Skip to main content
mAItion serves all traffic — including static assets — through Open WebUI’s Uvicorn server. For production deployments, the optional compose.caddy.yaml overlay adds Caddy as a caching reverse proxy that handles automatic TLS certificate issuance via LetsEncrypt and speeds up static asset delivery. The overlay also starts a dedicated redis-caddy sidecar used as Caddy’s cache backend: static assets (images, CSS, JS, fonts) are cached for one year with immutable headers, and manifest.json is cached for 24 hours. Dynamic chat and API requests bypass the cache entirely and are streamed directly to the browser.

​
Requirements

  • A public domain with an A/AAAA record pointing to your server
  • Ports 80 and 443 open and publicly reachable (required for the LetsEncrypt HTTP-01 challenge). Set CADDY_HTTP_PORT / CADDY_HTTPS_PORT in .env if you need to publish Caddy on different host ports.

​
Setup

  1. Add the following to your .env file:
    Setting DOMAIN to an http:// URL (e.g. DOMAIN=http://localhost) bypasses TLS termination entirely — Caddy will serve the app on plain HTTP. Use this only for local testing.
  2. Start the stack with the Caddy overlay by setting COMPOSE_FILE so plain docker compose picks it up automatically:
    Or pass the overlay explicitly with -f:
    Either way, the overlay clears OpenWebUI’s host port binding so only Caddy is externally reachable. Caddy will automatically obtain and renew a TLS certificate, and HTTP requests are redirected to HTTPS automatically.

​
Troubleshooting

  • Certificate not issued — check that ports 80 and 443 are reachable from the public internet and your DNS record points to this server. Run docker compose logs caddy to see the ACME challenge output.
  • Port 80/443 already in use — another reverse proxy (Traefik, Nginx, etc.) is likely running on the host. Either stop it, or set CADDY_HTTP_PORT/CADDY_HTTPS_PORT in .env to publish Caddy on different host ports — note that LetsEncrypt’s HTTP-01 challenge and normal HTTPS access require the public internet to reach ports 80/443, so this only works if you also forward those public ports to your chosen ones, or you’re not relying on public TLS (e.g. local testing).

​
Certificate persistence

TLS certificates are stored in the caddy_data Docker volume. They survive docker compose down but are removed by docker compose down -v. Do not use -v if you want to preserve your certificates.