scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-08-28 05:27:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge 72f210c0e1 into db22d89cab

Browse source
This commit is contained in:
Sebastian 2026-08-25 22:12:57 +00:00 • committed by GitHub
commit f7424cafd6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.dockerignore
View file

@ -18,3 +18,4 @@ uploads
**/*.db
_test
backend/data/*
backend/.webui_secret_key

22
backend/start.sh
View file

@ -29,7 +29,16 @@ fi
# ── Secret key setup ─────────────────────────────────────────────────────────
KEY_FILE="${WEBUI_SECRET_KEY_FILE:-.webui_secret_key}"
# The script cd's to its own directory, which lives in the image: a key written
# there is lost on every container recreate and is not writable when the
# container does not run as root. Fall back to DATA_DIR instead.
if [[ -n "${WEBUI_SECRET_KEY_FILE:-}" ]]; then
KEY_FILE="$WEBUI_SECRET_KEY_FILE"
elif [[ -f .webui_secret_key && -s .webui_secret_key ]]; then
KEY_FILE=".webui_secret_key"
else
KEY_FILE="${DATA_DIR:-./data}/.webui_secret_key"
fi
WEBUI_SECRET_KEY_LENGTH="${WEBUI_SECRET_KEY_LENGTH:-24}"
PORT="${PORT:-8080}"
HOST="${HOST:-0.0.0.0}"
@ -37,13 +46,20 @@ HOST="${HOST:-0.0.0.0}"
if [[ -z "${WEBUI_SECRET_KEY:-}" && -z "${WEBUI_JWT_SECRET_KEY:-}" ]]; then
echo "No WEBUI_SECRET_KEY environment variable set, loading from file."
if [[ ! -f "$KEY_FILE" ]]; then
# Regenerate when missing or empty, never when merely unreadable: such a key may
# belong to another UID, and it also encrypts OAuth sessions and valves.
if [[ ! -s "$KEY_FILE" ]]; then
echo "Generating new WEBUI_SECRET_KEY..."
if ! [[ "$WEBUI_SECRET_KEY_LENGTH" =~ ^[1-9][0-9]*$ ]]; then
echo "WEBUI_SECRET_KEY_LENGTH must be a positive integer." >&2
exit 1
fi
head -c "$WEBUI_SECRET_KEY_LENGTH" /dev/random | base64 > "$KEY_FILE"
# 0640/0750: a volume remounted under a different arbitrary UID keeps group 0.
(
umask 027
mkdir -p -- "$(dirname -- "$KEY_FILE")"
head -c "$WEBUI_SECRET_KEY_LENGTH" /dev/random | base64 > "$KEY_FILE"
)
fi
echo "Loading WEBUI_SECRET_KEY from ${KEY_FILE}"