Ollama & Open WebUI - Hardened Private LLM Runtime

Ollama is a Go-based runtime for running large language models locally - it pulls quantized GGUF weights from the public Ollama library and exposes a streaming REST API for inference with optional GPU acceleration via NVIDIA CUDA. Open WebUI is a self-hosted ChatGPT-style web interface (FastAPI + Svelte) that connects to the local Ollama API and lets your team chat with models, manage conversations, upload documents for RAG, run web search, and configure prompt templates. The bundle supports CPU and GPU instance types (g4dn.xlarge, g5.xlarge), embedded SQLite for chat history and user accounts, and Llama, Mistral, Gemma, Phi, Qwen, DeepSeek-R1 and 100+ models pulled on demand. Together they form a complete private AI stack with no external service dependencies.

LICENSING NOTE

Ollama is MIT-licensed. Open WebUI is distributed under the source-available Open WebUI License (not an OSI-approved open-source license). The license permits self-hosted use without restriction; deployments with more than 50 end users in any 30-day window that also modify Open WebUI branding (name, logo) require a commercial Enterprise License from Open WebUI Inc. This AMI ships Open WebUI with the original branding preserved - the 50-user clause does not apply unless the operator rebrands.

WHAT THIS AMI ADDS

Security hardening:

• Authentication enabled by default
• Nginx reverse proxy with TLS - Open WebUI proxied on port 443
• Ollama API (port 11434) bound to localhost only
• UFW firewall - ports 22, 80, 443 only
• fail2ban, AppArmor

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
• auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report at /etc/lynxroute/cis-report.html
• CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md