating accounts on your server. Switch registration off (or set new accounts to require admin approval) so only people you invite can get in. This one setting is the difference between a private instance and an open door.

Step 7: Set Up Backups

Everything that matters - your users, chat history, uploaded documents, and settings - lives in the open-webui Docker volume. Back it up regularly so a failed server or a botched upgrade is a minor inconvenience, not a disaster:

docker run --rm \
  -v open-webui:/data \
  -v $(pwd):/backup \
  alpine tar czf /backup/open-webui-backup.tar.gz -C /data .

Schedule that with cron, ship the archive off-server, and you can restore or migrate to a new VPS in minutes. Our Maintenance & Monitoring service handles this automatically if you would rather not manage it.

Upgrading Open WebUI

Because your data lives in a volume, upgrades are painless. Pull the new image, remove the old container, and re-run it with the same flags:

docker pull ghcr.io/open-webui/open-webui:main
docker stop open-webui && docker rm open-webui
# re-run the same docker run command from Step 3

The volume reattaches and all your data is intact.

The Short Version

To self-host Open WebUI on a VPS: harden a Ubuntu LTS box, install Docker, run the container on localhost with a persistent volume, wire it to Ollama or a hosted API, front it with nginx and Let’s Encrypt, claim the admin account, and disable open signups. Size RAM for your model choice - 12GB is plenty for a hosted-API setup, far more if you run local models on the same machine.

If you would rather skip the setup and get a working, secured Open WebUI without touching a terminal, we install it for you - Docker, reverse proxy, TLS, backups, and your model backend, all configured correctly from day one. For team deployments with enterprise auth and RAG, see our Business AI Installation.