Qwen Deployment Overview on Server¶

Prerequisites¶

The following system parameters are required for the application to function correctly:

• Operating System: Ubuntu (version 22.04 with HWE kernel is recommended).

• Access Rights: root privileges for installing drivers and system dependencies.

• Ports:

• 8080 — internal application port (Ollama/OpenWebUI).

• 443 — external port for HTTPS access.

FQDN of the final panel on hostkey.in domain¶

Domain name template for interface access:

File and Directory Structure¶

Main paths to data and configurations:

• /root/nginx — working directory for the Nginx container (contains compose.yml).

• /data/nginx/user_conf.d — directory with custom Nginx configurations.

• /data/nginx/nginx-certbot.env — environment variables file for SSL.

• /app/backend/data (inside the container) — OpenWebUI data storage.

Application Installation Process¶

Deployment includes the following stages:

1. Update system packages and install linux-generic-hwe-22.04 kernel.

2. Install NVIDIA drivers (if a GPU is detected) and the ubuntu-drivers-common utility.

3. Install the Ollama runtime via the official script.

4. Download the qwen3.6:35b model into Ollama.

5. Deploy the OpenWebUI container for interacting with the model.

6. Configure the Nginx reverse proxy with automatic SSL certificate acquisition via Certbot.

Access Rights and Security¶

• Users: A system user ollama is created to run Ollama without login capabilities (/bin/false).

• Firewall: Access is provided through the standard HTTPS port 443.

• Docker Security: The OpenWebUI container is launched using host network mode for direct interaction with the local Ollama service.

Databases¶

The application uses built-in data storage mechanisms inside the OpenWebUI container via the open-webui named volume. An external database is not required, as the model operates through the local Ollama service API (http://127.0.0.1:11434).

Docker Containers and Execution¶

Two types of container environments are deployed in the system:

Nginx (Reverse Proxy)¶

• Image Name: jonasal/nginx-certbot:latest

• Ports: 8080 (internal), 443 (external, via host mode).

• Volumes:

• nginx_secrets:/etc/letsencrypt — SSL certificates.

• /data/nginx/user_conf.d:/etc/nginx/user_conf.d — site configurations.

• Environment Variables: [email protected].

• Restart Policy: unless-stopped.

OpenWebUI (Interface)¶

• Image Name: ghcr.io/open-webui/open-webui:main

• Ports: Uses host network mode.

• Volumes: open-webui:/app/backend/data.

• Environment Variables: OLLAMA_BASE_URL=http://127.0.0.1:11434.

• Restart Policy: always.

Application Update Instructions¶

Updates are performed by restarting containers and updating images:

docker compose pull && docker compose up -d

For the Nginx service, it is possible to reload the configuration without stopping the container: docker exec nginx-nginx-1 nginx -s reload

Permissions Settings¶

• The /root/nginx directory has 0755 permissions, owner root.

• Configuration files in /root/nginx/compose.yml have 0644 permissions.

• The ollama user is added to the render and video groups for GPU hardware acceleration access.

Location of Configuration Files and Data¶

Available Connection Ports¶

• HTTPS: 443 — primary port for web interface access.

Starting and Stopping the Application¶

Managing the Nginx container:

• Stop: docker compose down (in /root/nginx directory).

• Start: docker compose up -d.

Managing the Ollama service:

• systemctl start ollama

• systemctl stop ollama

• systemctl restart ollama

Proxy Servers¶

The nginx-certbot is used as a reverse proxy. It provides automatic acquisition and renewal of Let's Encrypt SSL certificates. Traffic arriving on port 443 is redirected (proxy_pass) to the local address http://127.0.0.1:8080 within a secure tunnel.