Expand OpenManage AI documentation with architecture and deploy context.

Keeps runtime data and secrets out of git; documents relationship to OME Cockpit.
2026-07-17 04:04:33 +02:00
commit c0a545bf2c
8 changed files with 215 additions and 0 deletions
@@ -0,0 +1,13 @@
+WEBUI_SECRET_KEY=CHANGE_ME
+WEBUI_NAME=OpenManage AI
+WEBUI_URL=http://atc-portal01.dell-atc.lan:3080
+ENABLE_SIGNUP=false
+DEFAULT_USER_ROLE=admin
+OPENAI_API_BASE_URL=http://10.0.10.106:8000/v1
+OPENAI_API_KEY=CHANGE_ME
+AIOHTTP_CLIENT_SESSION_TOOL_SERVER_SSL=false
+HF_HOME=/app/backend/data/cache
+TRANSFORMERS_CACHE=/app/backend/data/cache
+SENTENCE_TRANSFORMERS_HOME=/app/backend/data/cache
+ENABLE_VERSION_UPDATE_CHECK=true
+WEBUI_AUTH=true
@@ -0,0 +1,6 @@
+.env
+data/
+data-backup*
+*.tgz
+*.db
+__pycache__/
@@ -0,0 +1,28 @@
+# OpenManage AI — Demo script (ATC)
+
+URL: http://atc-portal01.dell-atc.lan:3080
+
+## Fleet snapshot (from OME API, Jul 2026)
+
+| Metric | Count |
+|--------|------:|
+| Managed devices | 73 |
+| Servers | 55 |
+| iDRACs | 42 |
+| Connected servers | 20 |
+| Powered on | 19 |
+| Firmware critical (Dell Online baseline) | 45 |
+
+## Starter prompts
+
+1. How many iDRACs are managed in OpenManage Enterprise, and how many servers are currently connected?
+2. Summarize critical alerts and unhealthy devices in the ATC fleet.
+3. Show firmware compliance for the Dell Online baseline — how many devices are critical?
+4. List PowerEdge R740xd servers and their health/connection state.
+5. Preview (do not execute) what a graceful shutdown would look like for a disconnected lab server.
+
+## Notes
+
+- Destructive actions require preview + confirmation via OME MCP.
+- LLM: Llama 3 70B GPTQ on atc-gpu-prod (`10.0.10.106:8000`).
+- MCP: `https://cov-omeprod01.dell-atc.lan/mcp`
@@ -0,0 +1,50 @@
+# OpenManage AI — documentation
+
+**Forgejo:** http://atc-mgt01.dell-atc.lan:3001/mo/openmanage-ai  
+**Live:** http://atc-portal01.dell-atc.lan:3080  
+**Companion cockpit:** http://atc-mgt01.dell-atc.lan:3001/mo/ome-cockpit
+
+## Purpose
+
+Branded **Open WebUI** instance (`WEBUI_NAME=OpenManage AI`) for ATC demos, wired to:
+
+- vLLM OpenAI API (`OPENAI_API_BASE_URL` → `http://10.0.10.106:8000/v1`)
+- OME fleet REST tool (`ome_fleet`) for reliable natural-language fleet answers
+- Optional native OME MCP entry (often session-unstable in this lab)
+
+## Architecture
+
+```mermaid
+flowchart LR
+  User[Admin browser :3080]
+  OWUI[Open WebUI container]
+  VLLM[vLLM :8000]
+  OME[OME REST]
+
+  User --> OWUI
+  OWUI -->|chat/completions| VLLM
+  OWUI -->|tool ome_fleet| OME
+```
+
+## Recommended model
+
+Use **OME Copilot** (pipeline with tools), not only bare `llama3-70b-gptq`, when you need live OME facts.
+
+## Auth (lab)
+
+Local accounts (managed in Open WebUI DB), signup disabled after bootstrap.  
+Passwords are **not** stored in git — rotate via ops runbook.
+
+## Deploy
+
+```bash
+cd /home/lab/openmanage   # or clone this repo
+cp .env.example .env
+docker compose up -d
+```
+
+See `SETUP.md` and `DEMO.md` for operator steps and known MCP session caveats.
+
+## Relation to Cockpit
+
+Cockpit chat can list Open WebUI models and route `ome-copilot` / `arena-model` through Open WebUI when `OPENWEBUI_EMAIL` / `OPENWEBUI_PASSWORD` are configured on the cockpit side.
@@ -0,0 +1,29 @@
+# OpenManage AI — ready to use
+
+URL: http://atc-portal01.dell-atc.lan:3080
+
+## Login
+- Email: the address you used at signup (not the display name "admin")
+- Password: your Open WebUI password
+
+## Use this model
+Select **OME Copilot** (not bare llama3-70b-gptq).
+
+Ask:
+- How many iDRACs are managed and how many servers are currently connected?
+- Give me the OME fleet summary
+
+Expected (live from OME REST): **42 iDRACs**, **20 connected servers**.
+
+## Why not raw MCP yet?
+OME native MCP requires a `login` tool, but the appliance currently drops the MCP session after login
+(`Session not found` / odd `host.docker.internal` target).  
+We therefore use the **OME Fleet** tool (REST API) for reliable demo answers.
+
+MCP server entry remains in External Tools (disabled) for when OAuth/session is fixed.
+
+## Ops
+```bash
+cd /home/lab/openmanage && docker compose ps
+df -h / /home
+```
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGATCCA+mgAwIBAgIUZ5SF3Z2NifBqaUO0gYE3hNk4dw4wDQYJKoZIhvcNAQEN
+BQAwgaQxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJUWDETMBEGA1UEBwwKUm91bmQg
+Um9jazESMBAGA1UECgwJRGVsbCBJbmMuMRkwFwYDVQQLDBBTZXJ2ZXIgU29sdXRp
+b25zMR8wHQYJKoZIhvcNAQkBFhBzdXBwb3J0QGRlbGwuY29tMSMwIQYDVQQDDBpj
+b3Ytb21lcHJvZDAxLmRlbGwtYXRjLmxhbjAeFw0yMzExMDMxMzQwMjBaFw0zMzEw
+MzExMzQwMjBaMIGkMQswCQYDVQQGEwJVUzELMAkGA1UECAwCVFgxEzARBgNVBAcM
+ClJvdW5kIFJvY2sxEjAQBgNVBAoMCURlbGwgSW5jLjEZMBcGA1UECwwQU2VydmVy
+IFNvbHV0aW9uczEfMB0GCSqGSIb3DQEJARYQc3VwcG9ydEBkZWxsLmNvbTEjMCEG
+A1UEAwwaY292LW9tZXByb2QwMS5kZWxsLWF0Yy5sYW4wggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQDExY4JaUgz/kfUxVGll2KdVVJuA2TVSTBd9qXoJWLR
+9juGL5zWS2lQeLB5mG8f70wujv93MsSfJXvtuy+DDCu3H68aqq+OEJtX4jYVesQ+
+NVzGQHpartOsSyVUTAEkS3HlchAsVfO4EuEMf7STX9dP9YgjXPDt3SlTloe9I3AF
+Lp62uSDp4EgXN6KKPreOldubjFHoha+/Q4OcfjBM1jZ/O3LWKMkLZEXR66fXzsLO
+u8MHfc2qdimn5Zuz7qnNr6qyQmEIlWbPkkWFiJ2s5nwAyj8ZsXTC8tKnH2SW/esN
+HkD9FTCIPac2c7G6oe7oVCjibT2WjgWbplfepmtZlt4bQNICBfZiEtRAbX7SAbQu
+j77BfsipgD0Mg47VEFXXPtiAWqapqQZYYqaLWcaY8InBvVtt85kWTSIRECNicHZu
+8loFCOVpCzzI6asDaesDAwMMXZMc8No+vQZJs7krOke5u0bBZ0UX26ZwRWiPQF3B
+4m6vviSGTHkA8qE/Wm3nT3Hn/7IjQoZFVrkG+ZVDJxIf7im4T8eL6MQQdN1nD6S0
+xRtPxU3o4BXx4ZrWpRMAB2b7Cy6PiYvlK2idiuIv5V+qVkomhhHP7+n43HULQe3n
+zHIFTn9yG1KD4PUjypbEHtXEcWXLc+sOh1j81u+P1I0pmPF1SFMOi7A9keebLyl2
+1QIDAQABoykwJzAlBgNVHREEHjAcghpjb3Ytb21lcHJvZDAxLmRlbGwtYXRjLmxh
+bjANBgkqhkiG9w0BAQ0FAAOCAgEAaquMWNw52E1AIvfzuh4JgB7TZMMSJl0LRfP8
+1XQgvWRq10gAm5Pm9qAjHQQAfTnNNEoCHiM/8sVsdpYXkXRpRNZ4LVLpOgxLJq53
+nZVLHTqe+u2amVSeptUCJILimucVFCMpq30dSQqGRDWbozMuWa0Y564wVY8Crp3l
+cx4D53tK9KAMUcELJbWyMUbHQIGi3J2qfdmjPM0DYCbOxvUitTfOz0JG7VupViBn
+eAxjWXIAr9S0omcKcG1h0E6oxmXz7fjVK2d6iBTWyJiGxNM1NNz7UvUu+m9Rc7HL
+C9jtd1sTzTw5cnOw76vt3IsE06/19o3Nri9wPKhPJ56qTosCotpR2fQH6yaIH7+4
+pWbGJ8J8ucMR4lLAAWBcodH4cHuECjlezVvLf89DwgFDpw+tmS83hWGzN+sBdGMQ
+Z3SczDFV8wGHRxbyZYYv0z3v/1vukwhZnMp1Z+YwWT5rXa7ApmNAy8+z11kCzq8B
+qx4LRWQd6973n6i96iCHCj3iS2m60J7qWpHrB8/XHL3DQDkV+K4W0pVTI8T8d374
+CPblOBs5c8wj+N87Ldt4zHBuS66ifmm8xWOBBBzt8S/3saUNPpDnJdauQoefVWVB
+2IZOeRmXwFFPVHywKCzLCmHhg+RR4DwgKkY+u5H2V5ft00puG9GZ6iThE6EeJ2uq
+cH4wPpY=
+-----END CERTIFICATE-----
@@ -0,0 +1,35 @@
+# OpenManage AI — Open WebUI for Dell OME MCP
+# Data lives on /home (913G) to avoid filling 70G root.
+services:
+  openmanage:
+    image: ghcr.io/open-webui/open-webui:v0.10.2
+    container_name: openmanage
+    restart: unless-stopped
+    ports:
+      - "3080:8080"
+    env_file:
+      - .env
+    environment:
+      - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
+      - WEBUI_NAME=${WEBUI_NAME}
+      - WEBUI_URL=${WEBUI_URL}
+      - ENABLE_SIGNUP=${ENABLE_SIGNUP}
+      - WEBUI_AUTH=${WEBUI_AUTH:-false}
+      - OPENAI_API_BASE_URL=${OPENAI_API_BASE_URL}
+      - OPENAI_API_KEY=${OPENAI_API_KEY}
+      - AIOHTTP_CLIENT_SESSION_TOOL_SERVER_SSL=${AIOHTTP_CLIENT_SESSION_TOOL_SERVER_SSL}
+      - HF_HOME=/app/backend/data/cache
+      - TRANSFORMERS_CACHE=/app/backend/data/cache
+      - SENTENCE_TRANSFORMERS_HOME=/app/backend/data/cache
+      - ENABLE_VERSION_UPDATE_CHECK=${ENABLE_VERSION_UPDATE_CHECK:-false}
+    volumes:
+      - ./data:/app/backend/data
+      - ./config/ome-ca.crt:/etc/ssl/certs/ome-ca.crt:ro
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
@@ -0,0 +1,19 @@
+# OpenManage AI architecture
+
+See root [README.md](../README.md) for the system diagram and relationship to OME Cockpit.
+
+## Components
+
+| Piece | Role |
+|-------|------|
+| Open WebUI | Chat UI, auth, model picker, tools |
+| vLLM | Inference backend |
+| ome_fleet tool | Reliable OME REST queries for demos |
+| OME MCP (optional) | Native tools — session stickiness unreliable in lab |
+
+## Data path for a tool-using question
+
+1. User selects **OME Copilot**
+2. Model emits tool call → Open WebUI executes `ome_fleet` / configured tools
+3. Tool hits OME REST (with SSL verify disabled for lab self-signed where configured)
+4. Model answers with concrete inventory facts