Homelab: a private ChatGPT, every PDF tool, and transcription at home

Level BeginnerEstimated time 1 hRead first Homelab 2: one HTTPS entrance for all your services, Your first local model with llama.cppA word you don't know? Glossary

Three web services cover a lot of everyday needs. A chat window for your own models, so the family does not paste private things into a public chatbot. A toolbox for PDFs, so contracts and payslips are not uploaded to "free" converters. And transcription, so a meeting or a voice memo becomes text without leaving the house.

What you get. Replacements for a chatbot subscription, online PDF converters and transcription services, running on your own machines, and the three settings that keep them yours.

1. Open WebUI: a private chat for your models

docker run -d --name openwebui -p 127.0.0.1:3000:8080 \
  -v openwebui:/app/backend/data \
  -e WEBUI_AUTH=true -e ENABLE_SIGNUP=false \
  -e OLLAMA_BASE_URL=http://your-model-server:11434 \
  ghcr.io/open-webui/open-webui:main

It talks to Ollama, or to your model gateway as an OpenAI-compatible connection: every model you serve appears in the list.
Web search can go through your own SearXNG, so questions about the news stay private too.
Create the accounts yourself, then leave sign-up closed.

We ran it for months, then retired it: our own clients now do the job: Inari on Android and FoxDesk on the PC, talking to the same models through the same gateway. Its logs showed something worth knowing: published on the internet, almost every request came from automated scanners, not from us. If only your household uses it, reach it through your private network and do not publish it at all.

2. Stirling-PDF: every PDF tool, offline

docker run -d --name stirling-pdf -p 127.0.0.1:8081:8080 \
  -v stirling-configs:/configs \
  -e DOCKER_ENABLE_SECURITY=true \
  stirlingtools/stirling-pdf:latest

Merge, split, rotate, compress, convert, sign, and OCR scanned documents with Tesseract, in the browser, with the files never leaving your network. With security enabled it asks for a login; change the initial password at first connection.

3. Scriberr: recordings to text

Drop an audio file, get a transcript with timestamps, produced by WhisperX on your own machine. Ours runs next to the graphics cards, bound to the machine itself, and is reached through the private network with HTTPS, the only origin it accepts.

docker run -d --name scriberr --network host \
  -e HOST=127.0.0.1 -e PORT=8080 \
  -e ALLOWED_ORIGINS=https://your-machine.your-tailnet.ts.net:8080 \
  -v scriberr-data:/app/data -v scriberr-whisperx:/app/whisperx-env \
  ghcr.io/rishikanthc/scriberr:v1.2.0

The same three settings for all three

Bind to the machine itself (127.0.0.1) and publish through your reverse proxy or your private network, never by opening the port to everyone.
Login on, sign-up off. You create the accounts.
Pin a version rather than latest or main for what matters, so an update happens when you choose.

Traps

Do not turn off certificate checks to make a web loader "work": you would accept any answer from any impostor. Fix the certificate instead.

Give the most restricted role to new users by default. An interface where every new account is administrator is one leaked invitation away from trouble.

Found this useful? Tell us what to measure next.