a13labs.infra/terraform/modules/apps/open-webui/main.tf

resource "kubernetes_namespace" "openwebui" {
  metadata {
    name = "openwebui"
  }
}

resource "kubernetes_service_account" "openwebui" {

  metadata {
    name      = "openwebui-sa"
    namespace = kubernetes_namespace.openwebui.metadata[0].name
  }

  automount_service_account_token = false
}

resource "kubernetes_manifest" "internal_cert" {

  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "Certificate"
    metadata = {
      name      = "internal-cert"
      namespace = kubernetes_namespace.openwebui.metadata[0].name
    }
    spec = {
      secretName = "internal-cert"
      issuerRef = {
        name = var.issuer
        kind = "ClusterIssuer"
      }
      commonName = var.fqdn
      dnsNames   = [var.fqdn]
    }
  }
}

resource "kubernetes_deployment" "openwebui" {
  metadata {
    name      = "openwebui"
    namespace = kubernetes_namespace.openwebui.metadata[0].name
    labels = {
      openwebui = "openwebui"
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        openwebui = "openwebui"
      }
    }

    strategy {
      type = "Recreate"
    }

    template {
      metadata {
        labels = {
          openwebui = "openwebui"
        }
      }

      spec {
        service_account_name            = kubernetes_service_account.openwebui.metadata[0].name
        automount_service_account_token = false

        container {
          name  = "openwebui-container"
          image = "ghcr.io/open-webui/open-webui:${local.app_version}"

          security_context {
            allow_privilege_escalation = false
          }

          port {
            name           = "http"
            container_port = 8080
          }

          readiness_probe {
            tcp_socket {
              port = 8080
            }
            initial_delay_seconds = 5
            period_seconds        = 10
            failure_threshold     = 10
          }

          volume_mount {
            name       = "openwebui-data"
            mount_path = "/app/backend/data"
          }
        }

        volume {
          name = "openwebui-data"
          host_path {
            path = local.app_path
          }
        }
      }
    }
  }
}

resource "kubernetes_service" "openwebui" {
  metadata {
    name      = "http"
    namespace = kubernetes_namespace.openwebui.metadata[0].name
  }

  spec {
    selector = {
      openwebui = "openwebui"
    }

    port {
      name        = "http"
      port        = 8080
      target_port = 8080
    }

    cluster_ip = "None"
  }

  lifecycle {
    ignore_changes = [
      metadata[0].annotations
    ]
  }
}

resource "kubernetes_ingress_v1" "openwebui" {
  metadata {
    name      = "ingress"
    namespace = kubernetes_namespace.openwebui.metadata[0].name

    annotations = {
      "nginx.ingress.kubernetes.io/ssl-redirect" = "true"
    }
  }
  spec {
    tls {
      hosts       = [local.app_fqdn]
      secret_name = "internal-cert"
    }
    rule {
      host = local.app_fqdn
      http {
        path {
          backend {
            service {
              name = "http"
              port {
                number = 8080
              }
            }
          }
        }
      }
    }
  }
}