Secretia documentation

Secretia is three pieces wired together: Ollama runs the models, Open WebUI is the chat, and a small nginx layer gives it the Escriba identity. Everything runs on your own server.

   Internet ─► secretia (nginx, public) ─► open-webui (internal) ─► ollama (internal)
               branding + magenta accent     chat, users, OIDC        local models

How it works

Ollama — the engine

Pulls and serves open models locally over a simple API. Models live in a volume, so they survive restarts. It only talks to the internet to download a model.

Open WebUI — the front

The chat interface: conversations, users, model picker, multimodal input and native OIDC. It points at Ollama through OLLAMA_BASE_URL.

The branding layer

A tiny nginx reverse-proxy sits in front and injects Secretia’s CSS — the Inter typography and the magenta accent — and serves the logo, without forking Open WebUI’s UI.

Lockatus federation

Open WebUI’s built-in OIDC is wired to Lockatus: register secretia (redirect URI + access matrix) and the family logs in once, with 2FA and per-app roles.

Branding, honestly

The Escriba look here is branding-level, not a full re-skin. The name, logo and accent are ours; the interface underneath is Open WebUI’s own design. The accent is injected as CSS by the nginx layer — robust for the safe touches (typography, links, focus, the top bar), and best-effort for deeper recolouring, which may need a tweak when Open WebUI changes its markup. A full pixel-perfect re-skin would mean forking and maintaining their UI by hand — costly and fragile — so we don’t.

Models

Pull whatever fits your hardware:

llama3.1:8b — a solid, light general chat model.
qwen2.5:7b — a strong alternative.
llava:7b — multimodal: reads text and images.

A 7–8B model weighs about 4–5 GB. They run on CPU; a GPU is dramatically faster.