OpenWebUI RollCalc Pipe

rollcalc_pipe.py registers RollCalc Assistant as a selectable OpenWebUI Pipe model. It does not call an OpenWebUI chat model and contains no engineering logic. Each user message is forwarded to the existing authenticated RollCalc conversation API, and only its deterministic message plus a safe report link is rendered.

Deployment discovery

The OpenWebUI runtime was not visible from the coding sandbox: the Docker socket was inaccessible, no native OpenWebUI files/processes were visible, and the usual local ports were not reachable. Run these commands directly on fertigungski before enabling the Pipe:

docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Ports}}'
docker inspect <openwebui-container> --format '{{json .NetworkSettings.Networks}}'
docker exec <openwebui-container> python -c \
  'from importlib.metadata import version; print(version("open-webui"))'

For a native installation, use:

systemctl list-units --type=service | grep -i open-webui
python3 -c 'from importlib.metadata import version; print(version("open-webui"))'

Also verify the actual route in both network contexts:

# From the OpenWebUI container/server namespace
curl -u "$ROLLCALC_USERNAME:$ROLLCALC_PASSWORD" \
  "$ROLLCALC_API_BASE_URL/api/health"

# From a demo user's browser/network (run on a representative workstation)
curl -I "$ROLLCALC_PUBLIC_BASE_URL/api/conversations/reports/not-found.pdf"

An authenticated 404 for the deliberately invalid report is sufficient for the second network check. A 401 confirms that the public route exists but the browser has not authenticated yet.

Install and enable

Open Admin Panel → Workspace → Functions in OpenWebUI.
Create/import a Function using the complete contents of integrations/openwebui/rollcalc_pipe.py.
Save it and enable the Function.
Open its Valves and configure the values below.
Start a new chat and select RollCalc Assistant as the model.

The Pipe uses pydantic and asynchronous httpx, which are OpenWebUI runtime dependencies; RollCalc's Python environment gains no package dependency.

Configuration

Environment variables provide defaults; Function Valves can override them in OpenWebUI:

Variable / Valve	Purpose
`ROLLCALC_API_BASE_URL`	RollCalc base URL reachable by the OpenWebUI server/container.
`ROLLCALC_PUBLIC_BASE_URL`	RollCalc base URL reachable by the user's browser.
`ROLLCALC_USERNAME`	Basic-Auth user used by the Pipe for API calls.
`ROLLCALC_PASSWORD`	Basic-Auth password used by the Pipe for API calls.
`ROLLCALC_OPENWEBUI_TIMEOUT_SECONDS`	End-to-end request timeout; default `90`.
`ROLLCALC_OPENWEBUI_DEBUG`	Safe console diagnostics; default `false`.

Do not put credentials into either URL. Store the password in the protected OpenWebUI Valve/environment configuration and do not commit it.

localhost inside a container refers to that container. Typical internal URLs are:

http://rollcalc:5000 when both services share a Docker network;
http://host.docker.internal:5000 when RollCalc runs on the host and the Linux container has an explicit host-gateway mapping;
the server's real internal DNS name when the services run on separate hosts.

The public URL must be the externally reachable origin/path, for example https://fertigungski.example/rollcalc. It must never be an internal-only container hostname.

Qwen remains configured on the RollCalc service, not in the Pipe. For the validated local model, start RollCalc with:

export ROLLCALC_OLLAMA_MODEL=qwen3.5:35B-A3B

The existing ROLLCALC_OLLAMA_URL, timeout, temperature 0, think=false, and structured-output settings remain authoritative in ollama_nlu.py.

Session and authentication behavior

The Pipe maps (OpenWebUI user ID, OpenWebUI chat ID) to one RollCalc conversation_id. It serializes messages within one chat and allows different chats to wait on Qwen independently. The mapping is process-local and is lost when OpenWebUI reloads the Function or restarts. RollCalc's own conversation and report stores are also process-local and are lost when RollCalc restarts.

If RollCalc reports an expired/unknown conversation, the Pipe removes the mapping and asks the user to repeat a complete initial request. It deliberately does not replay a follow-up into an empty technical state.

API calls authenticate server-to-server with the configured Basic-Auth account. PDF links never contain those credentials. The existing PDF endpoint therefore prompts the browser for RollCalc Basic Auth on first access. For the demo, open and authenticate to ROLLCALC_PUBLIC_BASE_URL once in the same browser. Shared SSO or a short-lived download token is not implemented.

Because all Pipe API calls use one service account, RollCalc's current access log records that service identity rather than the individual OpenWebUI user.

Demo procedure

For a repository-local validation, use separate terminals:

# Terminal 1
ollama serve

# Terminal 2
cd /opt/git-projects/RollCalcPython
ROLLCALC_OLLAMA_MODEL=qwen3.5:35B-A3B .venv/bin/python app.py

Start/restart the already-discovered OpenWebUI deployment using its actual container or native service name; do not create a second deployment merely for the Pipe. Configure and enable the Function as described above. Then open ROLLCALC_PUBLIC_BASE_URL once and complete its Basic-Auth prompt.

Select RollCalc Assistant in OpenWebUI and use one chat for the entire sequence:

Welchen Durchmesser hat Bentofix NSP 4900, Artikelnummer 180205 bei 65 m Länge?
150 mm
Bitte ändere den Kern auf einen Stahlkern.
194 mm
Wie schwer ist die berechnete Rolle?
Ändere die Länge auf 80 m.

Select one of the candidate diameters actually offered by RollCalc if the preset list differs. Verify that each successful recalculation has a new PDF herunterladen link, that the weight remains visible after the final length change, and that opening the links produces authenticated PDFs.

Known demo limitations

There is no streaming token output; the Pipe returns when the local Qwen plus deterministic RollCalc request completes.
Session mappings, RollCalc conversation state, and reports are in memory only.
Multiple OpenWebUI or RollCalc workers do not share state.
Browser and server-side Basic-Auth sessions are separate.
RollCalc audit entries identify the configured Pipe service account, not the originating OpenWebUI user.
OpenWebUI direct API calls without a stable user/chat identifier are rejected instead of sharing or guessing a session.
OpenWebUI version, deployment topology, and the complete browser flow still need verification in the actual fertigungski host namespace.