Deploy a Complete AI Stack on a Budget VPS: Ollama + Open WebUI + Dify (2026 Guide)

ssh root@your-server-ip
# Create a non-root user with sudo
adduser deploy
usermod -aG sudo deploy
su - deploy

# Update system
sudo apt update && sudo apt upgrade -y

# Install Docker
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER
newgrp docker  # or log out and back in

# Verify
docker --version
docker compose version

mkdir -p ~/ai-stack && cd ~/ai-stack
mkdir -p data/open-webui data/dify data/dify/postgres data/dify/redis data/dify/weaviate data/n8n data/qdrant

# ~/ai-stack/docker-compose.yml
version: '3.8'

services:
  # ─── Ollama: Local LLM Inference ───
  ollama:
    image: ollama/ollama:latest
    container_name: ollama
    restart: unless-stopped
    volumes:
      - ./data/ollama:/root/.ollama
    ports:
      - "11434:11434"
    environment:
      - OLLAMA_KEEP_ALIVE=24h
      - OLLAMA_HOST=0.0.0.0
    deploy:
      resources:
        limits:
          memory: 12G
    command: serve

  # ─── Open WebUI: ChatGPT-Style Interface ───
  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: open-webui
    restart: unless-stopped
    depends_on:
      - ollama
    volumes:
      - ./data/open-webui:/app/backend/data
    ports:
      - "3000:8080"
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
      - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY:-change-me-to-random}
    deploy:
      resources:
        limits:
          memory: 2G

  # ─── Dify: AI App Builder ───
  # API service
  dify-api:
    image: langgenius/dify-api:latest
    container_name: dify-api
    restart: unless-stopped
    depends_on:
      dify-postgres:
        condition: service_healthy
      dify-redis:
        condition: service_healthy
    volumes:
      - ./data/dify/storage:/app/api/storage
    ports:
      - "5001:5001"
    environment:
      - MODE=api
      - LOG_LEVEL=INFO
      - SECRET_KEY=${DIFY_SECRET_KEY:-change-me-randomly}
      - DB_USERNAME=postgres
      - DB_PASSWORD=${DIFY_DB_PASSWORD:-difyai123456}
      - DB_HOST=dify-postgres
      - DB_PORT=5432
      - DB_DATABASE=dify
      - REDIS_HOST=dify-redis
      - REDIS_PORT=6379
      - REDIS_PASSWORD=${DIFY_REDIS_PASSWORD:-}
      - STORAGE_TYPE=local
      - STORAGE_LOCAL_PATH=/app/api/storage
      - VECTOR_STORE=qdrant
      - QDRANT_URL=http://qdrant:6333
    deploy:
      resources:
        limits:
          memory: 1G

  # Dify Worker (background tasks)
  dify-worker:
    image: langgenius/dify-api:latest
    container_name: dify-worker
    restart: unless-stopped
    depends_on:
      dify-postgres:
        condition: service_healthy
      dify-redis:
        condition: service_healthy
    volumes:
      - ./data/dify/storage:/app/api/storage
    environment:
      - MODE=worker
      - LOG_LEVEL=INFO
      - SECRET_KEY=${DIFY_SECRET_KEY:-change-me-randomly}
      - DB_USERNAME=postgres
      - DB_PASSWORD=${DIFY_DB_PASSWORD:-difyai123456}
      - DB_HOST=dify-postgres
      - DB_PORT=5432
      - DB_DATABASE=dify
      - REDIS_HOST=dify-redis
      - REDIS_PORT=6379
      - REDIS_PASSWORD=${DIFY_REDIS_PASSWORD:-}
      - STORAGE_TYPE=local
      - STORAGE_LOCAL_PATH=/app/api/storage
    deploy:
      resources:
        limits:
          memory: 1G

  # Dify Web frontend
  dify-web:
    image: langgenius/dify-web:latest
    container_name: dify-web
    restart: unless-stopped
    depends_on:
      - dify-api
    ports:
      - "3001:3000"
    environment:
      - CONSOLE_API_URL=http://dify-api:5001
      - APP_API_URL=http://dify-api:5001
    deploy:
      resources:
        limits:
          memory: 512M

  # Dify PostgreSQL
  dify-postgres:
    image: postgres:15-alpine
    container_name: dify-postgres
    restart: unless-stopped
    volumes:
      - ./data/dify/postgres:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=${DIFY_DB_PASSWORD:-difyai123456}
      - POSTGRES_DB=dify
      - POSTGRES_USER=postgres
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "postgres", "-d", "dify"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 512M

  # Dify Redis
  dify-redis:
    image: redis:7-alpine
    container_name: dify-redis
    restart: unless-stopped
    volumes:
      - ./data/dify/redis:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 256M

  # ─── Qdrant: Vector Database (shared) ───
  qdrant:
    image: qdrant/qdrant:latest
    container_name: qdrant
    restart: unless-stopped
    volumes:
      - ./data/qdrant:/qdrant/storage
    ports:
      - "6333:6333"
    deploy:
      resources:
        limits:
          memory: 1G

  # ─── n8n: AI Workflow Automation ───
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    volumes:
      - ./data/n8n:/home/node/.n8n
    ports:
      - "5678:5678"
    environment:
      - N8N_SECURE_COOKIE=false
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY:-change-me-randomly}
      - N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE=true
    deploy:
      resources:
        limits:
          memory: 1G

  # ─── Caddy: Reverse Proxy with Auto SSL ───
  caddy:
    image: caddy:2-alpine
    container_name: caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./data/caddy/data:/data
      - ./data/caddy/config:/config
    deploy:
      resources:
        limits:
          memory: 128M

# ~/ai-stack/Caddyfile
ai.yourdomain.com {
    reverse_proxy open-webui:8080
}

dify.yourdomain.com {
    reverse_proxy dify-web:3000
}

n8n.yourdomain.com {
    reverse_proxy n8n:5678
}

# ~/ai-stack/.env
WEBUI_SECRET_KEY=$(openssl rand -hex 32)
DIFY_SECRET_KEY=$(openssl rand -hex 32)
DIFY_DB_PASSWORD=$(openssl rand -hex 16)
N8N_ENCRYPTION_KEY=$(openssl rand -hex 16)

cd ~/ai-stack

# Start everything
docker compose up -d

# Check status
docker compose ps

# Watch logs
docker compose logs -f

# Verify Ollama
curl http://localhost:11434/api/tags

# Verify Open WebUI
curl http://localhost:3000  # should return HTML

# Verify Dify
curl http://localhost:3001  # should redirect to setup

# Verify n8n
curl http://localhost:5678/healthz

# Pull Llama 3.1 8B (good balance of quality and speed)
docker exec -it ollama ollama pull llama3.1:8b

# Or pull a smaller, faster model
docker exec -it ollama ollama pull phi3:mini  # 3.8B, very fast

# Test inference
docker exec -it ollama ollama run llama3.1:8b "Explain quantum computing in one paragraph"

# In docker-compose.yml, set a hard memory limit
ollama:
  deploy:
    resources:
      limits:
        memory: 8G  # Adjust based on your total RAM

# Speed comparison on 8 vCPU Hetzner:
# phi3:mini (3.8B)  → ~25 tok/s  — snappy
# llama3.2:3b        → ~20 tok/s  — fast
# mistral:7b         → ~12 tok/s  — decent
# llama3.1:8b        → ~8 tok/s   — usable
# qwen2.5:14b        → ~3 tok/s   — slow

# Start only what you need
docker compose up -d ollama open-webui n8n qdrant
# Omit dify-* services entirely

sudo fallocate -l 8G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

# Add a cron job to release idle model memory
crontab -e
# Add: 0 */4 * * * curl -s http://localhost:11434/api/generate -d '{"model":"","keep_alive":0}' > /dev/null