docker-compose.yaml

name: ollama-local

services:

  ollama:
    image: ollama/ollama:${OLLAMA_IMAGE_VERSION}
    volumes:
      - ollama_data:/root/.ollama
    ports:
      # Standard port for Ollama. Don't really want to expose this unencrypted.
      - 127.0.0.1:11434:11434
    #extra_hosts:
    #  - "host.docker.internal:host-gateway"
    gpus: all
    restart: unless-stopped
    networks:
      - restricted_internal
    profiles:
      - offline

  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    volumes:
      - open_webui_backend_data:/app/backend/data
    #ports:
    #  # Port exposure for Open-WebUI. Don't really want to expose this unencrypted.
    #  - 127.0.0.1:16462:8080
    #extra_hosts:
    #  - "host.docker.internal:host-gateway"
    environment:
      # Not using SSL because we're within the docker network.
      OLLAMA_BASE_URL: http://ollama:11434
    gpus: all
    depends_on:
      - ollama
    restart: unless-stopped
    networks:
      - restricted_internal
    profiles:
      - offline

  open-webui-pipelines:
    image: ghcr.io/open-webui/pipelines:main
    volumes:
      - open_webui_pipelines:/app/pipelines
    #ports:
    #  # Port exposure for Open-WebUI Pipelines. Don't really want to expose this unencrypted.
    #  - 127.0.0.1:9099:9099
    #extra_hosts:
    #  - "host.docker.internal:host-gateway"
    gpus: all
    depends_on:
      - ollama
      - open-webui
    restart: unless-stopped
    networks:
      - restricted_internal
    profiles:
      - offline

  # Hide Ollama and Open-WebUI behind self-signed reverse proxies.
  reverse-proxy:
    image: nginx:1.25.4-alpine
    depends_on:
      - ollama
      - open-webui
    volumes:
      - ./nginx/nginx-selfsigned.crt:/etc/ssl/certs/my-site.crt:ro
      - ./nginx/nginx-selfsigned.key:/etc/ssl/private/my-site.key:ro
      - ./nginx/dhparam.pem:/etc/ssl/certs/dhparam.pem:ro
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
    ports:
      - 127.0.0.1:443:443
      - 127.0.0.1:80:80
    restart: unless-stopped
    networks:
      - restricted_internal
    profiles:
      - offline

  # Service also connected to the same volumes as ollama but is on an
  # internet-accessible network
  ollama-cli:
    image: ollama/ollama:${OLLAMA_IMAGE_VERSION}
    volumes:
      - ollama_data:/root/.ollama
    profiles:
      - ollama-cli

networks:
  restricted_internal:
    driver: bridge
    ipam:
      config:
        - subnet: 172.128.0.0/16
    driver_opts:
      com.docker.network.bridge.enable_ip_masquerade: "false"

volumes:
  ollama_data:
  open_webui_backend_data:
  open_webui_pipelines: