Author: Matthias Kerstner

Runn Ollama via Open WebUI using Docker compose and Apache as reverse proxy for SSL

Wanted to have a quick but secure Ollama + Open WebUI setup using docker compose.

Here is a working version using Apache as a reverse proxy. The options used are pretty self-explanatory, otherwise leave a comment.

compose.yaml

services:
  ollama:
    image: ollama/ollama:latest
    ports:
      - 11434:11434
    volumes:
      - ollama:/root/.ollama
    container_name: ollama
    tty: true
    restart: unless-stopped

  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    ports:
      - 3000:8080
    depends_on:
      - ollama
    environment:
      - 'OLLAMA_BASE_URL=http://ollama:11434'
      - 'WEBUI_AUTH=true'
      - 'DEFAULT_MODELS=ai/llama3.2'
      - 'WEBUI_URL=https://my.server.com'
      - 'CORS_ALLOW_ORIGIN=https://my.server.com;http://localhost:3000'
      - 'WEBUI_SESSION_COOKIE_SECURE=true'
      - 'WEBUI_AUTH_COOKIE_SECURE=true'
    extra_hosts:
      - host.docker.internal:host-gateway
    volumes:
      - open-webui:/app/backend/data
    restart: unless-stopped

volumes:
  ollama: {}
  open-webui: {}

As usual, run it via docker compose up.

httpd.conf

<VirtualHost x.x.x.x:443 x:x:x:x::2:443>
  ServerName my.server.com

  # Proxy
  SSLProxyEngine On
  SSLProxyVerify None
  SSLProxyCheckPeerCN Off

  # Make sure to keep the host
  ProxyRequests Off
  ProxyPreserveHost On
  ProxyAddHeaders On

  ProxyPass "/" "http://127.0.0.1:3000/" upgrade=websocket flushpackets=on
  ProxyPassReverse "/" "http://127.0.0.1:3000/"

  # equivalent of proxy_set_header X-Real-IP $remote_addr;
  RequestHeader set X-Real-IP expr=%{REMOTE_ADDR}

  # equivalent of proxy_set_header X-Forwarded-Proto $scheme;
  RequestHeader set X-Forwarded-Proto "https"

  # Open WebUI streams long-lived LLM responses; raise timeouts so Apache doesn't cut them off
  ProxyTimeout 300
  Timeout 300

  Alias /pda-ssl-validation-files /opt/pdadmin/etc/ssl-validation

  SSLEngine on
  SSLCertificateFile /opt/pdadmin/sslcerts/my.server.com-cert
  SSLCertificateKeyFile /opt/pdadmin/sslcerts/my.server.com-key
  SSLCertificateChainFile /opt/pdadmin/sslcerts/my.server.com-cacert
  SetEnvIf User-Agent ".*MSIE.*" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0

  Alias /.well-known/acme-challenge/ /opt/pdadmin/etc/ssl-validation/.well-known/acme-challenge/
  
  Header set Strict-Transport-Security "max-age=15768000"
</VirtualHost>

That’s it.

23/08/2026