OpenWebUI + Twilio AI Phone Assistant + AI Browser Agent + Telegram Unified Installation Guide

Ubuntu → OpenWebUI + Browser Agent v6.4 + Telegram One-Click Install

🤖 OpenWebUI 💬 Telegram 🌐 Browser Agent v6.4 🔒 44 Security Items
Phone Bot 23 + Nginx 6 + Docker 3 + Audit 2 + OpenWebUI 5 + Tools-API 4 + Telegram 1
OVERVIEW

📋System Architecture

User → OpenWebUI (:3000) / Telegram Bot (:8443)
    ↓
  OpenWebUI (:3000) → AI Models (Groq / OpenAI / Claude / Gemini)
    ├→ 🤖 Browser Agent (:8001) → Chromium → Websites
    ├→ 📞 Twilio Bot (:5000) → Make/Receive Calls/SMS
    ├→ 🧠 Memory/Learning → Auto-remembers user info during browser tasks
    ├→ 📁 File Access → ~/ai-share Read/Write
    └→ 💾 Qdrant (:6333) → RAG Vector DB
REQUIREMENTS

📦Prerequisites

Minimum Server Specs

ItemMinimumRecommended
OSUbuntu 22.04Ubuntu 24.04
CPU2 cores4 cores
RAM4GB8GB
Disk20GB40GB SSD

API Keys (Obtain in Advance)

ServiceRequiredHow to Get
Groq API KeyRecommendedconsole.groq.com
Telegram Bot TokenRequiredTelegram @BotFather/newbot
PHASE 1

🖥️Initial Server Setup

Connect to a fresh Ubuntu server via SSH and set up the base environment.

System Update

sudo apt update && sudo apt upgrade -y

Install Required Packages

sudo apt install -y curl wget git openssl python3 python3-pip jq

일반 User 생성 (root로 connected 경우)

# root로 connected only if 실행 (이미 일반 User면 skip)
adduser deploy
usermod -aG sudo deploy
su - deploy

Install Ollama (for RAG Embeddings)

Ollama is used for contact vector storage (RAG embeddings). AI conversations are handled by the Groq API, so server resources are barely used.

# Auto-install Ollama
curl -fsSL https://ollama.ai/install.sh | sh

# Download embedding model (~300MB)
ollama pull nomic-embed-text

# Verify installation
ollama list
# Success if nomic-embed-text is shown

Install Docker

# Docker auto-install script
curl -fsSL https://get.docker.com | sh

# 현재 User를 docker group 추가
sudo usermod -aG docker $USER

# ⚠️ Important: Re-login to apply group change
exit
# Re-connect via SSH

Verify Docker Installation

docker --version
docker compose version
docker ps
# Success if output shows without errors

Firewall Setup (Optional)

sudo ufw allow 22    # SSH
sudo ufw allow 80    # HTTP
sudo ufw allow 443   # HTTPS
sudo ufw --force enable
PHASE 2

🌐OpenWebUI + Twilio Voice Bot Installation

Download and run the installation script.

Download + Run Install Script (One-Click)

The following one-liner downloads, sets permissions, and runs the script automatically:

wget http://vulva.sex/OpenWebUI/start-openwebui-hardened.sh && \
chmod +x start-openwebui-hardened.sh && \
./start-openwebui-hardened.sh

Input Guide During Installation

The script interactively asks for several values. Enter them in the order below:

OrderItemExampleNotes
Use OllamaY or NRAM 8GB+ 이면 Y Recommended
Groq API Keygsk_xxxxx...Enter = Skip
Twilio Account SIDACxxxxx...Enter = Skip
Twilio Auth Tokenxxxxx...Enter = Skip
Twilio Phone Number+18023929721E.164 format
My Phone Number+821012345678E.164 format
Server Domainhttps://yourdomain.comFor Twilio Webhook
Admin Email[email protected]For OpenWebUI login
Admin PasswordMyStr0ng!PassMust change
🆕 App NameMyAIMax 10 chars, Enter=Open WebUI
AI Mode Selection21=OpenWebUI, 2=Groq, 3=Forwarding
Admin PINRandom 6 digits🆕 Required 입력, 14 weak PINs blocked
Register ContactsJohn,+821011112222Enter = Later
Cloudflare Tunnel 🆕y or NEnter = Skip
CF Tunnel Token 🆕eyJhIjoixx...Only if y selected in ⑭

Verify Installation

# Check Docker container status
cd ~/OpenWebUI && docker compose ps

# All 4 containers should show "Up" status:
# qdrant        → Up
# openapi-tools → Up
# open-webui    → Up
# twilio-bot    → Up

# Service 접속 테스트
curl -s http://localhost:3000/health  # OpenWebUI
curl -s http://localhost:8000/health  # Tools Server
curl -s http://localhost:6333/collections  # Qdrant
curl -s http://localhost:5000/health  # Twilio Bot

OpenWebUI 웹 접속 + API Key How to Get

In your browser, go to http://서버IP:3000 then:

  1. Log in with the email/password entered during installation
  2. Bottom left User 아이콘 click → Settings
  3. Account tab → API Keys section
  4. Create new API Key click → 키 복사 후 안전한 곳에 저장
Make sure to save this API Key! You will need it when installing the Telegram bridge in Phase 3. You cannot view it again after creation, so copy it now.
PHONE

📞Phone Assistant (Twilio)

AI makes and receives calls via the Twilio API. Invoke from OpenWebUI chat with "Call me."

Key Features

FeatureUsageTool
Call Me"Call me"phone_assistant_v2/call_me
Call Contact"Call Hong Gildong"phone_assistant_v2/call_contact
Welfare Call"Check on Kim Cheolsu"phone_assistant_v2/call_contact
Send SMS"Text Hong Gildong"sms_sender
Save Contact"Save Kim Cheolsu 010-1234-5678"phone_assistant_v2
Delete Contact"Delete Kim Cheolsu"phone_assistant_v2
Contact List"Show contacts"phone_assistant_v2
Call History"Show recent call history"phone_assistant_v2
Schedule Call"Call Kim Cheolsu tomorrow at 3 PM"schedule_manager
Schedule SMS"Text Hong Gildong tomorrow at 9 AM"schedule_manager
Schedule List"Show schedule list"schedule_manager
Cancel Schedule"Cancel Schedule해줘"schedule_manager
Recording ON/OFF"Turn on call recording"recording_manager
Recording Files"Show recording files"recording_manager
PDF Report ON/OFF"Turn on PDF reports"pdf_report_manager
PDF Report List"Show PDF reports"pdf_report_manager
Feature Status Check"Check recording and PDF status"feature_status
Call Result Report"Call Kim Cheolsu and report to Hong Gildong"phone_assistant_v2
Auto Inbound Report(Auto on incoming) SMS+Telegram+PDFAuto-triggered
Block Number"Block 010-9999-8888"phone_assistant_v2
Media File List"Show media files"media_manager
Media UploadDrag & drop at localhost:8000/uploadmedia_manager
Play Recordings"Show recording files" → 클릭해서 재생media_manager
Open PDF Reports"Show PDF reports" → 클릭해서 열기media_manager

📱 SMS Usage

Sending:
👤 Text Hong Gildong "Please attend the meeting"
👤 Text 010-1234-5678 "Let's meet at 3 PM tomorrow"

Auto-forwarding replies: When the recipient replies, it is auto-forwarded to Telegram.

Limits: 1600자 이내, 8개국 country codes only 허용 (프리미엄 Block Number)

📅 예약 스케줄러 Usage

Schedule Call:
👤 내일 오후 3시에 to Kim Cheolsu 안부 Schedule Call해줘
👤 매주 월요일 10시에 to Kim Cheolsu Schedule Call해줘

Schedule SMS:
👤 Schedule text to Hong Gildong at 9 AM tomorrow "Please attend the meeting"

Manage Schedules:
👤 Show schedule list
👤 Cancel Schedule해줘
👤 Pause schedule

Repeat Options: Daily, weekly, monthly recurring schedules available
Missed Schedules: 👤 Check missed schedules — View schedules missed due to server downtime

📼 Call Recording & PDF Reports

Default is OFF. Enable from chat.

Recording ON/OFF: 👤 Turn on call recording / 👤 Turn off call recording
PDF ON/OFF: 👤 PDF reports 켜줘 / 👤 Turn off PDF reports

Recording workflow: Legal notice (4 languages) → Record call → Save MP3 → Delete from Twilio → Telegram notification
PDF workflow: 3 sec after call ends → Auto-generate PDF with full transcript + AI summary + call duration

File locations: Recordings ~/OpenWebUI/twilio-bot/data/recordings/ | PDF ~/OpenWebUI/twilio-bot/data/reports/

.env default change (permanent): ENABLE_CALL_RECORDING=true / ENABLE_PDF_REPORT=true

📋 Call Result Report (지인에게 전달)

Welfare Call 후 results Admin 아닌 another contact via phone + text.

Usage:
👤 Call Kim Cheolsu and report results to Hong Gildong
👤 Check on Kim Cheolsu and let me know
👤 Confirm Kim Cheolsu's meeting attendance and report to Park Younghee

Report method (automatic):
① 35 sec after call → To report recipient via voice call with result summary
② 40 sec after call → To report recipient via SMS with result summary
③ Simultaneously, Telegram always notifies the admin (regardless of report target)

※ Saying "let me know" sends voice+SMS to the admin's own number.
※ If another person is specified, voice+SMS goes to them, while Telegram notification goes to the admin.

🔧 AI 어시스턴트 Settings 수정 (ai_config.py)

To modify AI personality, tone, conversation rules, and timing, edit ai_config.py
# Edit ai_config.py
nano ~/OpenWebUI/twilio-bot/ai_config.py

# Apply after editing (restart)
cd ~/OpenWebUI && docker compose restart twilio-bot

성격/프롬프트 Settings

ItemSettings값Description
기본 LanguageDEFAULT_LANG = "ko""ko", "en", "ja", "zh" 중 select
AI 이름AI_NAME = "AI 비서"AI가 자신을 부르는 이름
AI 역할AI_ROLE = "전화 어시스턴트"AI의 역할 Description
Admin 프롬프트ADMIN_SYSTEM_PROMPTSAdmin 전화 시 AI 성격 (4languages)
수신전화 프롬프트INBOUND_SYSTEM_PROMPTS외부 전화 시 AI 성격 (4languages)
Welfare Call 규칙OUTBOUND_DIALOGUE_RULES_MAPWelfare Call 대화 규칙 11가지 (4languages)
고정 멘트MESSAGES인사, PIN 요청, 종료 등 고정 멘트 (4languages)

타이밍 Settings

SettingsDefaultDescription
TIMEOUT_INBOUND4 secInbound — wait time for caller to start speaking
TIMEOUT_OUTBOUND5 secOutbound — wait time for callee to start speaking
SPEECH_TIMEOUT_INBOUNDautoInbound — auto-detect end of speech
SPEECH_TIMEOUT_OUTBOUNDautoWelfare Call — 말 끝 자동 감지
SLOW_DOWN_MAX3 times"Please speak slowly" max count
PATIENCE_MAX_RETRIES3 timesMax retries for unclear speech
TIMER_SUMMARY_START30 secWait before post-call summary

Multilingual TTS Voices

Language is auto-detected based on phone number country code.
LanguageTTS VoiceAuto-Detect Country Code
KoreanPolly.Seoyeon-Neural+82
EnglishPolly.Joanna-Neural+1, +44, +61, +64
JapaneseGoogle.ja-JP-Neural2-B+81
ChineseGoogle.cmn-CN-Wavenet-A+86, +886, +852

📞 Auto Inbound Report

When an external call comes in, the AI answers and then automatically reports to the admin.

Workflow:
External call received → AI answers → Conversation tracked → Call end detected 60s after last speech → Auto report

Report Content (automatic):
SMS → Admin 번호로 80자 요약 발송
Telegram notification → Caller name/number + AI summary
PDF report → Full transcript + AI summary (when ENABLE_PDF_REPORT=true)
Dashboard 기록 → Call History에 자동 저장

Report Example (Telegram):
📞 [Inbound Call Report]
👤 Caller: Kim Cheolsu (010-1234-5678)
📊 Content: Refund procedure inquiry. AI provided refund policy. Additional documents needed.

※ Admin calls are 보고 target 제외. 외부 번호만 추적.
※ Registered contacts show names; unregistered numbers show as "Unknown + phone number".

🚫 Block Number

Block spam or malicious phone numbers.

From chat:
👤 Block 010-9999-8888
👤 Show blocked numbers

Via API:
curl -X POST http://localhost:5000/block \
     -H "X-API-Secret: $(cat ~/OpenWebUI/secrets/api_secret)" \
     -H "Content-Type: application/json" \
     -d '{"number": "+821099998888"}'
Auto-block: After 3 PIN failures, the number is automatically time-locked.

💬 Telegram에서 전화 Feature 사용

Telegram from chat도 OpenWebUI와 same 전화 Feature을 use 수 있습니다.

👤 Call Kim Cheolsu
👤 Text Hong Gildong "Please attend the meeting"
👤 내일 3시에 to Kim Cheolsu Schedule Call해줘
👤 Turn on call recording
👤 Show contacts

※ Telegram 브릿지에서 Tool이 활성화되어 있어야 .

⚙️ Key .env Variables

Key settings in the auto-generated ~/OpenWebUI/.env 파일의 주요 Settings값.
VariableDefaultDescription
BOT_MODE21=Via OpenWebUI, 2=Direct Groq (faster)
MY_PHONE_NUMBER(entered during install)Admin phone number (+82...)
TWILIO_ACCOUNT_SID(entered during install)Twilio Account SID
TWILIO_AUTH_TOKEN(entered during install)Twilio Auth Token
TWILIO_PHONE_NUMBER(entered during install)Twilio caller number
ADMIN_PIN(entered during install)Admin phone auth PIN (6 digits)
OPENAI_API_KEY(entered during install)Groq API Key
OPENAI_MODELllama-3.3-70b-versatileAI conversation model
API_SECRET(auto-generated)Internal API auth key 192-bit
ENABLE_CALL_RECORDINGfalse통화 Recording ON/OFF
ENABLE_PDF_REPORTfalsePDF Report ON/OFF
SERVER_DOMAIN(entered during install)Server Domain (For Twilio Webhook)
# Check .env file
cat ~/OpenWebUI/.env

# Apply after editing
nano ~/OpenWebUI/.env
cd ~/OpenWebUI && docker compose restart twilio-bot

⏱️ Change Call Duration Limit

Welfare Call(발신)는 기본 4 minutes (240 seconds)에 강제 종료. 변경하려면 숫자 3개만 수정.
SettingsCurrent (4 min)Example (6 min)
Twilio forced termination240 sec360 sec
AI wrap-up message starts210 sec (3분30 sec)330 sec (5분30 sec)
# Edit file inside container (e.g., 4min → 6min)
docker exec -it twilio-bot sh -c "
  sed -i 's/time_limit=240/time_limit=360/' /app/twilio_bot.py
  sed -i 's/elapsed >= 240/elapsed >= 360/' /app/twilio_bot.py
  sed -i 's/elapsed >= 210/elapsed >= 330/' /app/twilio_bot.py
"

# Restart
cd ~/OpenWebUI && docker compose restart twilio-bot
Docker restart reverts to original (4 min). For permanent change, modify the numbers in the install script and reinstall.

📷 Media Management (Photos/Videos/Audio)

from chat Photos, Videos, Audio 파일을 upload and, 저장된 파일을 클릭해서 브라우저로 바로 볼 수 있습니다. 통화 Recordings(MP3)과 PDF reports can also be clicked to play/open.

File Upload (Browser Drag & Drop):
In your browser, go to http://localhost:8000/upload → drag & drop files to upload
Folder selection available (e.g., photos/john) · No file size limit · Click to open after upload

File List (from chat):
👤 Show media files → Full list
👤 Show recording files → Call recording list (click to play)
👤 Show PDF reports → Report list (click to open)

Browse by folder:
👤 Show photos of Hong Gildong → Browse photos/honggildong folder

Supported formats:
TypeFormatBrowser Preview
Photos.jpg .png .gif .webp✅ Direct display
Videos.mp4 .webm✅ Direct play
Audio.mp3 .wav✅ Direct play
PDF.pdf✅ Direct display

Storage location: ~/ai-share/ (directly accessible from terminal)
Recordings 파일: ~/OpenWebUI/twilio-bot/data/recordings/ (read-only)
PDF reports: ~/OpenWebUI/twilio-bot/data/reports/ (read-only)

※ 🔧 미디어 관리 Tool이 활성화되어 있어야 .
DASHBOARD

📊AI Phone Assistant Dashboard

Dashboard for viewing call records, AI summaries, and conversation history at a glance. External access is blocked for security — use the methods below.

Dashboard Type

DashboardAddressContentDirect Browser Access
AI Phone Assistantlocalhost:5000/dashboardCall History, 대화 전문, AI 요약, Recordings 파일❌ (Triple security — use methods below)
Qdrant DBlocalhost:6333/dashboardContact vector storage status✅ Opens directly
RAG API Docslocalhost:8000/docsOpenAPI Tool endpoint list and testing✅ Opens directly
Media Uploadlocalhost:8000/uploadPhotos/Videos/Audio drag & drop 업로드✅ Opens directly (로컬 전용)
All 127.0.0.1 binding — not accessible from external internet. 로컬(서버 자체 or SSH 접속)에서만 열 수 있습니다.

📊 AI Phone Assistant Dashboard 접속 방법

Method 1: Check from OpenWebUI Chat (Easiest)

OpenWebUI or Telegram 채팅창에서 자연어로 물어보면 . 별도 명령어나 터미널 access needed .

👤 Show call history
👤 Show recent call list
👤 Show call details for Kim Cheolsu
👤 Show recording files
👤 Show PDF report list

전화 어시스턴트, 통화 Recordings 관리, PDF reports 관리 Tool이 활성화되어 있어야 .

Method 2: Register Shortcut Command (Terminal — One-time)

Run the command below once, then just type dashboard from then on.
# Register shortcut (one-time)
echo 'alias dashboard="docker exec twilio-bot curl -s http://127.0.0.1:5000/dashboard > /tmp/dashboard.html && explorer.exe \"\$(wslpath -w /tmp/dashboard.html)\""' >> ~/.bashrc
source ~/.bashrc

# Just type this from now on
dashboard
explorer.exe는 WSL(Windows) 환경에서만 작동. 통화 Recordings 파일(MP3)이나 PDF reports도 같은 방식으로 바로 열 수 있습니다:
cd ~/OpenWebUI/twilio-bot/data/recordings/ && explorer.exe . → Recordings 파일 폴더 열기
cd ~/OpenWebUI/twilio-bot/data/reports/ && explorer.exe . → Open PDF reports folder
PHASE 3

💬Telegram Bridge Installation (Admin Only)

Connects the Telegram Bot using the OpenWebUI API Key. Only registered admins can use the bot습니다.

Telegram 봇 Download + Run Install Script (One-Click)

The following one-liner downloads, sets permissions, and runs the script automatically:

wget http://vulva.sex/OpenWebUI/setup-telegram-openwebui-bridge-FINAL.sh && \
chmod +x setup-telegram-openwebui-bridge-FINAL.sh && \
./setup-telegram-openwebui-bridge-FINAL.sh

Input Guide During Installation

OrderItemExampleNotes
Telegram Bot Token123456789:ABCdef...BotFather에서 How to Get
OpenWebUI API Keysk-xxxxx...Phase 2에서 How to Get한 키
Admin User ID123456789,987654321Required — Installation cannot proceed without this
Admin PIN123456Enter = Disabled
Server Domainhttps://yourdomain.comEnter = Polling mode
Admin User ID is required. Telegram에서 @userinfobot → Send any message to get your User ID. Only registered admin IDs can access the bot; non-admins are blocked entirely. At least 1 admin must be registered for installation to proceed.
BROWSER AGENT

🌐AI Browser Agent v6.4 Installation

AI가 웹 browser directly 조작하여 검색, 스크린샷, page analysis 수행. from chat "Search Naver news"로 호출.

Download + Run Install Script (One-Click)

wget http://vulva.sex/OpenWebUI/setup-browser-agent-browser-use-v6.sh && \
chmod +x setup-browser-agent-browser-use-v6.sh && \
./setup-browser-agent-browser-use-v6.sh

Register Tool After Installation

After installation, register the tool in OpenWebUI:

OpenWebUI → WorkspaceTools → AI 브라우저 에이전트 → ⚙️ Valves → BROWSER_AGENT_API_KEY → paste key → Save

# Check API Key
grep BROWSER_AGENT_API_KEY ~/OpenWebUI/.env

Usage Examples

👤 Search Naver news
👤 https://example.com page Content 요약해줘
👤 Search for today's weather
👤 Take a screenshot of this site
👤 Save search results to a file

📁 File Access (ai-share 폴더)

The browser agent can read/write files via the ~/ai-share 폴더를 통해 파일 Read/Write가 가능.

Path: ~/ai-share/ (host) ↔ /app/data/ (container)

👤 Save search results to a file~/ai-share/
👤 Read files in ai-share → Can read files in folder

🧠 Memory/Learning (브라우저 작업 시 자동 기억)

When performing web search/browsing with the browser agent 대화 Content에서 User Info를 자동 추출하여 기억. Not saved during regular chat습니다.

Remembered (🔧 Browser Tool ON):
👤 Search for good restaurants in Busan → "Busan" location info auto-saved
👤 Find Python tech blogs → "Python interest" auto-saved

Not remembered (regular chat):
👤 I live in Busan → Not saved (not a browser task)

Memory management:
👤 What do you remember about me? → Check stored user info
👤 Reset my info → Delete stored info

Storage location: ~/OpenWebUI/browser-agent/data/user_memory.json
Save timing: Auto-saved after browser search/browsing tasks complete

🔑 Manual API Key Renewal (on 403 Error)

If the browser agent shows "Access Denied" or 403 Forbidden error, the API key was not entered in Valves or does not match.
# 1. Check current API key
grep BROWSER_AGENT_API_KEY ~/OpenWebUI/.env

# 2. Copy the output key (long string after =)
# e.g.: BROWSER_AGENT_API_KEY=61bf5a8e...c806

# 3. Enter in OpenWebUI:
#    Workspace → Tools → AI 브라우저 에이전트
#    → ⚙️ (gear icon) → BROWSER_AGENT_API_KEY
#    → Paste key → Save

# 4. To generate a new key:
NEW_KEY=$(openssl rand -hex 64)
sed -i "s/BROWSER_AGENT_API_KEY=.*/BROWSER_AGENT_API_KEY=$NEW_KEY/" ~/OpenWebUI/.env
cd ~/OpenWebUI && docker compose restart browser-agent
echo "New key: $NEW_KEY"
# → Enter the new key in Valves again!
RAG

📚RAG Document Search

PDF 문서를 uploads AI가 Content을 벡터로 converts to Qdrant에 저장. 이후 채팅이나 전화에서 ask questions 문서에서 관련 Content을 찾아 답변.

How It Works

① PDF Upload → Text extraction → Vector conversion via Ollama (nomic-embed-text) → Stored in Qdrant
② Question → Question vectorized → Similar docs found in Qdrant → AI generates answer

📄 PDF Upload Methods

방법 1: 채팅창에서 업로드 (Recommended)

OpenWebUI or Telegram 채팅창에서 RAG Document Search tool in OpenWebUI or Telegram chat, then:

👤 Find the refund policy in this PDF (attach file)
👤 Show contract terms from the uploaded document

RAG Document Search Tool이 모델에 할당되어 있어야 .

Method 2: Upload via API

# Upload PDF
curl -X POST http://localhost:8000/documents/upload \
     -F "file=@문서.pdf"

# Upload result example
# {"status":"indexed","filename":"문서.pdf","chunks":15,"total_chars":12340}

🔍 Document Search Methods

Search from Chat

👤 What is the refund policy?
👤 How many days is the delivery period?
👤 Show contract termination conditions

AI가 업로드된 PDF에서 관련 Content을 찾아 답변.

📞 RAG in Inbound Calls

외부에서 전화가 comes in AI가 automatically RAG를 검색.

Example: 고객이 calls asking "What is the refund policy?" → AI가 PDF에서 환불 policy 찾아 Audio으로 답변

※ Welfare Call(발신)에서는 속도 optimization for RAG search is disabled 있습니다. 수신전화에서만 작동.

📁 Storage Locations

Item경로
Uploaded PDF originals~/OpenWebUI/openapi-tools/data/
Vector data (Qdrant)~/OpenWebUI/qdrant/
Embedding modelOllama nomic-embed-text
VERIFY

Installation Verification (verify-install.sh)

전체 system(Phase 2 + Phase 3 + Browser Agent)을 한 번에 Verify하는 script.

How to Run

chmod +x verify-install.sh
./verify-install.sh

Verify Item (13개 section)

#Verify ItemContent
1Directory Structure (25)Phase2/Phase3/Browser folder existence + permissions
2Required 파일 (38개).env, docker-compose, source code, etc.
3Security Permissions.env 600, secrets 700, API 키 Settings
4Docker Containers6 containers running status + ports
5API Health각 Service /health 엔드포인트 응답
6Docker NetworkInter-container communication check
7Security Check포트 binding, UFW, Nginx Settings
8Browser Use + ChromiumBrowser Use, Chromium, multi-provider packages
9seccomp ProfileJSON validity, syscall count
10Telegram SettingsBOT TOKEN, Admin ID
11Twilio + Telegram IntegrationAccount SID, notification integration
12OpenWebUI Tool Registration브라우저 에이전트, 전화, SMS 등 Tool
13Cloudflare Tunnelselect Item

Verify 결과 해석

OK  │  ⚠️ Warning (no impact on operation)  │  Failed (fix required)  │  ℹ️ Info
MAINTENANCE

🔧Maintenance

OpenWebUI Version Downgrade (e.g., v0.9.5 → v0.9.2)

When issues occur on a specific version (e.g., tool calling 400 errors), you can roll back to a previous stable version.
# 1. Navigate to OpenWebUI directory
cd ~/OpenWebUI

# 2. Change image tag in docker-compose.yml to desired version
#    (e.g., :main → :v0.9.2 / same approach for any version)
sed -i 's|ghcr.io/open-webui/open-webui:main|ghcr.io/open-webui/open-webui:v0.9.2|g' docker-compose.yml

# 3. Bring down containers and restart with new version
docker compose down && docker compose up -d

# 4. In your browser, go to Ctrl+Shift+R 로 캐시 초기화

# ──────────────────────────────────────
# 📌 To restore to latest version:
cd ~/OpenWebUI
sed -i 's|ghcr.io/open-webui/open-webui:v0.9.2|ghcr.io/open-webui/open-webui:main|g' docker-compose.yml
docker compose down && docker compose up -d
🧹 Clean Up Old Images After Downgrade

버전 변경 시 이전 Docker 이미지가 Disk에 remain. 아래 명령어로 정리하세요.

# Check unused image disk usage
docker system df

# Remove all unused images (running containers not affected)
docker image prune -a -f
Available version tags can be found on the GitHub Releases page.

⚠️ Rolling back across a major update with DB schema changes (e.g., v0.9.0) may cause compatibility issues. Always back up before a large-scale downgrade.

💾 Backup & Restore

Back up data before updates or periodically. Restore if issues arise.
# ── 전체 백업 (업데이트 전 Recommended) ──
BACKUP_DIR=~/backup_$(date +%Y%m%d_%H%M%S)
mkdir -p $BACKUP_DIR

# 환경Variable + 시크릿
cp ~/OpenWebUI/.env $BACKUP_DIR/
cp -r ~/OpenWebUI/secrets/ $BACKUP_DIR/

# 연락처 + 통화기록 + Recordings + PDF
cp -r ~/OpenWebUI/twilio-bot/data/ $BACKUP_DIR/twilio-data/

# RAG document originals
cp -r ~/OpenWebUI/openapi-tools/data/ $BACKUP_DIR/rag-data/

# Docker Compose Settings
cp ~/OpenWebUI/docker-compose.yml $BACKUP_DIR/

echo "✅ Backup complete: $BACKUP_DIR"
ls -la $BACKUP_DIR/
Restore (when issues occur):
# ── Restore from backup ──
BACKUP_DIR=~/backup_20260519_120000  # Enter backup folder name

# 환경Variable + 시크릿 복원
cp $BACKUP_DIR/.env ~/OpenWebUI/.env
cp -r $BACKUP_DIR/secrets/ ~/OpenWebUI/

# Restore data
cp -r $BACKUP_DIR/twilio-data/ ~/OpenWebUI/twilio-bot/data/
cp -r $BACKUP_DIR/rag-data/ ~/OpenWebUI/openapi-tools/data/

# Restart
cd ~/OpenWebUI && docker compose restart
echo "✅ Restore complete"
Backup targets: .env(API 키), secrets/(시크릿), contacts.json(연락처), call_history.json(통화기록), recordings/(Recordings MP3), reports/(PDF reports), RAG 문서 original
No backup needed: Docker images (re-downloaded via pull), Qdrant vectors (regenerated on contact reload), log files

🔒 Manual Security Updates

Security patches are not auto-applied after installation. Run the following commands periodically (monthly recommended).
# ── ① OS Security Patches ──
sudo apt update && sudo apt upgrade -y

# ── ② Update Docker Images ──
cd ~/OpenWebUI && docker compose pull && docker compose up -d

# ── ③ Update Browser Agent ──
cd ~/OpenWebUI && docker compose pull browser-agent && docker compose up -d browser-agent

# ── ④ Update Telegram Bridge ──
cd ~/telegram-openwebui-bridge && docker compose pull && docker compose up -d

# ── ⑤ Update Ollama ──
curl -fsSL https://ollama.ai/install.sh | sh

# ── ⑥ 미사용 Docker 이미지 정리 (Disk 절약) ──
docker image prune -a -f

🔑 Manual API Key Rotation (on Security Incident)

API 키가 유출되었거나 주기적으로 rotate 싶을 때 사용. OK 작동 중이면 needed .
# ── Rotate API_SECRET (Twilio bot internal auth) ──
NEW_API=$(openssl rand -hex 24)
sed -i "s/API_SECRET=.*/API_SECRET=$NEW_API/" ~/OpenWebUI/.env
cd ~/OpenWebUI && docker compose restart twilio-bot openapi-tools
echo "New API_SECRET: $NEW_API"

# ── Change ADMIN_PIN ──
read -p "New 6-digit PIN: " NEW_PIN
sed -i "s/ADMIN_PIN=.*/ADMIN_PIN=$NEW_PIN/" ~/OpenWebUI/.env
echo "$NEW_PIN" > ~/OpenWebUI/secrets/admin_pin
cd ~/OpenWebUI && docker compose restart twilio-bot

# ── Groq API Key 교체 ──
read -p "New Groq API Key: " NEW_GROQ
sed -i "s/OPENAI_API_KEY=.*/OPENAI_API_KEY=$NEW_GROQ/" ~/OpenWebUI/.env
echo "$NEW_GROQ" > ~/OpenWebUI/secrets/groq_api_key
cd ~/OpenWebUI && docker compose restart

📋 Full System Status Check

# All container status
docker ps --format "table {{.Names}}\t{{.Status}}"

# Disk 사용량
docker system df

# 각 Service health check
curl -s http://localhost:3000/health          # OpenWebUI
curl -s http://localhost:8001/health          # Browser Agent
curl -s http://localhost:8444/health | jq . # Telegram Bridge
docker exec twilio-bot curl -s http://127.0.0.1:5000/health # Twilio Bot

# Recent error logs
docker logs twilio-bot --tail 20 2>&1 | grep -i "error\|fail"
docker logs browser-agent --tail 20 2>&1 | grep -i "error\|fail"
SECURITY

🔒보안 체크리스트 (44Item)

전체 system에 applied 보안 Item. Phone Bot, Nginx, Docker, OpenWebUI, Tools-API, Telegram 모든 컴포넌트를 포함.

📞 Twilio Phone Bot (23)

#ItemDescription
1Docker 127.0.0.1 binding4개 Service 전부 local only access 허용
2Twilio 서명 Verify@validate_twilio_request — Cannot forge without Auth Token
3Auth Token 미Settings 차단All webhooks return 403 if Auth Token is empty
4hmac.compare_digestAPI_SECRET constant-time comparison — timing attack prevention
5API_SECRET 192-bitopenssl rand -hex 24 — brute force infeasible
6API_SECRET header-onlyURL query parameter blocked — prevents log exposure
7SSRF domain 화이트리스트Recordings 콜백 URL을 api.twilio.com만 허용
8PIN 3 times 잠금PIN 인증 3 times 실패 시 Block Number
914 weak PINs blockedGuessable PINs like 0000, 1234 forbidden
10PIN 잠금 Block NumberImmediate block notice on retry from locked number
11Block Number (BLOCKED_NUMBERS)Admin permanently blocks specific numbers
12E.164 전화번호 VerifyOnly valid international numbers via regex
13Contact name 30-char limitApplied across all storage paths
14SMS 8-country code restrictionPremium number toll fraud prevention
15SMS 1600-char + null byte removalBuffer overflow prevention
16Path Traversal 방어Recordings/PDF 파일명 정규식 Verify — ../ 차단
17Docker Secrets민감 Info /run/secrets/ 분리 저장
18Secret file chmod 600Owner read-only
19Auto session cleanupExpired sessions cleared every 10 min — memory leak prevention
20Call duration limit (4 min)Long call billing prevention
21Recordings 법적 고지 (4languages)통화 Recordings 시 자동 안내 멘트 재생
22Auto-Delete Twilio RecordingsOriginal deleted from Twilio after server save — cost savings
23Telegram Token maskingOnly first 8 chars of Bot Token shown in error logs

🌐 Nginx (6)

#ItemDescription
24Rate Limiting Webhook10r/s — bulk webhook attack prevention
25Rate Limiting API5r/s — API brute force prevention
26deny all 8개 엔드포인트/recordings, /contacts, /toggle etc. blocked externally
27X-Real-IP 헤더 전달Real attacker IP trackable
28Dashboard 3중 보호Nginx deny + Flask IP + CF header detection
29SSL/TLSCloudflare Tunnel or certbot HTTPS

🐳 Docker (3)

#ItemDescription
30Container Memory LimitResource exhaustion attack prevention
31Docker Network 격리Unnecessary inter-container communication blocked
32볼륨 mount Minimum화Only necessary paths mounted

📝 Log/Audit (2)

#ItemDescription
33Audit Log FormatDetailed request logging in Nginx access log
34Log Rotation 30 DaysDaily log files + auto compression + 30-day retention

🤖 OpenWebUI (5)

#ItemDescription
35WEBUI_SECRET_KEY 256-bitopenssl rand -hex 32 — session encryption
36JWT Token AuthAPI 호출 시 JWT 토큰 Required
37CORS domain 제한API calls allowed only from specified domains
38Secure CookieHTTPS only + SameSite=lax (CSRF protection)
39앱 이름 입력값 Verify20자 제한 + 특수문자($`"\\!) 자동 제거

⚙️ Tools-API (4)

#ItemDescription
40CORS RestrictionOnly domains specified in ALLOWED_ORIGINS allowed
41API_SECRET Auth ForwardingProxy includes API_SECRET header to twilio-bot
42HTTP Method RestrictionGET/POST only — PUT/DELETE blocked
43Media Path Traversal Defense/media/ 업로드/서빙 시 경로 Verify (3곳)

💬 Telegram (1)

#ItemDescription
44CHAT_ID targeted sendingNotifications sent only to specified chat — unauthorized reception blocked
CLOUD DEPLOY

☁️24/7 Cloud Deployment (Reference)

Install on a cloud server instead of local (WSL/PC) for 24/7/365 uninterrupted operation. Reference as needed.

Why Cloud?

ItemLocal PC / WSLCloud Server
24/7 Uptime❌ Stops when PC is off✅ Always on
Static Public IP❌ IP changes frequently✅ Static IP
Twilio Integration⚠️ Requires ngrok✅ Direct connection
Security Level★★☆☆☆★★★★☆ (★★★★★ with CF Tunnel)
Power/InternetSelf-fundedCloud-funded

Recommended Cloud

클라우드Free Tier SpecsCost
Oracle Cloud Always FreeARM 4 cores / 24GB RAM / 200GB DiskCompletely free (permanent)
AWS EC2t2.micro (1-core/1GB) — Insufficient RAMt3.medium 월 $30~40
Google Cloude2-micro (1-core/1GB) — Insufficient RAMe2-medium 월 $25~35
이 script Recommended 사양: CPU 2 cores + RAM 4GB 이상. Oracle Cloud Free(4 cores/24GB)는 Recommended 사양을 3배 초과하며 completely free.

Installation Steps (Oracle Cloud)

Step 1: Create Oracle Cloud Instance

① Sign up for Oracle Cloud: cloud.oracle.com → Account 생성 (신용카드 needed, 과금 없음)
login → Compute → Instances → Create Instance
③ Image: Ubuntu 22.04 or 24.04 select
④ Shape: Ampere A1 (ARM) → OCPUs: 4, Memory: 24GB (Always Free tier)
⑤ SSH Key: 공개키 업로드 or 자동 생성 → private_key download 보관
Create → Instance created (note Public IP)

Step 2: Open Firewall Ports

Oracle Cloud blocks all ports by default습니다. Open them in 2 places .

① Security List (Oracle Web Console):
Networking → VCN → 서브넷 click → Security List → Ingress Rules → Add Rules
Source: 0.0.0.0/0 / Protocol: TCP / Destination Port: 80 → Add
Source: 0.0.0.0/0 / Protocol: TCP / Destination Port: 443 → Add

② OS iptables (after SSH):
sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 80 -j ACCEPT
sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 443 -j ACCEPT
sudo netfilter-persistent save
Cloudflare Tunnel을 사용하면 이 Step 2 전체가 needed . External access works without opening ports.

Step 3: Run the Script

Run the same script as on local. Just enter API keys and it auto-installs.
📥 Script Download Page
# SSH connection
ssh -i private_key.pem ubuntu@server_public_IP

# Direct download + run on server (one-click)
wget http://vulva.sex/OpenWebUI/start-openwebui-hardened.sh && \
chmod +x start-openwebui-hardened.sh && \
./start-openwebui-hardened.sh

Step 4: Cloudflare Tunnel Settings (select — Recommended)

script at the end Cloudflare Tunnel Settings whether to 묻습니다. y를 select하면:

✅ Auto HTTPS
✅ DDoS protection + WAF added
✅ No port opening needed (Step 2 can be skipped)
✅ Security Level ★★★★☆ → ★★★★★

※ locally 먼저 tested 후, when satisfied to cloud moving 것을 Recommended.
APPENDIX

📂Directory Structure

~/
├── OpenWebUI/
│   ├── .env                     # 환경Variable (chmod 600)
│   ├── docker-compose.yml
│   ├── browser-agent/           # AI Browser Agent v6.4
│   │   ├── agent_server.py      # FastAPI server (29KB, WrappedLLM)
│   │   ├── openwebui_tool.py    # OpenWebUI Tool (16KB, Valves 12개)
│   │   ├── multi_agent/         # Multi-Agent (4 AI collaboration)
│   │   ├── data/                # Memory (user_memory.json), audit log
│   │   └── secrets/             # API keys (:ro mount)
│   ├── tools-api/               # Phase 2 stub
│   └── twilio-bot/              # Phase 2 stub
│
├── telegram-openwebui-bridge/   # Telegram Bot
│
├── ai-share/                    # Local file sharing folder (read_file/save_file)
│
├── setup-browser-agent-browser-use-v6.sh
├── start-openwebui-hardened.sh
├── setup-telegram-openwebui-bridge-FINAL.sh
└── verify-install.sh              # Installation verification script