* ✨ feat(docker): run self-hosted Compose chats in Gateway Mode by default
- Add the lobehub-gateway service to docker-compose and wire the lobe service
to it; AGENT_GATEWAY_INTERNAL_URL keeps server pushes on the Compose network
while browsers use AGENT_GATEWAY_URL.
- S3_INTERNAL_ENDPOINT routes the server's own S3 requests to rustfs:9000 while
presigned URLs keep the browser-facing S3_ENDPOINT, which local mode sets to
localhost and the container cannot reach.
- setup.sh generates a per-deployment JWKS_KEY and gateway token and writes the
gateway URL for each deploy mode; the .env template drops the public JWKS key.
- Warn loudly at container startup when an upgraded stack lacks the gateway
settings or still uses the public example JWKS_KEY, and document the upgrade.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* 🔒 fix(docker): pass only the public JWK to the gateway container
The gateway only needs the public half of JWKS_KEY to verify browser
sessions, but it received the full private key set, so anyone able to read
the gateway environment could sign tokens LobeHub trusts. setup.sh now also
writes JWKS_PUBLIC_KEY (the same key without d/p/q/dp/dq/qi), Compose passes
only that to the gateway, and the startup check warns when it is missing,
still contains private fields, or does not match JWKS_KEY.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
- Apply a bucket CORS rule in rustfs-init so browser uploads to RustFS through
presigned URLs are not blocked by the preflight.
- Preload pg_cron and pg_stat_statements alongside pg_search, matching the
ParadeDB image default. Its first-start bootstrap creates pg_cron under set -e,
so preloading only pg_search aborted initialization, restarted the container
and failed the first docker compose up with an unhealthy database.
- Probe PostgreSQL health over TCP with a start period. During initialization the
image runs a temporary socket-only server, so the socket probe passed early and
LobeHub's migrations failed with ECONNREFUSED until it had restarted repeatedly.
- setup.sh downloads templates from lobehub/lobehub main, uses curl with a wget
fallback, and detects the host IP on macOS where hostname -I is missing.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* 🔧 chore(docker): replace minio with rustfs/rc in compose scripts
- dev/deploy: swap minio/mc init image for rustfs/rc and rename mc
commands to their mc-compatible rc equivalents
- production/grafana: replace the minio server with rustfs/rustfs,
split bucket initialization into a rustfs-init sidecar using
rustfs/rc, and rename MINIO_* env vars to RUSTFS_*
- verified locally: rc alias/mb/ls/anonymous set-json/admin info work
against a live RustFS server
* 🔥 revert(docker): drop production/grafana migration, keep minimal rustfs/rc swap
Per review feedback, the production/grafana changes (named volume switch
and MINIO_* -> RUSTFS_* env rename) break existing deployments' data and
.env contract. Revert them; keep only the rustfs-init image swap
(minio/mc -> rustfs/rc) and mc -> rc command rename in dev/deploy.
---------
Co-authored-by: arvinxx <arvinxuxu@icloud.com>
Enable pg_search in Postgres containers
Start Postgres with shared_preload_libraries=pg_search in three docker-compose files (deploy, dev, production/grafana). This adds a command to the Postgres service so the pg_search library is preloaded on startup, ensuring the pg_search extension is available for full-text search features.
Related Links: https://github.com/paradedb/paradedb/pull/4914
* v2 init
* chore: update eslint suppressions and package dependencies
- Removed several eslint suppressions related to array sorting and reversing from eslint-suppressions.json to clean up the configuration.
- Updated @lobehub/lint package version from 2.0.0-beta.6 to 2.0.0-beta.7 in package.json for improvements and bug fixes.
- Made minor formatting adjustments in vitest.config.mts and various SKILL.md files for better readability and consistency.
Signed-off-by: Innei <tukon479@gmail.com>
* fix: clean up import statements and formatting
- Removed unnecessary whitespace in replaceComponentImports.ts for improved readability.
- Standardized import statements in contextEngineering.ts and createAgentExecutors.ts by adding missing spaces for consistency.
Signed-off-by: Innei <tukon479@gmail.com>
* chore: update eslint suppressions and clean up code formatting
* 🐛 fix: use vi.hoisted for mock variable initialization
Fix TDZ error in persona service test by using vi.hoisted() to ensure
mock variables are available when vi.mock factory runs.
---------
Signed-off-by: Innei <tukon479@gmail.com>
* 🔥 chore(docker-compose): remove Casdoor SSO dependency
Casdoor is no longer needed since BetterAuth now supports email/password registration natively.
LOBE-3907
* ♻️ refactor(docker-compose): restructure directories
- Rename local/ to dev/ for development dependencies
- Remove logto/ and zitadel/ from production/
- Restore Casdoor config in production/grafana/
- Simplify dev/ to core services only (postgresql, redis, rustfs, searxng)
- Update docker-compose.development.yml to use dev/
- Remove minio-bucket.config.json (switched to rustfs)
* ♻️ refactor(docker-compose): simplify dev environment setup
- Remove docker-compose.development.yml, use dev/docker-compose.yml directly
- Add npm scripts: dev:docker, dev:docker:down, dev:docker:reset
- Simplify .env.example.development (remove variable refs, redundant vars)
- Update docker-compose/dev/.env.example (consistent passwords)
- Add docker-compose/dev/data/ to .gitignore
- Update setup docs: use npm scripts, remove image generation section
* 🔧 chore: add SSRF_ALLOW_PRIVATE_IP_ADDRESS to dev env example
* 🔒 security: auto-generate KEY_VAULTS_SECRET and AUTH_SECRET in setup.sh
- Remove hardcoded secrets from docker-compose.yml
- Add placeholders to .env.example files
- Generate secrets dynamically in setup.sh using openssl rand -base64 32
* 🔧 chore(docker-compose): expose SearXNG port and improve dev scripts
- Add SearXNG port mapping (8180:8080) for host access
- Use --wait flag in dev:docker to ensure services are healthy
- Include db:migrate in dev:docker:reset for one-command reset
- Update MinIO reference to RustFS in zh-CN docs
- Add SearXNG to service URLs and port conflict docs
* ✨ feat: add INTERNAL_APP_URL for server-to-server calls
Add INTERNAL_APP_URL environment variable to bypass CDN/proxy for internal operations like embedding and file chunking. Falls back to APP_URL if not set.
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
* 📝 docs: add INTERNAL_APP_URL documentation
Add documentation for INTERNAL_APP_URL environment variable in:
- docker-compose .env.example
- Docker Compose deployment guide (English and Chinese)
Explains how to bypass CDN/proxy for server-to-server operations.
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
* ✅ test: add tests for INTERNAL_APP_URL feature
Add comprehensive test coverage for INTERNAL_APP_URL:
- Test fallback behavior to APP_URL when INTERNAL_APP_URL is not set
- Test explicit INTERNAL_APP_URL configuration
- Test localhost bypass for CDN/proxy
- Test createAsyncServerClient using INTERNAL_APP_URL
- Test authentication headers in async calls
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
---------
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
* 👷 build: add docker compose to setup local services for development
* 👷 build: setup dotenv-expand for all the npm scripts
* 🐛 fix: remove useless comments
* 📚 docs: add server-side database setup guide with i18n support
- Add comprehensive server-side database setup documentation
- Include step-by-step Docker service configuration
- Add Chinese localization for better developer experience
- Cover environment setup, database migration, and verification steps
* 🔨 chore: fix MiniO image version
* fix: MiniO disabled web admin panel in latest version
* 🔨 chore: fix Relay Mode mis-report
* fix: Relay mode should check localhost under network_mode: service:network-service itself, but if failed, should notice user check relay URL
* 🔨 chore: fix Relay Mode mis-report
* fix: Relay mode should check localhost under network_mode: service:network-service itself, but if failed, should notice user check relay URL
* 🔨 chore: fix Relay Mode mis-report
* fix: Relay mode should check localhost under network_mode: service:network-service itself, but if failed, should notice user check relay URL
* 🔨 chore: fix Relay Mode mis-report
* fix: Relay mode should check localhost under network_mode: service:network-service itself, but if failed, should notice user check relay URL
* Revert "🔨 chore: fix MiniO image version"
This reverts commit 1d6c2cd334.
* Revert "🔨 chore: fix Relay Mode mis-report * fix: Relay mode should check localhost under network_mode: service:network-service itself, but if failed, should notice user check relay URL"
This reverts commit 7bc8a47b
* 🔨 chore: fix MiniO Version
* fix: MiniO new version do not have web admin panel
Otherwise, anyone can signup with the lobechat organization and it is
very likely that's not wanted. We should be closed and secure by
default.
Signed-off-by: Max Brauer <mbrauer@vmware.com>
* Create docker-compose.yml for local deploy with zitadel
Create docker-compose.yml for local deploy with zitadel
* Create .env.zh-CN.example for local deploy with zitadel
Create .env.zh-CN.example for local deploy with zitadel
* Create .env.example for local deploy with zitadel
Create .env.example for local deploy with zitadel
* Update .env.zh-CN.example
* Create docker-compose.yml for self-hosting with zitadel
Create docker-compose.yml for self-hosting with zitadel
* Create .env.zh-CN.example for self-hosting deploy with zitadel
Create .env.zh-CN.example for self-hosting deploy with zitadel
* Create .env.example for self-host deploy with zitadel
Create .env.example for self-host deploy with zitadel
* Create zitadel-init-steps.yaml
* Create zitadel-config.yaml
* Update docker-compose.yml
* Update docker-compose.yml
* Create zitadel-config.yaml
* Create zitadel-init-steps.yaml
* Update .env.zh-CN.example
* Update .env.example
* Update .env.example
* Update .env.zh-CN.example
* Update zitadel-init-steps.yaml
Rylan Cai