Receive Open WebUI ready to use rather than merely installed? The AI Cube combines Open WebUI, a local model, hardening, functional testing, and initial setup into a prepared business AI platform. Without hardware of your own, Open WebUI with models operated in Germany by German providers is available as the AI platform. Explore the AI Cube
Open WebUI is the interface through which staff actually use local AI. It resembles familiar AI chats, can present several models, and manages knowledge, users, groups, and other workspace resources. Production requires the interface to be embedded into a complete platform.
What users receive
- chat with one or more approved models;
- history and workspaces on the organisation's platform;
- file uploads and personal knowledge collections;
- shared team knowledge after approval;
- models, prompts, and tools according to role;
- one interface for local and deliberately approved external models.
These capabilities do not mean an external source is already integrated. Users can maintain knowledge in Open WebUI. For automatic syncing, the official tool oikb has been available since 2026 (MIT licence, v0.5.0 as of October 2026, requires Open WebUI 0.9.6 or later): it syncs knowledge bases from many sources, including Nextcloud and SharePoint, incrementally and including deleted files (documentation). Access is controlled via the knowledge base in Open WebUI; the documentation does not describe carrying over document permissions from the source. If users should only see passages they may also open in the source, a dedicated pipeline with permission checks is still required.
The guide to RAG with Nextcloud, SharePoint, and DMS explains how such a connection is built.
The platform underneath
Model endpoint
Ollama, vLLM, or another compatible runtime serves the local model. Model release, quantisation, context, and concurrency are documented. The endpoint is not exposed directly.
Database and storage
Chat history, users, configuration, and metadata need persistent storage. Files and knowledge artefacts use defined volumes or object storage. Backup and recovery must cover both together.
Identity and permissions
Business operation uses local accounts or OIDC/SSO, groups, and minimal defaults. Access to models, knowledge, and tools is deliberate. Administration is separated from normal use.
Network
TLS, internal DNS, firewall, and potentially VPN or NetBird constrain access. Web interface, model server, database, and administration do not need to share one exposed segment.
Minimum standard for production
| Area | Define before release |
|---|---|
| Identity | local accounts or SSO/OIDC or LDAP, MFA at the identity provider, and a managed user lifecycle |
| Authorisation | default role, administrators, groups, and access to models, knowledge, and tools |
| Data | storage locations for chats, uploads, knowledge artefacts, database, logs, and backups |
| Models | approved local and optional external endpoints with unambiguous labels |
| Operations | update path, maintenance window, monitoring, restore test, rollback, and incident responsibility |
| Access | internal use, VPN, NetBird, or reverse proxy with a separate administration path |
These decisions turn an installation into an operable service. They should be documented before several teams store production data on the platform.
Updates without uncontrolled downtime
Open WebUI and the model runtime evolve independently. Updates require release review, backup, test, maintenance window, and rollback. Unreviewed automatic upgrades are unsuitable for a production platform.
Model changes also require evaluation against the same work tasks. A higher version number does not replace quality testing.
Monitoring and backup
Monitor availability, latency, errors, memory, storage, services, and backup status. Content prompts do not need to be sent wholesale to external monitoring. Logs should be limited to what operations require.
A restore test verifies that database, files, keys, and configuration recover together. A backup without a tested restart is not reliable evidence of recoverability.
AI Cube as a prepared foundation
For the AI Cube, WZ-IT installs Open WebUI, local runtime, and an agreed model, configures and hardens the base system, and tests function. Initial setup and briefing are included in the purchase price of €7,999 excl. VAT. The platform is usually ready within two weeks after configuration approval.
Patching, backup, monitoring and support are covered by AI Cube Care from €349.90 excl. VAT per month; the first twelve months run with the device, after that Care is cancellable monthly. SSO, automated sources, custom RAG pipelines, MCP servers, special backup targets, and secure site connectivity are planned as extensions for the existing environment.
Sources
- Open WebUI: Knowledge
- Open WebUI: authentication and access
- Open WebUI: groups and resource access
- Open WebUI: permissions
- Open WebUI: Knowledge Base Sync (oikb)
- oikb on GitHub
- WZ-IT: Open WebUI expertise
Further reading: Set up Open WebUI SSO, Self-hosting SearXNG, Web search in Open WebUI: providers compared
