.env.openwebui

# ═══════════════════════════════════════════════════════════
# Open WebUI (Unicorn Chat) Environment Configuration
# ═══════════════════════════════════════════════════════════
#
# Copy this file to .env.openwebui and configure values below.
# Required values are marked with [REQUIRED].
# Most defaults work out of the box with an existing Ops-Center deployment.

# ── Domain / General ────────────────────────────────────────
# Your root domain (shared with Ops-Center)
EXTERNAL_HOST=kubeworkz.io

# Secret key for Open WebUI sessions [REQUIRED - generate with: openssl rand -hex 32]
OPENWEBUI_SECRET_KEY=e209e2eae956be3f84547b1f15c0def3173e5b96349e916a645a138f523e3a20

# Allow new users to register via the Open WebUI signup form (disable if using SSO only)
OPENWEBUI_ENABLE_SIGNUP=false

# Default role for new users: "user" or "admin"
OPENWEBUI_DEFAULT_ROLE=user

# ── LiteLLM Connection ──────────────────────────────────────
# Master key for the LiteLLM proxy (must match your LiteLLM deployment)
# [REQUIRED] - copy from your existing .env.auth LITELLM_MASTER_KEY
LITELLM_MASTER_KEY=d85bcec2690d3f12779c0690d26d16370e434c0d7422bef5c5105f0a39b36a3a

# ── Keycloak SSO (OIDC) ─────────────────────────────────────
# These connect Open WebUI to your existing Keycloak instance.
# The OIDC client "open-webui" must be registered in Keycloak first
# (the install script can do this automatically).

# Keycloak realm (must match your Ops-Center deployment)
KEYCLOAK_REALM=uchub

# Allow SSO login to automatically create accounts
OPENWEBUI_ENABLE_OAUTH_SIGNUP=true

# OIDC client credentials [REQUIRED - set after Keycloak client creation]
OPENWEBUI_OAUTH_CLIENT_ID=open-webui
OPENWEBUI_OAUTH_CLIENT_SECRET=ICmKXG0xOtncIzY1EdSSov6SZyVUs2Lr

# ── Keycloak Admin (for automatic client registration) ──────
# Used only by the install script to auto-register the OIDC client.
# Can be removed after installation.
KEYCLOAK_ADMIN_USER=admin
KEYCLOAK_ADMIN_PASSWORD=vz9cA8-kuX-oso3DC-w7