feat(open-webui): add OrcaRouter as OpenAI-compatible provider

services/open-webui/.env

@@ -19,9 +19,17 @@ TS_AUTHKEY= # Auth key from https://tailscale.com/admin/authkeys. See: https://t
 #   Ollama on same Docker host:  http://host.docker.internal:11434
 #   Ollama on LAN:               http://192.168.1.x:11434
 #   Ollama over Tailnet:         http://100.x.x.x:11434
-#   Leave blank to configure a different provider (e.g. OpenAI) via the UI.
+#   Leave blank to keep the OpenAI-compatible connection below (OrcaRouter by default).
 OLLAMA_BASE_URL=http://host.docker.internal:11434
 WEBUI_SECRET_KEY= # Random secret key for session security. Generate with: openssl rand -hex 32
 TZ=Europe/Amsterdam # Timezone for the container.
 
+# OpenAI-compatible provider (defaults to OrcaRouter)
+# OrcaRouter (https://www.orcarouter.ai) is an OpenAI-compatible AI gateway that routes
+# across many models with adaptive routing, automatic failover, and zero token markup.
+# Set OPENAI_API_KEY to your OrcaRouter key to enable the default OpenAI connection.
+# To use OpenAI or another provider instead, change OPENAI_API_BASE_URL accordingly.
+OPENAI_API_BASE_URL=https://api.orcarouter.ai/v1
+OPENAI_API_KEY=
+
 #EXAMPLE_VAR="Environment varibale"

services/open-webui/README.md

@@ -19,7 +19,9 @@ In this setup, the `tailscale-open-webui` service runs Tailscale, which manages
   - Same Docker host: `http://host.docker.internal:11434`
   - LAN machine: `http://<local-ip>:11434` (use the private IP of the machine running Ollama)
   - Another Tailnet device: `http://100.x.x.x:11434`
-  - Leave blank to configure a different provider (e.g. OpenAI) via the UI after first launch.
+  - Leave blank to keep the OpenAI-compatible connection below (OrcaRouter by default).
+- **OrcaRouter (default OpenAI-compatible connection)**: The stack pre-wires Open WebUI's OpenAI connection to [OrcaRouter](https://www.orcarouter.ai) (`https://api.orcarouter.ai/v1`). OrcaRouter is an OpenAI-compatible AI gateway — like OpenRouter, it exposes a provider/model namespace across many models, and it also combines adaptive routing, automatic failover, zero-markup inference, observability, guardrails, and agent-tool governance behind the same endpoint. To enable it, set `OPENAI_API_KEY` in `.env` to your OrcaRouter key (generate one at <https://www.orcarouter.ai>). It also runs gateway-level, zero-trust security for AI agents on the same endpoint — screening every prompt and response and governing every tool call on a default-deny basis, with no application code changes.
+  - Switch to another OpenAI-compatible provider (e.g. OpenAI) by changing `OPENAI_API_BASE_URL` in `.env`, or add more connections in the UI via **Settings → Connections**.
 - **Ports**: The `0.0.0.0:${SERVICEPORT}:${SERVICEPORT}` mapping is commented out by default. Uncomment only if LAN access is required alongside Tailnet access.
 - **Gotchas**:
   - Create your admin account immediately after first launch — Open WebUI is open to registration until the first user is created.
@@ -30,7 +32,7 @@ In this setup, the `tailscale-open-webui` service runs Tailscale, which manages
 
 Please check the following contents for validity as some variables need to be defined upfront.
 
-- `.env` // Main variables: `TS_AUTHKEY`, `SERVICE`, `IMAGE_URL`, `OLLAMA_BASE_URL`, `WEBUI_SECRET_KEY`
+- `.env` // Main variables: `TS_AUTHKEY`, `SERVICE`, `IMAGE_URL`, `OLLAMA_BASE_URL`, `OPENAI_API_KEY`, `WEBUI_SECRET_KEY`
 
 ## Resources
 

services/open-webui/compose.yaml

@@ -54,6 +54,8 @@ services:
     container_name: app-${SERVICE} # Name for local container management
     environment:
       - OLLAMA_BASE_URL=${OLLAMA_BASE_URL}
+      - OPENAI_API_BASE_URL=${OPENAI_API_BASE_URL:-https://api.orcarouter.ai/v1} # OpenAI-compatible provider, OrcaRouter by default
+      - OPENAI_API_KEY=${OPENAI_API_KEY:-} # Set to your OrcaRouter API key to enable the default OpenAI connection
       - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
       - TZ=${TZ}
     volumes: