Deploy the optional Web UI
Add the browser UI as a Compose profile or a Helm option - it runs on its own origin.
Eddytor is API-first - the server is REST + gRPC + MCP. A browser UI ships as
a separate image (ghcr.io/nordalf/eddytor-ce-ui), off by default. It runs on
its own origin and proxies to the server, so the key detail is registering
that origin as an OAuth redirect URI.
The installer prompts on a fresh install (answer Y, or set
EDDYTOR_WITH_UI=true for non-interactive runs). It serves at
http://localhost:3000 and sets three things in .env:
COMPOSE_PROFILES=ui # start the eddytor-ui service
EDDYTOR_UI_VERSION=<published ui tag> # pinned from get.eddytor.com/ui/VERSION
EDDYTOR__SERVER__WEB_REDIRECT_URIS=http://localhost:3000/auth/callbackAdd it to an existing install:
EDDYTOR_WITH_UI=true sh -c "$(curl -fsSL https://get.eddytor.com)"
# or add the three lines above, then:
docker compose pull && docker compose up -dDisable it again by removing the COMPOSE_PROFILES line and running
docker compose up -d --remove-orphans.
Enable it and give it a public origin; the chart registers
{ui.origin}/auth/callback as a server redirect URI automatically:
helm upgrade --install eddytor oci://ghcr.io/nordalf/charts/eddytor -n eddytor \
--set ui.enabled=true \
--set ui.origin=https://app.eddytor.example.com \
--set ui.ingress.enabled=true --set ui.ingress.host=app.eddytor.example.comFor a quick eval, expose it on a NodePort/LoadBalancer instead and port-forward.
ui.image.tag tracks the UI's own release cadence, independent of the
server/engine image.tag.
Heads up
web_redirect_uri, sign-in fails with 400 redirect_uri does not match any registered URI. The env form replaces (not
merges with) any web_redirect_uris in config.toml - add further URIs to that
same line, comma-separated.Beyond localhost
The UI is a second public origin with its own knobs (Compose interpolates them):
| Variable | Meaning |
|---|---|
EDDYTOR_UI_ORIGIN | The UI's public origin. Must match a registered redirect URI. |
EDDYTOR_UI_API_BASE_URL | Backend origin the browser is redirected to for OAuth - your public server.public_url, not the compose service name. |
EDDYTOR_UI_COOKIE_DOMAIN | Auth cookie domain. Empty = host-only (correct for separate origins). |
No CORS changes are needed: the browser only talks to the UI's own origin; a same-origin proxy inside the UI forwards to the server.
TLS
Terminate TLS for the UI origin at your edge exactly like the API - the UI
container serves plaintext on :3000. See
TLS termination.