Add Open WebUI service

[wedge22]

Pull Request Title: Add Open WebUI service

Description

Adds a Tailscale sidecar configuration for Open WebUI, a self-hosted AI interface that supports Ollama and OpenAI-compatible APIs. This allows users to securely access their private AI interface from anywhere on their Tailnet without exposing it to the public internet.

Related Issues

N/A

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactoring

How Has This Been Tested?

1. Deployed the stack via Portainer on an unRAID server
2. Confirmed Tailscale container joined the Tailnet successfully
3. Accessed Open WebUI via MagicDNS URL on a mobile device over cellular (no LAN)
4. Confirmed connection to a remote Ollama instance and successfully ran inference

Checklist

• I have performed a self-review of my code
• I have added tests that prove my fix or feature works
• I have updated necessary documentation (e.g. frontpage README.md)
• Any dependent changes have been merged and published in downstream modules

Additional Notes

• The standard 41234/healthz health check endpoint is not available when using TS_USERSPACE=true. This config uses tailscale status as the health check instead.
• Open WebUI is provider-agnostic — OLLAMA_BASE_URL can point to a local Ollama instance, a remote machine on the LAN or Tailnet, or be left blank to configure an OpenAI-compatible API via the UI.
• Ollama is intentionally not bundled in this compose — users may run it on a separate machine or use a different AI backend entirely.

[jackspiering]

@wedge22 Thank you for your PR. Your PR is not reflecting the templates for .env and compose.yaml. Please change the naming conventions of the files and their contents to reflect the templates that can be found via the following link: https://github.com/tailscale-dev/ScaleTail/tree/main/templates/service-template

[wedge22]

Thanks for the feedback, I've updated the files to match the template structure. Please let me know if anything else needs changing.

[jackspiering]

Looks good to me. @crypt0rr please have a look and approve and merge if it looks good to you.

[crypt0rr]

In your PR additional notes you state:

The standard 41234/healthz health check endpoint is not available when using TS_USERSPACE=true. This config uses tailscale status as the health check instead.

In the current configuration I see the USERSPACE and health check back to the default configuration.

Please double check.

[crypt0rr]

Just tried locally with an already running service. Changed the variable TS_USERSPACE from false to true, restarted the service and still got the standard 41234/healthz healthcheck to work.

...
  tailscale-nginx:
    image: tailscale/tailscale:latest
    container_name: tailscale-nginx
    hostname: proxy
    environment:
      #- TS_AUTHKEY=
      - TS_STATE_DIR=/var/lib/tailscale
#      - TS_SERVE_CONFIG=/config/serve.json
      **- TS_USERSPACE=true**
...