Run Your Own AI Chat on a VPS With Ollama and Open WebUI (and Give It a Domain)

A year or two ago, running your own AI chat meant a GPU, a pile of Python and a weekend. Now it's two containers. Ollama runs open models like Llama, Qwen, Gemma or Mistral. Open WebUI gives you a ChatGPT-style interface on top, with accounts, chat history and file uploads.

Why bother when hosted chat apps exist? Privacy is the big one: prompts and documents never leave your server. Cost is another if you use it a lot. And it's a good way to learn how these models behave without an API bill.

This guide sets it up on a VPS and puts it on an address like https://chat.digitalweb.host. It also covers the one mistake you must not make.

The mistake first

Ollama's API has no authentication. If port 11434 is reachable from the internet, anyone can send it prompts, download your models or pull new ones onto your disk. Security researchers scanning the internet keep finding Ollama servers left wide open like this.

The rule for this whole setup: Ollama stays private. Only Open WebUI, which has logins, faces the internet.

What you need

• A VPS with 8 GB of RAM or more for small models on the CPU. 4 GB works for the tiniest models but feels cramped.
• Disk space: models are a few GB each. Budget 20 GB or more.
• Docker installed (see our VPS deploy guide if you're starting from scratch).

Set your expectations about speed. On a CPU-only VPS, a 3B or 4B model answers at reading speed, more or less. A 70B model won't fit at all. If you need big models, look at a GPU server.

Step 1: Run both containers on a private network

One compose.yaml keeps Ollama off the internet by never publishing its port:

services:
  ollama:
    image: ollama/ollama
    restart: unless-stopped
    volumes:
      - ollama:/root/.ollama
    # No "ports:" here on purpose. Only Open WebUI can reach Ollama.

  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    restart: unless-stopped
    depends_on:
      - ollama
    ports:
      - "3000:8080"
    environment:
      OLLAMA_BASE_URL: http://ollama:11434
    volumes:
      - open-webui:/app/backend/data

volumes:
  ollama:
  open-webui:

Start it:

docker compose up -d

Both containers share Compose's default network, so Open WebUI reaches Ollama at http://ollama:11434 while the outside world can't reach it at all.

Step 2: Pull a model

docker compose exec ollama ollama pull llama3.2:3b

Swap in any model from the Ollama library. Start small, see how fast it answers on your hardware, then try bigger ones.

Step 3: Create your admin account right away

Open http://YOUR_SERVER_IP:3000 (after allowing port 3000 in your provider's firewall). The first account created on Open WebUI becomes the admin, so create yours before anyone else finds the page.

Then close the door behind you. Add this to the open-webui environment and run docker compose up -d again:

      ENABLE_SIGNUP: "False"

You can still invite people from the admin panel.

Step 4: Give it a real address with HTTPS

You don't want to type an IP and a port on your phone. Browsers also treat plain HTTP pages as not secure. Some features, like using your microphone for voice input, only work over HTTPS.

With DomainDock:

1. Create a project and add a domain, for example chat.
2. Enter your server's IP and port 3000.
3. Wait for the connection test to pass and the route to go active.

You now have https://chat.digitalweb.host with a valid certificate. Open WebUI keeps running on plain HTTP inside your server. The gateway handles HTTPS and forwards requests to port 3000.

Prefer your own domain and proxy? Caddy in front of port 3000 with a two-line config does the same job.

Step 5: Lock it down

A few more minutes here keeps the server yours:

• Check that Ollama really is private. From your laptop, curl http://YOUR_SERVER_IP:11434 should time out or be refused.
• Use a strong password on the admin account. Open WebUI is now a login page on the public internet.
• Keep images updated. docker compose pull && docker compose up -d once a week. Open WebUI ships often.
• Watch the disk. Models are big. docker system df shows what's using space.
• Know when it's down. DomainDock checks the route every 5 minutes and shows a status page to anyone who visits while the server is unreachable.

What it costs

A VPS with 8 GB of RAM runs from roughly $10 to $20 a month depending on the provider. The domain and HTTPS from DomainDock are free. The software is open source. If you use hosted AI chat heavily or care about keeping prompts private, that's a fair trade.

Common problems

"Ollama: connection refused" in Open WebUI. Check that OLLAMA_BASE_URL uses the service name (http://ollama:11434), not localhost. Inside a container, localhost means the container itself.

Answers are painfully slow. The model is too big for the CPU. Try a smaller one, or a quantized version.

The container keeps restarting. Usually out of memory. docker compose logs ollama will say so. A smaller model or a bigger server fixes it.

Ready to put your AI chat online? Point a free domain at your server and you're done in a minute.