github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-07-16 06:03:26 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[GH-ISSUE #16018] feat: Allow websocket to connect to external Redis over TLS #33284

New Issue
Closed
opened 2026-04-25 07:12:18 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-25 07:12:18 -05:00
Owner
Copy Link

Originally created by @erhhung on GitHub (Jul 25, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/16018

Check Existing Issues

  • I have searched the existing issues and discussions.

Problem Description

I am attempting to install Open WebUI via Helm chart, and have provided the following chart values relevant to the websocket connection to an existing Valkey cluster:

websocket:
  enabled: true
  manager: redis
  redis:
    enabled: false
  url: rediss://:secret@valkey-0-svc.valkey.svc.cluster.local:6379/0

Since the Valkey cluster requires connections over TLS (and optionally mTLS), and that TLS cert was issued by a private CA, I know I need to either disable server certificate verification or provide the CA cert to the Redis client.

But I couldn't find any environment variables related to such settings.
So, as expected, this is the output from the open-webui-0 container:

2025-07-25 03:30:36.788 | ERROR | asyncio.runners:run:118 - Task exception was never retrieved
future: <Task finished name='Task-3' coro=<periodic_usage_pool_cleanup() done, defined at
/app/backend/open_webui/socket/main.py:133> exception=ConnectionError('Error 1
connecting to valkey-0-svc.valkey.svc.cluster.local:6379. [SSL: CERTIFICATE_VERIFY_FAILED]
certificate verify failed: unable to get local issuer certificate (_ssl.c:1016).')>

Desired Solution you'd like

Either an interim workaround to disable TLS certificate verification on external Redis connections, or provide addtional environment variables to fully support mTLS connections.

Suggested environment variables:

  • REDIS_USE_TLS — True or False (default)
  • REDIS_CA_CERTIFICATE — path to CA cert file, e.g. /certs/ca.crt
  • REDIS_CLIENT_CERTIFICATE — path to client cert file, e.g. /certs/tls.crt
  • REDIS_CLIENT_KEY — path to client key file, e.g. /certs/tls.key

Alternatives Considered

No response

Additional Context

No response

Originally created by @erhhung on GitHub (Jul 25, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/16018 ### Check Existing Issues - [x] I have searched the existing issues and discussions. ### Problem Description I am attempting to install Open WebUI via Helm chart, and have provided the following chart values relevant to the websocket connection to an existing Valkey cluster: ```yaml websocket: enabled: true manager: redis redis: enabled: false url: rediss://:secret@valkey-0-svc.valkey.svc.cluster.local:6379/0 ``` Since the Valkey cluster requires connections over TLS (and optionally mTLS), and that TLS cert was issued by a private CA, I know I need to either disable server certificate verification or provide the CA cert to the Redis client. But I couldn't find any [environment variables](https://docs.openwebui.com/getting-started/env-configuration/#redis) related to such settings. So, as expected, this is the output from the `open-webui-0` container: ``` 2025-07-25 03:30:36.788 | ERROR | asyncio.runners:run:118 - Task exception was never retrieved future: <Task finished name='Task-3' coro=<periodic_usage_pool_cleanup() done, defined at /app/backend/open_webui/socket/main.py:133> exception=ConnectionError('Error 1 connecting to valkey-0-svc.valkey.svc.cluster.local:6379. [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1016).')> ``` ### Desired Solution you'd like Either an **interim workaround** to **disable TLS certificate verification** on external Redis connections, or provide **addtional environment variables** to fully support mTLS connections. Suggested environment variables: * `REDIS_USE_TLS` — `True` or `False` _(default)_ * `REDIS_CA_CERTIFICATE` — path to CA cert file, e.g. `/certs/ca.crt` * `REDIS_CLIENT_CERTIFICATE` — path to client cert file, e.g. `/certs/tls.crt` * `REDIS_CLIENT_KEY` — path to client key file, e.g. `/certs/tls.key` ### Alternatives Considered _No response_ ### Additional Context _No response_
GiteaMirror commented 2026-04-25 07:12:19 -05:00
Author
Owner
Copy Link

@tjbck commented on GitHub (Jul 25, 2025):

PR Welcome!

<!-- gh-comment-id:3117910021 --> @tjbck commented on GitHub (Jul 25, 2025): PR Welcome!
GiteaMirror commented 2026-04-25 07:12:19 -05:00
Author
Owner
Copy Link

@erhhung commented on GitHub (Jul 25, 2025):

Upon further investigation, it turns out that TLS connections are already supported through redis-py's ability to accept connection options as query params directly in the Redis connection URL (see examples).

So, using a rediss:// connection URL like the following works:

rediss://:secret@valkey-0-svc.valkey.svc.cluster.local:6379/0?ssl_cert_reqs=required&ssl_certfile=/tls/valkey/tls.crt&ssl_keyfile=/tls/valkey/tls.key&ssl_ca_certs=/tls/valkey/ca.crt

The query param names are the same as the kwarg param names of the Redis client.

In my case, though, getting past this TLS issue isn't the only problem, as my Valkey cluster requires cluster support on the client-side by using redis.cluster.RedisCluster and redis.asyncio.cluster.RedisCluster, which isn't implemented in utils/redis.py at the moment.

So I'll close this issue and file a separate one for cluster mode support...

<!-- gh-comment-id:3120517369 --> @erhhung commented on GitHub (Jul 25, 2025): Upon further investigation, it turns out that TLS connections are **already** supported through `redis-py`'s ability to accept connection options as query [params](https://redis.readthedocs.io/en/stable/connections.html) directly in the Redis connection URL _(see [examples](https://redis.readthedocs.io/en/stable/examples/ssl_connection_examples.html))_. So, using a `rediss://` connection URL like the following works: ``` rediss://:secret@valkey-0-svc.valkey.svc.cluster.local:6379/0?ssl_cert_reqs=required&ssl_certfile=/tls/valkey/tls.crt&ssl_keyfile=/tls/valkey/tls.key&ssl_ca_certs=/tls/valkey/ca.crt ``` The query param names are the same as the kwarg param names of the Redis client. In my case, though, getting past this TLS issue isn't the only problem, as my Valkey **cluster** requires cluster support on the client-side by using `redis.cluster.RedisCluster` and `redis.asyncio.cluster.RedisCluster`, which isn't implemented in [`utils/redis.py`](/open-webui/open-webui/blob/main/backend/open_webui/utils/redis.py) at the moment. So I'll close this issue and file a separate one for cluster mode support...
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#33284
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?