Run Open WebUI on a European VPS as a private chat interface, connect it to an approved model endpoint and keep its accounts, configuration and history in persistent storage. Hosting the interface in Europe does not establish where inference happens: prompts still go to the model service you configure.
This guide builds a single-instance installation accessed through an SSH tunnel. It keeps the application off the public network while you create its administrator and qualify the model connection. It does not install a language model or promise GPU capacity.
Separate the interface from inference
Open WebUI connects to model providers, including Ollama and compatible API servers. The browser interface, application database and inference service are separate components, even if a convenient installation can put some of them on one machine.
| Component | What to establish |
|---|---|
| Open WebUI VPS | Where accounts, chats, uploads and application backups are stored. |
| Model provider | Where prompts and responses are processed, retained and logged. |
| Optional services | Where embeddings, document extraction, web search, tools and telemetry send data. |
| Administrator access | Who can configure providers, inspect data and recover the application. |
Before uploading business documents, draw the actual request path and approve each destination. A European frontend calling an overseas model endpoint still transfers prompts to that endpoint. A locally operated model can reduce that particular dependency, but introduces model-serving capacity and operations work.
Choose a provider region and contractual terms that match your requirements. Do not turn location into a blanket GDPR claim: data categories, access, retention and third-party processing also matter. Our hosting checklist helps organise those questions.
Prepare the VPS and the example
You need a Linux VPS you administer, SSH access, Docker Engine with the Compose plugin, Python 3.9 or later and an approved inference endpoint. Reserve disk capacity for the application, uploaded content, logs and backups. Size inference separately; this setup contains no GPU runtime or local model weights.
Start with a small approved trial and observe memory, CPU and disk use before admitting a team. User count alone is a weak sizing estimate: long conversations, document processing and simultaneous requests create different workloads. Avoid publishing a universal minimum based on an idle screen.
Download the runnable Compose example. It includes the configuration below, a secret initializer and backup/restore instructions. It pins Open WebUI 0.12.5 to an image digest. The slim variant fits a basic chat setup using a separate provider; consult the official image-variant guidance before adding local document or speech processing.
Use a dedicated directory. Do not place the example beside a different project's Compose file and run an unqualified command. The explicit project name below keeps its containers and volume names identifiable.
Start privately and create the administrator
1. Review the Compose configuration
The host port binds only to loopback. Authentication remains enabled, and the named volume preserves the application data:
name: owui-private
services:
open-webui:
image: ghcr.io/open-webui/open-webui:v0.12.5-slim@sha256:9a4db3e6c8d6174d4ed8952304115e90dcc36e9a8b98c2f8984eab321f29505e
restart: unless-stopped
ports:
- "127.0.0.1:3000:8080"
environment:
WEBUI_AUTH: "True"
WEBUI_SECRET_KEY: ${WEBUI_SECRET_KEY:?Run python3 init_env.py first}
ENABLE_OLLAMA_API: "False"
volumes:
- webui-data:/app/backend/data
volumes:
webui-data:
The fixed application secret belongs outside the committed configuration. Run the initializer in the downloaded directory; it creates an owner-only .env and refuses to overwrite an existing one. Preserve that secret with your recovery materials rather than generating a new value on every restart.
python3 init_env.py
docker compose -p owui-private config --quiet
docker compose -p owui-private up -d
curl --fail http://127.0.0.1:3000/healthThe configuration check validates Compose syntax and required variables; it does not prove application startup. If the health request fails, inspect startup privately and distinguish image-pull errors, insufficient resources and application failures. Treat logs as potentially sensitive. A successful health request still does not prove provider access or a successful chat.
2. Connect from your laptop
Run this on your laptop, replacing the SSH account and VPS hostname:
ssh -N -L 127.0.0.1:3000:127.0.0.1:3000 operator@your-vpsOpen http://127.0.0.1:3000 locally while the tunnel remains connected. If your laptop already uses that port, change its first port number and browse the corresponding address. Do not solve a tunnel problem by exposing the container publicly.
3. Claim and protect the administrator account
Create the administrator through the private connection. Open WebUI promotes its first account to administrator; its security guidance explicitly recommends completing setup over a private network or local port. Verify that new signups are closed after setup and keep the administrator password in your approved secret manager.
Use a separate normal account for everyday work. Invite or approve only the people in the initial trial. Establish who owns provider credentials and who is allowed to change instance settings. A shared administrator login makes both incidents and routine departures harder to manage.
Connect and verify the model service
In the documented interface, go to your avatar, Settings, Admin, then Connections. Add the approved provider's API connection with its documented base URL and credential. Keep that credential out of chat messages, screenshots and shell history. Use a project-specific provider key with an appropriate budget and permissions.
For a self-hosted model endpoint, arrange a private network, VPN or authenticated TLS connection. A container's localhost means that container, not another server. Confirm routing and DNS from the application host without opening an unauthenticated model server to the internet.
Run a non-sensitive acceptance conversation. Check that the intended model appears, streaming completes, a new session can authenticate and an ordinary user has the access you intended. Then inspect provider-side usage accounting. A UI label by itself does not prove the request reached the correct provider region.
If the model list is empty, check the connection URL, credential permissions and whether the provider publishes a model listing. Follow its documented model-ID configuration when it does not. An authentication failure, missing model and timeout have different causes; repeatedly replacing credentials without identifying the response is unlikely to help.
Open WebUI persists some settings in its database. The environment reference explains that persisted ConfigVar values can override later environment changes. Review the Admin settings before concluding that an environment edit failed. Do not delete the data volume to reset one setting.
Back up, restore and control expansion
Back up application data and the matching secret as one recovery set. For this single-instance example, pause the service, copy its data from the stopped container into a new restricted directory and restart it. The download's README gives the complete commands. A live file copy of an actively changing database is not the acceptance target.
Move an encrypted copy to independent storage, record the image digest and keep the Compose file. Rehearse restoration onto a separate instance with a fresh volume. Confirm login, expected chat history, provider configuration and a non-sensitive request. A copied directory is a backup candidate until recovery succeeds.
Use our Linux backup guide to plan the independent copy. Treat backups as sensitive because they can contain conversations, uploaded information and configuration. Apply a retention policy to the recovery copies as well as the running application.
For upgrades, read release notes, take a recoverable backup and trial the new pinned image against a separate copy first. Database changes can make a simple image downgrade insufficient. Keep the prior image reference, but rely on the tested data recovery procedure when rollback requires it.
Before adding document uploads, embeddings, web search or executable tools, repeat the data-boundary review. Each feature can introduce additional network destinations or privileges. Start with basic chat and add one capability with its own acceptance check.
If the private trial becomes a shared public service, plan an authenticated HTTPS reverse proxy with the application's documented streaming and WebSocket requirements. Update the application URL and test authentication, uploads and long responses through that proxy before inviting users. The SSH-only example intentionally remains usable without publishing an unfinished service.
Compare the operating work with your team's needs in managed apps versus self-hosting. If you want to operate the interface yourself, explore DanubeData VPS hosting and choose inference separately.
Frequently asked questions
Does a European VPS make every conversation stay in Europe?
No. It establishes the interface's hosting location. Verify inference, embeddings, tools and backup destinations separately, including the terms of any external provider.
Does this installation need a GPU?
The example runs the interface and uses a separate model service. A local inference deployment needs its own hardware assessment; this guide makes no GPU hosting availability claim.
Can I open port 3000 for colleagues?
Keep it private during setup. For broader access, use a reviewed HTTPS and authentication design or a private VPN, then test the whole route. Do not expose an unconfigured first-account screen.
What must survive a container replacement?
The persistent data volume and matching application secret are the starting point. Preserve any additional services, provider configuration and encryption material your expanded setup uses, and prove restoration independently.
Sources
Getting started; Docker quick start; environment settings; first administrator security; 0.12.5 release.
