_: {
  services.open-webui = {
    enable = true;
    port = 8080;
    host = "127.0.0.1";
    environment = {
      ANONYMIZED_TELEMETRY = "False";
      DO_NOT_TRACK = "True";
      SCARF_NO_ANALYTICS = "True";
      # Enable authentication
      WEBUI_AUTH = "True";
    };
    # Model backend connections (Ollama/OpenAI) are PersistentConfig: configured
    # via the admin web UI and stored in Open WebUI's DB. Not managed here — env
    # vars only apply on first launch and would drift from the live config.
  };
}