You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
827 lines
30 KiB
Markdown
827 lines
30 KiB
Markdown
---
|
|
title: Deploying LobeChat with Docker Compose
|
|
description: >-
|
|
Learn how to deploy the LobeChat service using Docker Compose, including
|
|
configuration tutorials for various services.
|
|
tags:
|
|
- Docker Compose
|
|
- LobeChat
|
|
- Docker Container
|
|
- Deployment Guide
|
|
---
|
|
|
|
# Deploying LobeChat Server Database Version with Docker Compose
|
|
|
|
<div style={{display:"flex", gap: 4}}>
|
|
[![][docker-release-shield]][docker-release-link]
|
|
|
|
[![][docker-size-shield]][docker-size-link]
|
|
|
|
[![][docker-pulls-shield]][docker-pulls-link]
|
|
</div>
|
|
|
|
<Callout type="warning">
|
|
**Note on Docker Deployment Limitations**
|
|
The Docker and Docker Compose deployment options do not support injecting the `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY` through environment variables, which prevents enabling the Clerk authentication service. Recommended alternatives include:
|
|
|
|
- Hosting deployment via Vercel
|
|
|
|
- Running a local image build process
|
|
</Callout>
|
|
|
|
## Quick Start
|
|
|
|
<Callout type="info">
|
|
**System Compatibility Notes**
|
|
|
|
- One-click deployment is supported in Unix environments (Linux/macOS).
|
|
|
|
- Windows users must run through [WSL 2](https://aka.ms/wsl).
|
|
|
|
- The one-click startup script is only for initial deployment; for subsequent deployments, please refer to the [Custom Deployment](#custom-deployment) section.
|
|
|
|
- Port occupation check: Ensure that ports `3210`, `8000`, `9000`, and `9001` are available.
|
|
</Callout>
|
|
|
|
Execute the following commands to set up the deployment environment; the directory `lobe-chat-db` will be used to store your configuration files and subsequent database files.
|
|
|
|
```sh
|
|
mkdir lobe-chat-db && cd lobe-chat-db
|
|
```
|
|
|
|
Fetch and execute the deployment script:
|
|
|
|
```sh
|
|
bash <(curl -fsSL https://lobe.li/setup.sh) -l en
|
|
```
|
|
|
|
The script supports the following deployment modes; please choose the appropriate mode based on your needs and read the rest of the documentation.
|
|
|
|
- [Local Mode (default)](#local-mode): Accessible only locally, not supporting LAN/public access; suitable for initial experiences.
|
|
- [Port Mode](#port-mode): Supports LAN/public `http` access; suitable for no domain or private network use.
|
|
- [Domain Mode](#domain-mode): Supports LAN/public `http/https` access with reverse proxy; suitable for personal or team use.
|
|
|
|
<Callout type="info">
|
|
In the script's options prompt `(Option1/Option2)[Option1]`: `(Option1 / Option2)` indicates selectable options, while `[Option1]` indicates the default option; simply press enter to choose the default.
|
|
</Callout>
|
|
|
|
### Local Mode
|
|
|
|
<Steps>
|
|
### Complete Remaining Configuration in Interactive Script
|
|
|
|
Continue pressing enter to use the default configuration.
|
|
|
|
### Check Configuration Generation Report
|
|
|
|
After the script finishes running, you need to check the configuration generation report, which includes the accounts and initial login passwords for the Casdoor administrator and user.
|
|
|
|
<Callout type="warning">
|
|
Please log in to LobeChat using the user account; the administrator account is only for managing Casdoor.
|
|
</Callout>
|
|
|
|
```log
|
|
The results of the secure key generation are as follows:
|
|
LobeChat:
|
|
- URL: http://localhost:3210
|
|
- Username: user
|
|
- Password: c66f8c
|
|
Casdoor:
|
|
- URL: http://localhost:8000
|
|
- Username: admin
|
|
- Password: c66f8c
|
|
Minio:
|
|
- URL: http://localhost:9000
|
|
- Username: admin
|
|
- Password: 8c82ea41
|
|
```
|
|
|
|
### Start Docker
|
|
|
|
```sh
|
|
docker compose up -d
|
|
```
|
|
|
|
### Check Logs
|
|
|
|
```sh
|
|
docker logs -f lobe-chat
|
|
```
|
|
|
|
If you see the following logs in the container, it means the startup was successful:
|
|
|
|
```log
|
|
[Database] Start to migration...
|
|
✅ database migration pass.
|
|
-------------------------------------
|
|
▲ Next.js 14.x.x
|
|
- Local: http://localhost:3210
|
|
- Network: http://0.0.0.0:3210
|
|
|
|
✓ Starting...
|
|
✓ Ready in 95ms
|
|
```
|
|
|
|
### Access Application
|
|
|
|
Visit your LobeChat service at [http://localhost:3210](http://localhost:3210). The account credentials for the application can be found in the report from step `2`.
|
|
</Steps>
|
|
|
|
### Port Mode
|
|
|
|
<Steps>
|
|
### Complete Remaining Configuration in Interactive Script
|
|
|
|
In port mode, you need to complete the following based on the script prompts:
|
|
|
|
- Server IP address settings: for LAN/public access.
|
|
- Regenerate secure keys: We highly recommend regenerating the secure keys; if you lack the key generation library required by the script, we suggest referring to the [Custom Deployment](#custom-deployment) section for key modifications.
|
|
|
|
### Check Configuration Generation Report
|
|
|
|
After the script finishes running, please check the configuration generation report for the Casdoor administrator account, user account, and their initial login passwords.
|
|
|
|
<Callout type="warning">
|
|
Please log in to LobeChat using the user account; the administrator account is only for managing Casdoor.
|
|
</Callout>
|
|
|
|
```log
|
|
The results of the secure key generation are as follows:
|
|
LobeChat:
|
|
- URL: http://your_server_ip:3210
|
|
- Username: user
|
|
- Password: 837e26
|
|
Casdoor:
|
|
- URL: http://your_server_ip:8000
|
|
- Username: admin
|
|
- Password: 837e26
|
|
Minio:
|
|
- URL: http://your_server_ip:9000
|
|
- Username: admin
|
|
- Password: dbac8440
|
|
```
|
|
|
|
### Start Docker
|
|
|
|
```sh
|
|
docker compose up -d
|
|
```
|
|
|
|
### Check Logs
|
|
|
|
```sh
|
|
docker logs -f lobe-chat
|
|
```
|
|
|
|
If you see the following logs in the container, it means the startup was successful:
|
|
|
|
```log
|
|
[Database] Start to migration...
|
|
✅ database migration pass.
|
|
-------------------------------------
|
|
▲ Next.js 14.x.x
|
|
- Local: http://your_server_ip:3210
|
|
- Network: http://0.0.0.0:3210
|
|
✓ Starting...
|
|
✓ Ready in 95ms
|
|
```
|
|
|
|
### Access Application
|
|
|
|
You can access your LobeChat service at `http://your_server_ip:3210`. The account credentials for the application can be found in the report from step `2`.
|
|
|
|
<Callout type="warning">
|
|
If your service can accessed via the public network,
|
|
we strongly recommend disabling the registration,
|
|
refer to the [documentation](https://lobehub.com/docs/self-hosting/advanced/auth/next-auth/casdoor)
|
|
for more information.
|
|
</Callout>
|
|
</Steps>
|
|
|
|
### Domain Mode
|
|
|
|
<Steps>
|
|
### Complete Reverse Proxy Configuration
|
|
|
|
In domain mode, you need to complete the reverse proxy configuration and ensure that the LAN/public can access the following services. Please use a reverse proxy to map the following service ports to the domain names:
|
|
|
|
| Domain | Proxy Port | Required |
|
|
| ---------------------- | ---------- | -------- |
|
|
| `lobe.example.com` | `3210` | Yes |
|
|
| `auth.example.com` | `8000` | Yes |
|
|
| `minio.example.com` | `9000` | Yes |
|
|
| `minio-ui.example.com` | `9001` | |
|
|
|
|
<Callout type="important">
|
|
If you are using panel software like [aaPanel](https://www.bt.cn/) for reverse proxy configuration,
|
|
ensure it does not intercept requests to the `.well-known` path to facilitate the proper functioning of Casdoor's OAuth2 configuration.
|
|
Below is a whitelist configuration for the Nginx server block concerning paths for Casdoor reverse proxy:
|
|
|
|
```nginx
|
|
location /.well-known/openid-configuration {
|
|
proxy_pass http://localhost:8000; # Forward to localhost:8000
|
|
proxy_set_header Host $host; # Keep the original host header
|
|
proxy_set_header X-Real-IP $remote_addr; # Keep the client's real IP
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # Keep the forwarded IP
|
|
proxy_set_header X-Forwarded-Proto $scheme; # Keep the request protocol
|
|
}
|
|
```
|
|
|
|
⚠️ If you are using such panel software,
|
|
please do not enable any form of caching in the reverse proxy settings of such panel software to avoid affecting the normal operation of the service.
|
|
Read more at https://github.com/lobehub/lobe-chat/discussions/5986
|
|
</Callout>
|
|
|
|
### Complete Remaining Configuration in Interactive Script
|
|
|
|
In domain mode, you need to complete the following configurations based on script prompts:
|
|
|
|
- Domain setup for the LobeChat service: `lobe.example.com`
|
|
- Domain setup for the Minio service: `minio.example.com`
|
|
- Domain setup for the Casdoor service: `auth.example.com`
|
|
- Choose the access protocol: `http` or `https`
|
|
- Regenerate secure keys: We highly recommend regenerating the secure keys; if you lack the key generation library required by the script, we suggest referring to the [Custom Deployment](#custom-deployment) section for key modifications.
|
|
|
|
<Callout type="warning">
|
|
The following issues may impede access to your service:
|
|
|
|
- The domain configuration here must match the reverse proxy configuration in step `1`.
|
|
|
|
- If you are using Cloudflare for domain resolution and have activated `full proxy`, please use the `https` protocol.
|
|
|
|
- If you have used the HTTPS protocol, ensure that your domain certificate is correctly configured; one-click deployment does not support self-signed certificates by default.
|
|
</Callout>
|
|
|
|
### Check Configuration Generation Report
|
|
|
|
After the script finishes running, you need to check the configuration generation report, which includes the initial login password for the Casdoor administrator.
|
|
|
|
<Callout type="warning">
|
|
Please log in to LobeChat using the user account; the administrator account is only for managing Casdoor.
|
|
</Callout>
|
|
|
|
```log
|
|
The results of the secure key generation are as follows:
|
|
LobeChat:
|
|
- URL: https://lobe.example.com
|
|
- Username: user
|
|
- Password: 837e26
|
|
Casdoor:
|
|
- URL: https://auth.example.com
|
|
- Username: admin
|
|
- Password: 837e26
|
|
Minio:
|
|
- URL: https://minio.example.com
|
|
- Username: admin
|
|
- Password: dbac8440
|
|
```
|
|
|
|
### Start Docker
|
|
|
|
```sh
|
|
docker compose up -d
|
|
```
|
|
|
|
### Check Logs
|
|
|
|
```sh
|
|
docker logs -f lobe-chat
|
|
```
|
|
|
|
If you see the following logs in the container, it indicates a successful startup:
|
|
|
|
```log
|
|
[Database] Start to migration...
|
|
✅ database migration pass.
|
|
-------------------------------------
|
|
▲ Next.js 14.x.x
|
|
- Local: https://localhost:3210
|
|
- Network: http://0.0.0.0:3210
|
|
✓ Starting...
|
|
✓ Ready in 95ms
|
|
```
|
|
|
|
### Access Application
|
|
|
|
You can access your LobeChat service via `https://lobe.example.com`. The account credentials for the application can be found in the report from step `3`.
|
|
|
|
<Callout type="warning">
|
|
If your service can accessed via the public network,
|
|
we strongly recommend disabling the registration,
|
|
refer to the [documentation](https://lobehub.com/docs/self-hosting/advanced/auth/next-auth/casdoor)
|
|
for more information.
|
|
</Callout>
|
|
</Steps>
|
|
|
|
## Custom Deployment
|
|
|
|
This section mainly introduces the configurations that need to be modified to customize the deployment of the LobeChat service in different network environments. Before starting, you can download the [Docker Compose configuration file](https://raw.githubusercontent.com/lobehub/lobe-chat/HEAD/docker-compose/local/docker-compose.yml) and the [environment variable configuration file](https://raw.githubusercontent.com/lobehub/lobe-chat/refs/heads/main/docker-compose/local/.env.example).
|
|
|
|
```sh
|
|
curl -O https://raw.githubusercontent.com/lobehub/lobe-chat/HEAD/docker-compose/local/docker-compose.yml
|
|
curl -O https://raw.githubusercontent.com/lobehub/lobe-chat/HEAD/docker-compose/local/.env.en_US.example
|
|
mv .env.en_US.example .env
|
|
```
|
|
|
|
<Callout type="info">
|
|
This section does not cover all complete variables; remaining variables can be referenced in [Deploying with the Server Database](/en/docs/self-hosting/server-database).
|
|
</Callout>
|
|
|
|
### Prerequisites
|
|
|
|
Generally, to fully run the LobeChat database version, you will need at least the following four services:
|
|
|
|
- The LobeChat database version itself
|
|
- PostgreSQL database with PGVector plugin
|
|
- Object storage service that supports S3 protocol
|
|
- An SSO authentication service supported by LobeChat
|
|
|
|
These services can be combined through self-hosting or online cloud services to meet various deployment needs. In this article, we provide a Docker Compose configuration entirely based on open-source self-hosted services, which can be used directly to start the LobeChat database version or modified to suit your requirements.
|
|
|
|
We use [MinIO](https://github.com/minio/minio) as the local S3 object storage service and [Casdoor](https://github.com/casdoor/casdoor) as the local authentication service by default.
|
|
|
|
<Callout type="warning">
|
|
If your network topology is complex, please make sure these services can communicate properly within your network environment.
|
|
</Callout>
|
|
|
|
### Necessary Configuration
|
|
|
|
Now, we will introduce the necessary configurations for running these services:
|
|
|
|
1. Casdoor
|
|
|
|
- LobeChat requires communication with Casdoor, so you need to configure Casdoor's Issuer.
|
|
|
|
```env
|
|
AUTH_CASDOOR_ISSUER=https://auth.example.com
|
|
```
|
|
|
|
This configuration will affect LobeChat's login authentication service, and you need to ensure that the URL of the Casdoor service is correct. You can find common manifestations and solutions for errors in this configuration in the [FAQ](#faq).
|
|
|
|
- Additionally, you need to allow the callback URL in Casdoor to point to the LobeChat address:
|
|
|
|
Please add a line in the `Authentication -> Application` -> `<Application ID, default is app-built-in>` -> `Redirect URI` in Casdoor's web panel:
|
|
|
|
```
|
|
https://auth.example.com/api/auth/callback/casdoor
|
|
```
|
|
|
|
- Casdoor needs to provide the Origin information for access in the environment variables:
|
|
|
|
```env
|
|
origin=https://auth.example.com
|
|
```
|
|
|
|
2. MinIO
|
|
|
|
- LobeChat needs to provide a public access URL for object files for the LLM service provider, hence you need to configure MinIO's Endpoint.
|
|
|
|
```env
|
|
S3_PUBLIC_DOMAIN=https://minio.example.com
|
|
S3_ENDPOINT=https://minio.example.com
|
|
```
|
|
|
|
3. PostgreSQL
|
|
|
|
This configuration is found in the `docker-compose.yml` file, and you will need to configure the database name and password:
|
|
|
|
```yaml
|
|
services:
|
|
lobe:
|
|
environment:
|
|
- 'DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}'
|
|
```
|
|
|
|
## FAQ
|
|
|
|
#### Unable to Log In Properly
|
|
|
|
Check for the following errors based on the container logs:
|
|
|
|
```sh
|
|
docker logs -f lobe-chat
|
|
```
|
|
|
|
- r3: "response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)
|
|
|
|
```log
|
|
lobe-chat | [auth][error] r3: "response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)
|
|
```
|
|
|
|
Cause: This issue is typically caused by improper reverse proxy configuration; you need to ensure your reverse proxy configuration does not intercept the Casdoor OAuth2 configuration requests.
|
|
|
|
Solutions:
|
|
|
|
- Please refer to the reverse proxy configuration notes in the [Domain Mode](#domain-mode) section.
|
|
|
|
- A direct troubleshooting method is to access `https://auth.example.com/.well-known/openid-configuration` directly; if:
|
|
- Non-JSON format data is returned, it indicates your reverse proxy configuration is incorrect.
|
|
- If the returned JSON format data contains an `"issuer": "URL"` field that does not match your configured `https://auth.example.com`, it indicates your environment variable configuration is incorrect.
|
|
|
|
- TypeError: fetch failed
|
|
|
|
```log
|
|
lobe-chat | [auth][error] TypeError: fetch failed
|
|
```
|
|
|
|
Cause: LobeChat cannot access the authentication service.
|
|
|
|
Solutions:
|
|
|
|
- Check whether your authentication service is running properly and whether LobeChat's network can reach the authentication service.
|
|
|
|
- A straightforward troubleshooting method is to use the `curl` command in the LobeChat container terminal to access your authentication service at `https://auth.example.com/.well-known/openid-configuration`. If JSON format data is returned, it indicates your authentication service is functioning correctly.
|
|
|
|
````markdown
|
|
## Extended Configuration
|
|
|
|
To enhance your LobeChat service, you can perform the following extended configurations according to your needs.
|
|
|
|
### Use MinIO to Store Casdoor Avatars
|
|
|
|
Allow users to change their avatars in Casdoor.
|
|
|
|
1. First, create a bucket named `casdoor` in `buckets`, select a custom policy, and copy and paste the content below (if you modify the bucket name, please find and replace accordingly).
|
|
|
|
```json
|
|
{
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": ["*"]
|
|
},
|
|
"Action": ["s3:GetBucketLocation"],
|
|
"Resource": ["arn:aws:s3:::casdoor"]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": ["*"]
|
|
},
|
|
"Action": ["s3:ListBucket"],
|
|
"Resource": ["arn:aws:s3:::casdoor"],
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"s3:prefix": ["files/*"]
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": ["*"]
|
|
},
|
|
"Action": ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"],
|
|
"Resource": ["arn:aws:s3:::casdoor/**"]
|
|
}
|
|
],
|
|
"Version": "2012-10-17"
|
|
}
|
|
````
|
|
|
|
2. Create a new access key and store the generated `Access Key` and `Secret Key`.
|
|
|
|
3. In Casdoor's `Authentication -> Providers`, associate the MinIO S3 service. Below is an example configuration:
|
|
|
|
|
|
|
|
Here, the client ID and client secret correspond to the `Access Key` and `Secret Key` from the previous step; replace `192.168.31.251` with `your_server_ip`.
|
|
|
|
4. In Casdoor's `Authentication -> Apps`, add a provider to the `app-built-in` application, select `minio`, and save and exit.
|
|
|
|
5. You can attempt to upload a file in Casdoor's `Authentication -> Resources` to test if the configuration is correct.
|
|
|
|
### Migrating from `logto` to `Casdoor` in Production Deployment
|
|
|
|
This is applicable for users who have been using `logto` as their login and authentication service in a production environment.
|
|
|
|
<Callout type="info">
|
|
Due to significant instability when using [Logto](https://logto.io/)
|
|
as a login and authentication service, the following tutorial is based on deploying with an IP mode, implementing a domain release solution using Casdoor as the authentication service provider.
|
|
The remainder of this article will illustrate using this as an example. If you are using other login authentication services like Logto, the process should be similar, but be aware that port configurations may differ among different services.
|
|
</Callout>
|
|
|
|
In the following, it is assumed that in addition to the above services, you are also running an **Nginx** layer for reverse proxy and SSL configuration.
|
|
|
|
The domain and corresponding service port descriptions are as follows:
|
|
|
|
- `lobe.example.com`: This is your LobeChat service domain, which needs to reverse proxy to the LobeChat service port, default is `3210`.
|
|
- `auth.example.com`: This is your Logto UI domain, which needs to reverse proxy to the Logto WebUI service port, default is `8000`.
|
|
- `minio.example.com`: This is your MinIO API domain, which needs to reverse proxy to the MinIO API service port, default is `9000`.
|
|
- `minio-ui.example.com`: Optional, this is your MinIO UI domain, which needs to reverse proxy to the MinIO WebUI service port, default is `9001`.
|
|
|
|
#### Configuration File
|
|
|
|
```sh
|
|
bash <(curl -fsSL https://raw.githubusercontent.com/lobehub/lobe-chat/HEAD/docker-compose/local/setup.sh) -f -l zh_CN
|
|
docker compose up -d
|
|
```
|
|
|
|
Make sure to save the newly generated password at this time!
|
|
|
|
After running, you will get three files:
|
|
|
|
- init\_data.json
|
|
- docker-compose.yml
|
|
- .env
|
|
|
|
Next, modify the configuration files to achieve domain release.
|
|
|
|
1. Modify the `docker-compose.yml` file.
|
|
1. Change the `MINIO_API_CORS_ALLOW_ORIGIN` field of `minio`.
|
|
```yaml
|
|
'MINIO_API_CORS_ALLOW_ORIGIN=https://lobe.example.com'
|
|
```
|
|
2. Modify the `origin` field of `casdoor`.
|
|
```yaml
|
|
origin: 'https://auth.example.com'
|
|
```
|
|
3. Modify the `environment` field of `lobe`.
|
|
```yaml
|
|
# - 'APP_URL=http://localhost:3210'
|
|
- 'APP_URL=https://lobe.example.com'
|
|
|
|
- 'NEXT_AUTH_SSO_PROVIDERS=casdoor'
|
|
- 'KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ='
|
|
- 'NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg'
|
|
# - 'AUTH_URL=http://localhost:${LOBE_PORT}/api/auth'
|
|
- 'AUTH_URL=https://lobe.example.com/api/auth'
|
|
|
|
# - 'AUTH_CASDOOR_ISSUER=http://localhost:${CASDOOR_PORT}'
|
|
- 'AUTH_CASDOOR_ISSUER=https://auth.example.com'
|
|
|
|
- 'DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}'
|
|
# - 'S3_ENDPOINT=http://localhost:${MINIO_PORT}'
|
|
- 'S3_ENDPOINT=https://minio.example.com'
|
|
|
|
- 'S3_BUCKET=${MINIO_LOBE_BUCKET}'
|
|
# - 'S3_PUBLIC_DOMAIN=http://localhost:${MINIO_PORT}'
|
|
- 'S3_PUBLIC_DOMAIN=https://minio.example.com'
|
|
|
|
- 'S3_ENABLE_PATH_STYLE=1'
|
|
- 'LLM_VISION_IMAGE_USE_BASE64=1'
|
|
```
|
|
2. Modify the `.env` file.
|
|
|
|
<Callout type="info">
|
|
For security reasons, modify the ROOT USER field in the `.env` file.
|
|
</Callout>
|
|
|
|
```sh
|
|
# MinIO S3 configuration
|
|
MINIO_ROOT_USER=XXXX
|
|
MINIO_ROOT_PASSWORD=XXXX
|
|
```
|
|
|
|
#### Postgres Database Configuration
|
|
|
|
You can check the logs with the following command:
|
|
|
|
```sh
|
|
docker logs -f lobe-chat
|
|
```
|
|
|
|
<Callout type="tip">
|
|
In our official Docker images, automatic migration of the database schema is performed before starting the images.
|
|
Our official images guarantee the stability of "empty database -> complete tables" for automatic table creation. Therefore, we recommend your database instance use an empty table instance to avoid the trouble of manually maintaining table structure or migrations.
|
|
</Callout>
|
|
|
|
If you encounter issues during table creation, you can try the following command to forcibly remove the database container and restart:
|
|
|
|
```sh
|
|
docker compose down # Stop the service
|
|
sudo rm -rf ./data # Remove mounted database data
|
|
docker compose up -d # Restart
|
|
```
|
|
|
|
#### Login Authentication Service Configuration
|
|
|
|
You first need to access the WebUI for configuration:
|
|
|
|
- If you have set up the reverse proxy as mentioned before, open `https://auth.example.com`
|
|
- Otherwise, after port mapping, open `http://localhost:8000`
|
|
|
|
Log in to the admin account:
|
|
|
|
- The default username is admin.
|
|
- The default password is the random password generated when downloading the config file. If forgotten, you can find it in the `init_data.json` file.
|
|
|
|
After logging in, perform the following actions:
|
|
|
|
1. In `User Management -> Organizations`, add a new organization with the name and display name `Lobe Users`. Keep the rest as default.
|
|
2. In `Authentication -> Apps`, add a new application.
|
|
|
|
- Name and display name should be `LobeChat`.
|
|
- Organization should be `Lobe Users`.
|
|
- Add a line in Redirect URLs as `https://lobe.example.com/api/auth/callback/casdoor`.
|
|
- Disable all login methods except password.
|
|
- Fill in the client ID and client secret in the `.env` file under `AUTH_CASDOOR_ID` and `AUTH_CASDOOR_SECRET`.
|
|
- (Optional) Design the appearance of the login and registration pages by mimicking the `built-in` application configuration.
|
|
- Save and exit.
|
|
|
|
<Callout type="info">
|
|
Following the steps above ensures that not all users are administrators by default, leading to an unsafe situation.
|
|
</Callout>
|
|
|
|
#### S3 Object Storage Service Configuration
|
|
|
|
This article uses MinIO as an example to explain the configuration process. If you are using another S3 service provider, please refer to their documentation for configuration.
|
|
|
|
<Callout type="warning">
|
|
Please remember to configure the corresponding S3 service provider's CORS settings to ensure that LobeChat can access the S3 service correctly.
|
|
|
|
In this document, you need to allow cross-origin requests from `https://lobe.example.com`. This can either be configured in MinIO WebUI under `Configuration - API - Cors Allow Origin`, or in the Docker Compose configuration under `minio - environment - MINIO_API_CORS_ALLOW_ORIGIN`.
|
|
|
|
If you use the second method (which is also the default), you will no longer be able to configure it in the MinIO WebUI.
|
|
</Callout>
|
|
|
|
You first need to access the WebUI for configuration:
|
|
|
|
- If you have set up the reverse proxy as mentioned before, open `https://minio-ui.example.com`
|
|
- Otherwise, after port mapping, open `http://localhost:9001`
|
|
|
|
1. Enter the `MINIO_ROOT_USER` and `MINIO_ROOT_PASSWORD` you set in the login interface, then click login.
|
|
|
|
2. In the left panel under User / Access Keys, click `Create New Access Key`, no additional modifications needed, and fill the generated `Access Key` and `Secret Key` into your `.env` file under `S3_ACCESS_KEY_ID` and `S3_SECRET_ACCESS_KEY`.
|
|
|
|
<Image alt="Create MinIO Access Key" src="https://github.com/user-attachments/assets/72f02ce5-9991-425b-9864-9113ee1ed6bf" />
|
|
|
|
3. Restart the LobeChat service:
|
|
|
|
```sh
|
|
docker compose up -d
|
|
```
|
|
|
|
At this point, you have successfully deployed the LobeChat database version, and you can access your LobeChat service at `https://lobe.example.com`.
|
|
|
|
#### Configuration Files
|
|
|
|
For convenience, here is a summary of example configuration files required for the production deployment using the Casdoor authentication scheme:
|
|
|
|
- `.env`
|
|
|
|
```sh
|
|
# Proxy, if you need it
|
|
# HTTP_PROXY=http://localhost:7890
|
|
# HTTPS_PROXY=http://localhost:7890
|
|
|
|
# Other environment variables, as needed. You can refer to the environment variables configuration for the client version, making sure not to have ACCESS_CODE.
|
|
# OPENAI_API_KEY=sk-xxxx
|
|
# OPENAI_PROXY_URL=https://api.openai.com/v1
|
|
# OPENAI_MODEL_LIST=...
|
|
|
|
# ===========================
|
|
# ====== Preset config ======
|
|
# ===========================
|
|
# if no special requirements, no need to change
|
|
LOBE_PORT=3210
|
|
CASDOOR_PORT=8000
|
|
MINIO_PORT=9000
|
|
|
|
# Postgres related, which are the necessary environment variables for DB
|
|
LOBE_DB_NAME=lobechat
|
|
POSTGRES_PASSWORD=uWNZugjBqixf8dxC
|
|
|
|
# Casdoor secret
|
|
AUTH_CASDOOR_ID=943e627d79d5dd8a22a1
|
|
AUTH_CASDOOR_SECRET=6ec24ac304e92e160ef0d0656ecd86de8cb563f1
|
|
|
|
# MinIO S3 configuration
|
|
MINIO_ROOT_USER=Joe
|
|
MINIO_ROOT_PASSWORD=Crj1570768
|
|
|
|
# Configure the bucket information of MinIO
|
|
MINIO_LOBE_BUCKET=lobe
|
|
S3_ACCESS_KEY_ID=dB6Uq9CYZPdWSZouPyEd
|
|
S3_SECRET_ACCESS_KEY=aPBW8CVULkh8bw1GatlT0GjLihcXHLNwRml4pieS
|
|
```
|
|
|
|
- `docker-compose.yml`
|
|
|
|
```yaml
|
|
name: lobe-chat-database
|
|
services:
|
|
network-service:
|
|
image: alpine
|
|
container_name: lobe-network
|
|
ports:
|
|
- '${MINIO_PORT}:${MINIO_PORT}' # MinIO API
|
|
- '9001:9001' # MinIO Console
|
|
- '${CASDOOR_PORT}:${CASDOOR_PORT}' # Casdoor
|
|
- '${LOBE_PORT}:3210' # LobeChat
|
|
command: tail -f /dev/null
|
|
networks:
|
|
- lobe-network
|
|
|
|
postgresql:
|
|
image: pgvector/pgvector:pg16
|
|
container_name: lobe-postgres
|
|
ports:
|
|
- '5432:5432'
|
|
volumes:
|
|
- './data:/var/lib/postgresql/data'
|
|
environment:
|
|
- 'POSTGRES_DB=${LOBE_DB_NAME}'
|
|
- 'POSTGRES_PASSWORD=${POSTGRES_PASSWORD}'
|
|
healthcheck:
|
|
test: ['CMD-SHELL', 'pg_isready -U postgres']
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
restart: always
|
|
networks:
|
|
- lobe-network
|
|
|
|
minio:
|
|
image: minio/minio
|
|
container_name: lobe-minio
|
|
network_mode: 'service:network-service'
|
|
volumes:
|
|
- './s3_data:/etc/minio/data'
|
|
environment:
|
|
- 'MINIO_ROOT_USER=${MINIO_ROOT_USER}'
|
|
- 'MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}'
|
|
# - 'MINIO_API_CORS_ALLOW_ORIGIN=http://localhost:${LOBE_PORT}'
|
|
- 'MINIO_API_CORS_ALLOW_ORIGIN=https://lobe.example.com'
|
|
restart: always
|
|
command: >
|
|
server /etc/minio/data --address ":${MINIO_PORT}" --console-address ":9001"
|
|
|
|
casdoor:
|
|
image: casbin/casdoor
|
|
container_name: lobe-casdoor
|
|
entrypoint: /bin/sh -c './server --createDatabase=true'
|
|
network_mode: 'service:network-service'
|
|
depends_on:
|
|
postgresql:
|
|
condition: service_healthy
|
|
environment:
|
|
RUNNING_IN_DOCKER: 'true'
|
|
driverName: 'postgres'
|
|
dataSourceName: 'user=postgres password=${POSTGRES_PASSWORD} host=postgresql port=5432 sslmode=disable dbname=casdoor'
|
|
# origin: 'http://localhost:${CASDOOR_PORT}'
|
|
origin: 'https://auth.example.com'
|
|
runmode: 'dev'
|
|
volumes:
|
|
- ./init_data.json:/init_data.json
|
|
|
|
lobe:
|
|
image: lobehub/lobe-chat-database
|
|
container_name: lobe-chat-database
|
|
network_mode: 'service:network-service'
|
|
depends_on:
|
|
postgresql:
|
|
condition: service_healthy
|
|
network-service:
|
|
condition: service_started
|
|
minio:
|
|
condition: service_started
|
|
casdoor:
|
|
condition: service_started
|
|
|
|
environment:
|
|
# - 'APP_URL=http://localhost:3210'
|
|
- 'APP_URL=https://lobe.example.com'
|
|
|
|
- 'NEXT_AUTH_SSO_PROVIDERS=casdoor'
|
|
- 'KEY_VAULTS_SECRET=Kix2wcUONd4CX51E/ZPAd36BqM4wzJgKjPtz2sGztqQ='
|
|
- 'NEXT_AUTH_SECRET=NX2kaPE923dt6BL2U8e9oSre5RfoT7hg'
|
|
# - 'AUTH_URL=http://localhost:${LOBE_PORT}/api/auth'
|
|
- 'AUTH_URL=https://lobe.example.com/api/auth'
|
|
|
|
# - 'AUTH_CASDOOR_ISSUER=http://localhost:${CASDOOR_PORT}'
|
|
- 'AUTH_CASDOOR_ISSUER=https://auth.example.com'
|
|
|
|
- 'DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}'
|
|
# - 'S3_ENDPOINT=http://localhost:${MINIO_PORT}'
|
|
- 'S3_ENDPOINT=https://minio.example.com'
|
|
|
|
- 'S3_BUCKET=${MINIO_LOBE_BUCKET}'
|
|
# - 'S3_PUBLIC_DOMAIN=http://localhost:${MINIO_PORT}'
|
|
- 'S3_PUBLIC_DOMAIN=https://minio.example.com'
|
|
|
|
- 'S3_ENABLE_PATH_STYLE=1'
|
|
- 'LLM_VISION_IMAGE_USE_BASE64=1'
|
|
env_file:
|
|
- .env
|
|
restart: always
|
|
|
|
volumes:
|
|
data:
|
|
driver: local
|
|
s3_data:
|
|
driver: local
|
|
|
|
networks:
|
|
lobe-network:
|
|
driver: bridge
|
|
```
|
|
|
|
[docker-pulls-link]: https://hub.docker.com/r/lobehub/lobe-chat-database
|
|
[docker-pulls-shield]: https://img.shields.io/docker/pulls/lobehub/lobe-chat-database?color=45cc11&labelColor=black&style=flat-square
|
|
[docker-release-link]: https://hub.docker.com/r/lobehub/lobe-chat-database
|
|
[docker-release-shield]: https://img.shields.io/docker/v/lobehub/lobe-chat-database?color=369eff&label=docker&labelColor=black&logo=docker&logoColor=white&style=flat-square&sort=semver
|
|
[docker-size-link]: https://hub.docker.com/r/lobehub/lobe-chat-database
|
|
[docker-size-shield]: https://img.shields.io/docker/image-size/lobehub/lobe-chat-database?color=369eff&labelColor=black&style=flat-square&sort=semver
|