Open WebUI Setup Guide: Multi-User, Model Switching & RAG in 2025

Open WebUI gives you a ChatGPT-style interface running entirely on your own hardware — no data leaves your machine. Once it's running, you get role-based user management, one-click model switching across every model Ollama supports, and a built-in RAG pipeline that can answer questions against your own documents.

This guide gets you from zero to fully configured in under an hour.

Last updated: 2026-06-10

What You're Actually Installing

Open WebUI is a web frontend that speaks to a model backend — most commonly Ollama, though it also talks directly to OpenAI-compatible APIs. The architecture matters because it's what keeps your data private:

```

Browser → Open WebUI (port 3000) → Ollama (port 11434) → Model weights on disk

```

Nothing in that chain touches the internet after initial model download. Every inference runs locally. The only exception is if you explicitly add an external API key under Settings → Connections.

Prerequisites:

Docker Desktop (Mac/Windows) or Docker Engine (Linux)
Ollama installed and running (ollama serve in a terminal)
At least one model pulled: ollama pull llama3.2 or similar
8GB RAM minimum; 16GB+ recommended for 7B+ parameter models

Installation: Docker in One Command

The fastest path is a single docker run. This mounts the Open WebUI data volume and connects it to your local Ollama instance:

```bash

docker run -d \

-p 3000:8080 \

--add-host=host.docker.internal:host-gateway \

-v open-webui:/app/backend/data \

--name open-webui \

--restart always \

ghcr.io/open-webui/open-webui:main

```

What each flag does:

-p 3000:8080 — exposes the UI at localhost:3000
--add-host=host.docker.internal:host-gateway — lets the container reach Ollama on your host machine
-v open-webui:/app/backend/data — persists your settings, users, and uploaded documents across container restarts
--restart always — survives reboots

Once the container starts (30–60 seconds), open http://localhost:3000. The first user to register automatically becomes the admin.

Docker Compose (Recommended for Persistent Setups)

If you're running this long-term, a docker-compose.yml is easier to manage:

```yaml

services:

open-webui:

image: ghcr.io/open-webui/open-webui:main

container_name: open-webui

ports:

- "3000:8080"

extra_hosts:

- "host.docker.internal:host-gateway"

volumes:

- open-webui:/app/backend/data

restart: always

volumes:

open-webui:

```

Start it with docker compose up -d. Update later with:

```bash

docker compose pull && docker compose up -d

```

First-Time Configuration

After registering your admin account, go to Admin Panel → Settings (the gear icon, top-right). The critical settings to review immediately:

General:

Set your Ollama URL to http://host.docker.internal:11434 if it wasn't auto-detected.
Disable User Registration if this is a private instance — under Admin Panel → Users → Manage, toggle off open registration so only invited users can join.

Interface:

Enable Title Auto-Generation — Open WebUI will name your chat sessions using the model, so you can find conversations later.
Set a default model so new chats don't start with an empty selector.

Security (do this before sharing with anyone):

Go to Admin Panel → Settings → General and set WEBUI_SECRET_KEY if you deployed via environment variable — this signs session cookies.
If exposing to a LAN or remote access: put Nginx or Caddy in front with HTTPS. Never expose port 3000 directly to the internet.

Multi-User Management

Open WebUI has a three-tier permission system: Admin, User, and Pending (unapproved registrations).

Inviting Users

With open registration disabled, you have two options:

Direct admin approval — users register and show up as "Pending"; you approve them from Admin Panel → Users.
Invite link — generate a signup link from Admin Panel → Users → Invite User. Anyone with the link can register and gets auto-approved as a basic User.

Role Capabilities

| Capability | Admin | User |

|---|---|---|

| Access all models | ✓ | ✓ (configurable) |

| Upload documents to shared knowledge | ✓ | ✓ |

| Manage other users | ✓ | ✗ |

| Create workspace prompts | ✓ | ✓ |

| View all users' chat history | ✓ | ✗ |

| Set default models | ✓ | ✗ |

Restricting Model Access Per User

Admins can limit which models a specific user sees. Navigate to Admin Panel → Users → [username] → Edit, then toggle model visibility. This is useful if you're running a shared family or small-team instance and want to reserve large resource-hungry models for yourself.

Model Switching

This is where Open WebUI shines over the raw Ollama terminal interface. Every model you've pulled via ollama pull appears automatically in the model dropdown at the top of every chat.

Pulling New Models from the UI

You don't need to touch the terminal after initial setup. Go to Admin Panel → Settings → Models, type a model name from the Ollama library into the Pull a model field, and click Pull. Progress is shown in real-time.

Useful models to pull for different use cases:

llama3.2 — fast, capable general assistant (3B, fits in 8GB RAM)
llama3.1:8b — stronger reasoning, still consumer-hardware friendly
mistral — excellent for instruction-following and coding
nomic-embed-text — required for RAG (embedding model, not a chat model)
codellama — code-focused tasks

Switching Mid-Conversation

The model dropdown is live — you can switch models inside an existing conversation. Open WebUI preserves the full chat history and sends it as context to the new model. This lets you start with a fast model for drafting and switch to a more capable one for refinement without starting over.

Connecting an External API (Optional)

If you want to use OpenAI or an OpenAI-compatible endpoint (Groq, Together AI, local LM Studio) alongside Ollama:

Go to Settings → Connections → OpenAI API
Enter the API base URL and your key
Toggle the connection on

External models then appear in the same dropdown alongside your local Ollama models. Your local conversations stay local; only queries to explicitly selected external models leave your machine.

RAG: Answering Questions Against Your Own Documents

Retrieval-Augmented Generation (RAG) lets the model answer questions using your uploaded files instead of (or alongside) its training data. Open WebUI's RAG pipeline handles chunking, embedding, and retrieval automatically.

Step 1: Set Up the Embedding Model

RAG requires an embedding model to convert documents into searchable vectors. The default is nomic-embed-text via Ollama — pull it first:

```bash

ollama pull nomic-embed-text

```

Then in Open WebUI: Admin Panel → Settings → Documents, set the embedding model to nomic-embed-text. Leave chunk size at the default (1500 tokens) unless you're working with very short or very long documents.

Step 2: Upload Documents

There are two scopes for documents:

Per-conversation upload — click the paperclip icon in any chat and upload a file. The document is embedded on the spot and used as context for that conversation only. Supports PDF, TXT, DOCX, CSV, and more.

Shared knowledge base — go to Workspace → Knowledge, create a collection, and upload documents. Collections are reusable across conversations and accessible to all users you've shared them with.

Step 3: Querying Your Documents

In a chat, type # to summon the knowledge base selector and choose your collection. The model will retrieve relevant chunks and cite them inline. For per-conversation uploads, the document is automatically in context — just ask your question.

Tips for better RAG results:

Clean PDFs (text-selectable, not scanned images) work best — OCR support requires additional configuration
Keep documents under 50MB per file; large files slow embedding significantly
For dense technical documents, reduce chunk size to 500–800 tokens in Admin Panel → Settings → Documents
Use specific questions rather than broad ones — "What does section 4.2 say about liability?" outperforms "summarize everything"

Workspace: Prompts, Tools & Model Presets

The Workspace tab is where you build reusable infrastructure for your instance.

System Prompts — save custom system prompts under Workspace → Prompts and trigger them with / in any chat. Useful for consistent personas: a coding assistant that always outputs fenced code blocks, a document summarizer with a fixed output format.

Model Presets — under Workspace → Models, create a named preset that combines a base model with a system prompt, temperature setting, and knowledge collection. Presets appear in the model dropdown like first-class models. This is the cleanest way to give non-technical users on a shared instance a one-click "Document Q&A" or "Code Review" option.

Performance & Resource Tuning

Ollama controls most performance levers. Open WebUI exposes a few:

Concurrent requests — Ollama defaults to one request at a time. For multi-user instances, set OLLAMA_NUM_PARALLEL=2 in your Ollama environment to allow two simultaneous inferences (at the cost of per-request speed).
Context length — editable per conversation via the model parameters panel (the sliders icon). Increasing context lets the model "see" more of a long document but uses more VRAM.
Keep-alive — set OLLAMA_KEEP_ALIVE=5m to unload models from VRAM after 5 minutes of inactivity, freeing memory for other tasks on a shared machine.

Keeping Open WebUI Updated

The main tag always points to the latest release. Update with:

```bash

Docker Compose

docker compose pull && docker compose up -d

Plain Docker

docker pull ghcr.io/open-webui/open-webui:main

docker stop open-webui && docker rm open-webui

Re-run the original docker run command

```

Your data volume (open-webui) is separate from the container image — updates never touch your conversations, users, or uploaded documents.

Accessing Open WebUI Remotely

For access outside your home network without exposing a port publicly:

Tailscale — install on both the host machine and your remote device; access via the Tailscale IP at http://[tailscale-ip]:3000. Zero configuration, encrypted, no port forwarding.
Cloudflare Tunnel — free tier supports a named domain; traffic is encrypted end-to-end with no inbound firewall rules needed.

Both options are meaningfully more private than a raw port-forward, and Tailscale in particular adds near-zero latency overhead on LAN.

You're Running a Private AI Stack

At this point you have a fully functional, multi-user, document-aware AI interface running entirely on your own hardware. No usage logs, no training on your conversations, no subscription. The only data leaving your network is whatever you explicitly send to an external API — and now you know exactly when that happens.

The next step is building reusable model presets for your specific workflows: document review, code generation, research summarization. Each one takes five minutes to configure and eliminates the need to re-explain context every session.

Stay ahead of the privacy curve. Subscribe to the PrivateAI newsletter for new self-hosted tool guides, model recommendations, and configuration deep-dives — delivered to your inbox, not your AI provider's training set.

Subscribe to PrivateAI updates →

```