【教程】docker compose 部署 openwebui+newapi 并使用nginx进行反代、加密和优化

环境准备

安装必要软件

• Docker:

apt install docker.io

• Docker Compose:

apt install docker-compose

• Nginx:

apt install nginx

• Certbot:

apt install certbot python3-certbot-nginx

DNS 和 SSL 配置

CloudFlare DNS 记录配置

在 CloudFlare 面板的 DNS 记录中添加两个 A 记录：chat、api，指向服务器：

SSL 加密设置

将域名的 SSL 加密设置改为完全：

点击 configure：

选择 full(strict)

Docker 配置

创建 Docker 网络

为了高效通讯，创建一个 Docker 网络：

docker network create llm_network

Open-WebUI 配置

创建目录

mkdir open-webui
cd open-webui

创建 Docker Compose 配置文件

nano docker-compose.yml

将以下内容粘贴进去：

services:
  openwebui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: open-webui
    restart: always
    ports:
      - "3000:8080"
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - open-webui-data:/app/backend/data
    networks:
      - llm_network

volumes:
  open-webui-data:

networks:
  llm_network:
    external: true

启动服务

docker-compose up -d

New-API 配置

创建目录

cd ..
mkdir new-api
cd new-api

创建 Docker Compose 配置文件

nano docker-compose.yml

将以下内容粘贴进去：

services:
  new-api:
    image: calciumion/new-api:latest
    container_name: new-api
    restart: always
    command: --log-dir /app/logs
    ports:
      - "3002:3000"
    volumes:
      - ./new-api-data:/data
      - ./new-api-logs:/app/logs
    environment:
      - SQL_DSN=root:your_mysql_password@tcp(mysql:3306)/new-api
      - REDIS_CONN_STRING=redis://redis
      - TZ=Asia/Shanghai
      - ERROR_LOG_ENABLED=true
      - STREAMING_TIMEOUT=120
    depends_on:
      - redis
      - mysql
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:3000/api/status | grep -o '\"success\":\\s*true'"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - llm_network

  redis:
    image: redis:latest
    container_name: redis
    restart: always
    networks:
      - llm_network

  mysql:
    image: mysql:8.2
    container_name: mysql
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: your_mysql_password
      MYSQL_DATABASE: new-api
    volumes:
      - mysql-data:/var/lib/mysql
    networks:
      - llm_network

volumes:
  mysql-data:

networks:
  llm_network:
    external: true

注意: 需要修改 your_mysql_password 为你的实际密码

启动服务

docker-compose up -d

Nginx 反向代理配置

创建初始配置

chat域名配置

nano /etc/nginx/sites-available/chat.domain.com.conf

server {
    listen 80;
    server_name chat.domain.com;
}

api域名配置

nano /etc/nginx/sites-available/api.domain.com.conf

server {
    listen 80;
    server_name api.domain.com;
}

注意: 将 chat.domain.com/api.domain.com 替换为你的实际域名

获取 SSL 证书

certbot --nginx -d chat.domain.com -d api.domain.com

Nginx 配置优化

OpenWebUI 配置

nano /etc/nginx/sites-available/chat.domain.com.conf

在证书配置后面加上：

client_max_body_size 100m;
keepalive_timeout 120s;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;

location / {
    proxy_pass http://localhost:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_cache_bypass $http_upgrade;
}

修改后配置如图：

New-API 配置

nano /etc/nginx/sites-available/api.domain.com.conf

同上，只是将3000端口改为3002

client_max_body_size 100m;
keepalive_timeout 120s;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;

location / {
    proxy_pass http://localhost:3002;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_cache_bypass $http_upgrade;
}

启用 Nginx 配置

创建符号链接

ln -s /etc/nginx/sites-available/chat.domain.com.conf /etc/nginx/sites-enabled/
ln -s /etc/nginx/sites-available/api.domain.com.conf /etc/nginx/sites-enabled/

测试并重载配置

nginx -t
systemctl reload nginx

注意: 将 chat.domain.com/api.domain.com 替换为你的实际域名

总结

至此，后端配置完成。你现在应该能够通过配置的域名访问 OpenWebUI 和 New-API 服务了。