diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 51904352b3b7..40695872a16f 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -8,7 +8,9 @@
 
 ## New Services {#sec-release-24.11-new-services}
 
-- Create the first release note entry in this section!
+- [Open-WebUI](https://github.com/open-webui/open-webui), a user-friendly WebUI
+  for LLMs. Available as [services.open-webui](#opt-services.open-webui.enable)
+  service.
 
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
diff --git a/nixos/modules/services/misc/ollama.nix b/nixos/modules/services/misc/ollama.nix
index 6f00dbfa7531..886eaa180b9e 100644
--- a/nixos/modules/services/misc/ollama.nix
+++ b/nixos/modules/services/misc/ollama.nix
@@ -78,11 +78,11 @@ in
         '';
       };
       port = lib.mkOption {
-        type = types.nullOr types.ints.u16;
+        type = types.port;
         default = 11434;
         example = 11111;
         description = ''
-          Which port the ollama server listens to. Set to `null` to not specify a port.
+          Which port the ollama server listens to.
         '';
       };
       acceleration = lib.mkOption {
@@ -116,6 +116,14 @@ in
           Since `ollama run` is mostly a shell around the ollama server, this is usually sufficient.
         '';
       };
+      openFirewall = lib.mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for ollama.
+          This adds `services.ollama.port` to `networking.firewall.allowedTCPPorts`.
+        '';
+      };
     };
   };
 
@@ -127,11 +135,7 @@ in
       environment = cfg.environmentVariables // {
         HOME = cfg.home;
         OLLAMA_MODELS = cfg.models;
-        OLLAMA_HOST =
-          if cfg.port == null then
-            cfg.host
-          else
-            "${cfg.host}:${toString cfg.port}";
+        OLLAMA_HOST = "${cfg.host}:${toString cfg.port}";
       };
       serviceConfig = {
         ExecStart = "${lib.getExe ollamaPackage} serve";
@@ -142,6 +146,8 @@ in
       };
     };
 
+    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.port ]; };
+
     environment.systemPackages = [ ollamaPackage ];
   };
 
diff --git a/nixos/modules/services/misc/open-webui.nix b/nixos/modules/services/misc/open-webui.nix
index de61ff80e922..a43e819aac80 100644
--- a/nixos/modules/services/misc/open-webui.nix
+++ b/nixos/modules/services/misc/open-webui.nix
@@ -12,55 +12,71 @@ in
 {
   options = {
     services.open-webui = {
-      enable = lib.mkEnableOption "Enable open-webui, an interactive chat web app";
+      enable = lib.mkEnableOption "Open-WebUI server";
       package = lib.mkPackageOption pkgs "open-webui" { };
 
       stateDir = lib.mkOption {
         type = types.path;
         default = "/var/lib/open-webui";
-        description = "State directory of open-webui.";
+        example = "/home/foo";
+        description = "State directory of Open-WebUI.";
       };
 
       host = lib.mkOption {
         type = types.str;
-        default = "localhost";
-        description = "Host of open-webui";
+        default = "127.0.0.1";
+        example = "0.0.0.0";
+        description = ''
+          The host address which the Open-WebUI server HTTP interface listens to.
+        '';
       };
 
       port = lib.mkOption {
         type = types.port;
         default = 8080;
-        description = "Port of open-webui";
+        example = 11111;
+        description = ''
+          Which port the Open-WebUI server listens to.
+        '';
       };
 
       environment = lib.mkOption {
         type = types.attrsOf types.str;
-        default = { };
+        default = {
+          SCARF_NO_ANALYTICS = "True";
+          DO_NOT_TRACK = "True";
+          ANONYMIZED_TELEMETRY = "False";
+        };
         example = ''
           {
-            OLLAMA_API_BASE_URL = "http://localhost:11434";
+            OLLAMA_API_BASE_URL = "http://127.0.0.1:11434";
             # Disable authentication
             WEBUI_AUTH = "False";
           }
         '';
-        description = "Extra environment variables for open-webui";
+        description = "Extra environment variables for Open-WebUI";
+      };
+
+      openFirewall = lib.mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for Open-WebUI.
+          This adds `services.open-webui.port` to `networking.firewall.allowedTCPPorts`.
+        '';
       };
     };
   };
 
   config = lib.mkIf cfg.enable {
     systemd.services.open-webui = {
-      description = "User-friendly WebUI for LLMs (Formerly Ollama WebUI)";
+      description = "User-friendly WebUI for LLMs";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
 
-      preStart = ''
-        mkdir -p ${cfg.stateDir}/static
-      '';
-
       environment = {
-        STATIC_DIR = "${cfg.stateDir}/static";
-        DATA_DIR = "${cfg.stateDir}";
+        STATIC_DIR = ".";
+        DATA_DIR = ".";
       } // cfg.environment;
 
       serviceConfig = {
@@ -88,6 +104,8 @@ in
         UMask = "0077";
       };
     };
+
+    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.port ]; };
   };
 
   meta.maintainers = with lib.maintainers; [ shivaraj-bh ];