Install Secretia

Secretia is a distribution: it runs the official Ollama and Open WebUI images and adds a small branding layer. Pick the path that fits your host — a one-file Compose, or three separate services (the friendliest option on EasyPanel).

Requirements

Docker host

Any server that runs Docker images. Ollama needs outbound internet once, to ollama pull your models; after that everything is local.

Enough RAM

A 7–8B model needs roughly 4–5 GB. CPU-only works; a GPU is much faster.

A session secret

One long random string for Open WebUI (openssl rand -hex 32). For SSO, the Lockatus client details (optional).

Run it

EasyPanel (3 services)

EasyPanel prefers separate services over a Compose. Create a project and three services:

1. ollama — App → Docker Image ollama/ollama:latest. Mount a volume at /root/.ollama. No domain (internal).
2. open-webui — App → Docker Image ghcr.io/open-webui/open-webui:main. Mount /app/backend/data. Set the environment variables (below). No domain (internal).
3. secretia — App → GitHub diegoparras/secretia, Build = Dockerfile. Set OPEN_WEBUI_UPSTREAM=open-webui:8080. Assign your public domain → port 8080.

Inside one project, services reach each other by name (http://ollama:11434, open-webui:8080). The full checklist lives in the repo’s DEPLOY.md.

Docker Compose

git clone https://github.com/diegoparras/secretia.git && cd secretia
cp .env.example .env      # set WEBUI_URL, WEBUI_SECRET_KEY and the OAUTH_* vars
docker compose up -d

The compose brings up Ollama, Open WebUI and the branding nginx together; only the branding service is published (port 8080).

Minimal (2 services)

Want the simplest path? Run only ollama + open-webui and point your domain straight at open-webui (port 8080). You keep the “Secretia” name and Lockatus login, but lose the magenta accent — that’s what the branding service adds.

Environment variables (Open WebUI)

Variable	Example	Description
OLLAMA_BASE_URL	http://ollama:11434	Where the model engine lives (internal hostname).
WEBUI_NAME	Secretia	The app name shown in the UI.
WEBUI_URL	https://your-domain	Public URL — used to build OIDC redirects.
WEBUI_SECRET_KEY	(random)	Session/crypto key. openssl rand -hex 32. Keep it secret.
ENABLE_SIGNUP	false	Local sign-up off — accounts come in through Lockatus.
ENABLE_OAUTH_SIGNUP	true	Create a user automatically on first Lockatus login.
OAUTH_CLIENT_ID	secretia	App slug registered in Lockatus.
OAUTH_CLIENT_SECRET	(secret)	The secret registered in Lockatus.
OPENID_PROVIDER_URL	…/.well-known/openid-configuration	Lockatus discovery URL.
OPENID_REDIRECT_URI	https://your-domain/oauth/oidc/callback	Must match the one registered in Lockatus.

The branding service takes one variable: OPEN_WEBUI_UPSTREAM (default open-webui:8080).

First run

1. Open your domain and sign in with Lockatus.
2. The first user usually becomes admin; if not, promote it in Open WebUI → Settings → Users.
3. In the ollama service terminal, pull a model:

ollama pull llama3.1:8b      # or qwen2.5:7b, or llava:7b for images

The model appears in Secretia’s picker on its own.

Single sign-on

Set the OAUTH_* / OPENID_* variables and register secretia in Lockatus (redirect URI + access matrix) to federate the login with the whole suite. Leave them empty to keep the standalone admin login.