Install Ollama on a VPS: Open WebUI, HTTPS with Traefik and n8n Integration

Ollama runs language models such as Llama, Qwen or Mistral on your own server; Ollama runs locally (Ollama FAQ, as of Nov 8, 2026).

For this you need a VPS (Virtual Private Server, a virtual server in a data center) with enough memory for your model; how much is covered in the section "Models and memory requirements".

In this guide you install Docker, secure the server with a firewall, start Ollama with the Open WebUI web interface and set up HTTPS with Traefik.

Prerequisites

You need:

• A VPS with enough memory for your model (sizes in the section "Models and memory requirements"; the Ollama calculator estimates the total). Plans and prices incl. VAT are in the VPS comparison.
• Ubuntu in a Docker-supported version, such as 22.04, 24.04 or 26.04 LTS (Docker docs, as of Nov 8, 2026)
• SSH access to the server
• Optional: a domain for HTTPS

Step 1: Install Docker

Install Docker from the apt repository as the Docker docs describe. Per Docker, the convenience script get.docker.com is not meant for production (Docker docs, as of Nov 8, 2026).

# Add Docker's GPG key
sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
sudo apt update

# Install Docker Engine and the Compose plugin
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Members of the docker group have root privileges (Docker docs, as of Nov 8, 2026). The commands in this guide omit sudo; if you are not in the docker group, prefix them with sudo.

Step 2: Set up the firewall

Allow SSH before ufw enable, otherwise the connection may drop; incoming traffic is denied by default (Ubuntu manpage, as of Nov 8, 2026). If SSH runs on another port, allow that port. Traefik needs ports 80 and 443 in step 5.

sudo ufw allow proto tcp from any to any port 22
sudo ufw allow proto tcp from any to any port 80
sudo ufw allow proto tcp from any to any port 443
sudo ufw enable

Ports published by Docker bypass ufw (Docker docs, as of Nov 8, 2026). Without a host address, Docker publishes a port on all addresses (Docker docs, as of Nov 8, 2026). That is why Ollama publishes no port in this guide, and Open WebUI is bound to 127.0.0.1:3000 only until the HTTPS step.

Step 3: Start Ollama and Open WebUI with Docker Compose

Ollama runs as the ollama service with the ollama/ollama image; models are stored in the ollama volume (Ollama docs, as of Nov 8, 2026). Ollama is also available as a Linux installation without Docker (Ollama docs, as of Nov 8, 2026). Open WebUI is a web interface for Ollama; chats, users and settings live in the open-webui volume (Open WebUI docs, as of Nov 8, 2026).

Create a directory and generate a key for WEBUI_SECRET_KEY with openssl rand -hex 32 (Open WebUI docs, as of Nov 8, 2026):

mkdir -p ~/ollama && cd ~/ollama
openssl rand -hex 32

Create the file compose.yaml there and insert the key:

services:
  ollama:
    image: ollama/ollama
    restart: always
    volumes:
      - ollama:/root/.ollama
    networks:
      - ollama-net

  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    restart: always
    ports:
      - "127.0.0.1:3000:8080"
    volumes:
      - open-webui:/app/backend/data
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
      - WEBUI_SECRET_KEY=YOUR_KEY
    networks:
      - ollama-net

networks:
  ollama-net:
    name: ollama-net

volumes:
  ollama:
  open-webui:

Open WebUI reaches Ollama via the service name; OLLAMA_BASE_URL sets the address (Open WebUI docs, as of Nov 8, 2026). With name: ollama-net, the network gets exactly this name without a project prefix; containers from other Compose projects can then join it (Docker docs, as of Nov 8, 2026). You don't need a version line; it is obsolete (Docker docs, as of Nov 8, 2026).

docker compose up -d

From your computer, open an SSH tunnel with ssh -L 3000:127.0.0.1:3000 user@SERVER-IP (Ubuntu manpage, as of Nov 8, 2026) and open http://localhost:3000. Create the admin account right away: the first account becomes administrator; after that, open sign-up is disabled, and accounts that still register wait as "pending" for approval (Open WebUI docs, as of Nov 8, 2026).

Then check from your computer that http://SERVER-IP:3000 and http://SERVER-IP:11434 do not respond.

Step 4: Download your first model

The llama3.2 tag points to the 3B variant with 2.0 GB (Ollama library, as of Nov 8, 2026). You run Ollama commands inside the container (Ollama docs, as of Nov 8, 2026):

docker compose exec ollama ollama pull llama3.2

Try the model:

docker compose exec ollama ollama run llama3.2
>>> Write a haiku about server hosting

Tip: On the first call, Ollama loads the model into memory; it stays loaded for five minutes by default (Ollama FAQ, as of Nov 8, 2026).

Step 5: Set up HTTPS with Traefik

Open WebUI does not terminate TLS itself; a reverse proxy handles HTTPS (Open WebUI docs, as of Nov 8, 2026). Replace compose.yaml with this version. The ollama service stays the same; Open WebUI loses ports:

services:
  traefik:
    image: traefik:v3.7
    restart: always
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      - [email protected]
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./letsencrypt:/letsencrypt
    networks:
      - ollama-net

  ollama:
    image: ollama/ollama
    restart: always
    volumes:
      - ollama:/root/.ollama
    networks:
      - ollama-net

  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    restart: always
    volumes:
      - open-webui:/app/backend/data
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
      - WEBUI_SECRET_KEY=YOUR_KEY
      - WEBUI_SESSION_COOKIE_SECURE=true
    networks:
      - ollama-net
    labels:
      - traefik.enable=true
      - traefik.http.routers.webui.rule=Host(`chat.yourdomain.com`)
      - traefik.http.routers.webui.entrypoints=websecure
      - traefik.http.routers.webui.tls.certresolver=letsencrypt
      - traefik.http.services.webui.loadbalancer.server.port=8080

networks:
  ollama-net:
    name: ollama-net

volumes:
  ollama:
  open-webui:

Then run docker compose up -d. About the settings:

• The traefik:v3.7 image matches the Traefik docs (Traefik docs, as of Nov 8, 2026).
• exposedByDefault defaults to true; with false, Traefik only routes containers with traefik.enable=true. loadbalancer.server.port sets the Open WebUI port (Traefik docs, as of Nov 8, 2026).
• The Traefik API and dashboard stay off; the docs do not recommend them in production (Traefik docs, as of Nov 8, 2026).
• Traefik reads container labels via the Docker socket. According to the Traefik docs, unrestricted access to the Docker API is a security risk; the docs name alternatives such as a filtering socket proxy (Traefik docs, as of Nov 8, 2026).
• WEBUI_SESSION_COOKIE_SECURE=true belongs behind HTTPS (Open WebUI docs, as of Nov 8, 2026).
• Docker publishes 80 and 443 bypassing ufw (Docker docs, as of Nov 8, 2026); that is intended here.

Tip: Replace chat.yourdomain.com with your domain, whose DNS A record points to the server IP. Port 80 must be reachable for Let's Encrypt (Traefik docs, as of Nov 8, 2026).

Bonus: Connect Ollama with n8n

n8n includes Ollama nodes that access your server via an Ollama credential (n8n docs, as of Nov 8, 2026).

If n8n runs in its own Compose project as in the n8n guide, add the ollama-net network there as an external network (Docker docs, as of Nov 8, 2026):

services:
  n8n:
    networks:
      - default
      - ollama-net

networks:
  ollama-net:
    external: true

default keeps n8n connected to the database of its project. Then restart n8n with docker compose up -d.

If you set up Caddy for n8n on the same server as in the n8n guide, Caddy uses ports 80 and 443 just like Traefik; both cannot start at once. Then skip step 5: Open WebUI stays bound to 127.0.0.1:3000 as in step 3, you add a block chat.yourdomain.com with reverse_proxy 127.0.0.1:3000 to the Caddyfile (Caddy docs, as of Nov 8, 2026) and set WEBUI_SESSION_COOKIE_SECURE=true for Open WebUI (Open WebUI docs, as of Nov 8, 2026).

1. Create an Ollama credential. The base URL defaults to http://localhost:11434 according to the n8n docs; containers in the same Docker network reach Ollama by service name, here http://ollama:11434. Leave the API key field empty (n8n docs, as of Nov 8, 2026).
2. Select the model, such as llama3.2.
3. Connect the node to a trigger in your workflow.

Use cases:

• Summarize and categorize emails
• Analyze and prioritize support tickets
• Create content for social media
• Convert documents into structured data

Performance tuning

You set these options as environment variables on the ollama service in compose.yaml (Ollama FAQ, as of Nov 8, 2026) and apply them with docker compose up -d.

Context length

Ollama uses a context of 4096 tokens by default; OLLAMA_CONTEXT_LENGTH changes this. In interactive mode, use /set parameter num_ctx 8192 (Ollama FAQ, as of Nov 8, 2026).

  ollama:
    environment:
      - OLLAMA_CONTEXT_LENGTH=8192
      - OLLAMA_KEEP_ALIVE=10m

Keep models loaded

Models stay loaded for five minutes by default. OLLAMA_KEEP_ALIVE changes this and accepts a duration such as 10m or 24h, a number of seconds, a negative value (stays loaded) or 0 (unload at once). An empty call preloads the model (Ollama FAQ, as of Nov 8, 2026):

docker compose exec ollama ollama run llama3.2 ""

OLLAMA_MAX_LOADED_MODELS limits the number of loaded models (three by default on CPU), OLLAMA_NUM_PARALLEL the parallel requests per model (one by default). Memory needs grow with OLLAMA_NUM_PARALLEL × OLLAMA_CONTEXT_LENGTH (Ollama FAQ, as of Nov 8, 2026).

Monitoring

ollama ps shows the loaded models (Ollama docs, as of Nov 8, 2026):

docker compose exec ollama ollama ps

Models and memory requirements

Size and context length of common models in the Ollama library:

On top of the file size comes memory for the context: it grows with OLLAMA_NUM_PARALLEL × OLLAMA_CONTEXT_LENGTH (Ollama FAQ, as of Nov 8, 2026). Ollama uses 4096 tokens by default, even if the model allows more. Add the operating system, Docker, Open WebUI and Traefik. The Ollama calculator estimates the total.

RackDiff currently does not list GPU servers; on a VPS, Ollama computes on the CPU. How fast a model responds depends on CPU, model size and context.

Common problems

Open WebUI or n8n cannot find Ollama

1. Are the containers in the ollama-net network? docker network inspect ollama-net shows the connected containers.
2. Is the base URL set to http://ollama:11434? In Open WebUI, OLLAMA_BASE_URL sets it (Open WebUI docs, as of Nov 8, 2026).
3. Ollama is deliberately unreachable from outside: the service publishes no port.

Not enough memory

Use a smaller model or variant, such as llama3.2:1b with 1.3 GB (Ollama library, as of Nov 8, 2026) or llama3.1:8b-instruct-q4_0 with 4.7 GB (Ollama library, as of Nov 8, 2026), or reduce OLLAMA_CONTEXT_LENGTH.

Slow responses

On the CPU, speed depends on CPU, model size and context; a smaller model or a shorter context reduces the load. RackDiff currently does not list GPU servers.

Conclusion

You now run Ollama with Open WebUI and HTTPS on your own server. Updates, backups and security are up to you.

For updates, run docker compose pull in the ~/ollama directory to fetch new images and start with docker compose up -d. Compose recreates changed containers and keeps the mounted volumes (Docker docs, as of Nov 8, 2026).

You can run other services on the same VPS, such as Vaultwarden as a password manager or Immich for photos; plan for their memory needs.

More Self-Hosting Guides

n8n Self-Hosting Guide

Docker Setup Schritt für Schritt

Lesen

VPS Vergleich 2026

Anbieter und Tarife im Überblick

Lesen

Vaultwarden Setup

Bitwarden auf eigenem Server

Lesen