# Open WebUI production integration

Open WebUI must connect to the HTTPS load-balancer hostname, never directly to
the Cloud Run `run.app` URL. The load balancer terminates TLS and routes to a
serverless NEG for `awareness-service`; Cloud Run remains restricted to the
load-balancer ingress path.

## Open WebUI settings

Set the OpenAI-compatible connection to:

```text
Base URL: https://<approved-awareness-domain>/v1
API key:  retrieve the production value from Secret Manager (do not commit it)
Model:    sarvam-105b
```

Open WebUI should send the key as `Authorization: Bearer <key>`. Awareness also
accepts `X-API-Key` for service-to-service clients.

## GCP edge prerequisites

An approved DNS name is required before creating the managed certificate. The
DNS A record must point to the reserved global load-balancer address. Do not
use `awareness.bluepatterns.co.in` unless its ownership and delegation have
been explicitly approved.

Run `deploy_openwebui_edge.sh` from an authenticated Cloud Shell session after
setting `AWARENESS_DOMAIN` to that approved hostname. The script is guarded and
refuses to run with a placeholder or missing domain.

## Acceptance checks

1. `https://<domain>/v1/models` returns the certified model list.
2. Open WebUI can complete the Section 99-B legal benchmark.
3. An uncertified medical query fails closed.
4. The direct Cloud Run URL is not used by Open WebUI.
5. Cloud Armor, HTTPS redirect, Cloud Run restricted ingress, and IAM invoker
   policy are verified before production traffic is enabled.