Private ChatGPT replacement

Single 4090 is overkill but pleasant. RTX 3090 (24 GB) is the budget default. Apple M3 Max 64 GB is the silent-laptop alternative — same UX, lower throughput.

The killer optimization: keep one model in residence; let Ollama auto-evict. Two large models swapping in/out of VRAM is the #1 performance complaint here.

For 5-user concurrency: bump to vLLM (see /workflows/local-coding-agent-system) — Ollama serializes per loaded model.

Plan 150 GB: 3-5 model weights at ~10-15 GB each, conversation history (1 MB / month / user), embeddings index (~50 MB / 100 K chunks).

Conversations are the user-data layer. Back them up. Open WebUI stores them in SQLite under a Docker volume; docker run --rm -v webui_data:/data -v $(pwd)/backup:/backup alpine tar czf /backup/webui-$(date +%F).tgz /data is the lazy nightly cron.

Tailscale + Open WebUI is the recommended path. The web UI binds to 0.0.0.0 inside Docker; the host binds 127.0.0.1:8080; Tailscale wraps it.

If multiple household members need access from outside the LAN: each gets a Tailscale device. MagicDNS makes workstation.tail-net.ts.net resolve.

Never publish 8080 to the public internet. Open WebUI's auth is fine for trusted users on private networks; do not stress-test it against attackers.

Lighter than the production workflows. Watch:

• Ollama load time (first token after model swap). >5s means VRAM contention; close other GPU consumers.
• Conversation count growth. SQLite backing store gets slow past ~10K conversations / user; archive or rotate.
• Disk usage on the Open WebUI volume.

Grafana is overkill; docker stats + a weekly disk-usage check are sufficient.

Default-disable signup. OPEN_WEBUI_SIGNUP=false. Add accounts manually.

Strong owner password. Don't reuse credentials. Open WebUI's auth uses bcrypt — fine — but treat the admin account like a bastion.

Conversation privacy. SQLite stores plaintext. Encrypt the host volume (LUKS) if your threat model includes physical workstation theft.

Memory plugin. If you enable Open WebUI's memory feature, remember it reads / writes to the same vector store as RAG. Don't store secrets there.

Multi-user (5+): swap Ollama → vLLM with batching; add per-user API keys; consider LiteLLM as a proxy.

Bigger models (32-70B): add VRAM. Single 4090 caps at 32B; dual 3090 / dual 4090 unlocks 70B. See /workflows/local-coding-agent-system.

Document chat: enable Open WebUI's RAG plugin; pre-warm the embeddings model in Ollama so first ingest doesn't cold-start.

Voice: integrate Whisper + Piper as a per-conversation voice mode. See /workflows/local-voice-assistant for the full pattern.

1. Model thrashing when users switch models per-conversation. Either keep one model loaded or bump VRAM.
2. Open WebUI auto-update on Docker pulls a new image with breaking config changes. Pin the image SHA.
3. SQLite write contention at 10+ concurrent active users. Migrate to Postgres backing store before you hit this.
4. Ollama port-conflict with other services on 11434. See /errors/ollama-bind-port-conflict.