* ✨ feat(docker): run self-hosted Compose chats in Gateway Mode by default
- Add the lobehub-gateway service to docker-compose and wire the lobe service
to it; AGENT_GATEWAY_INTERNAL_URL keeps server pushes on the Compose network
while browsers use AGENT_GATEWAY_URL.
- S3_INTERNAL_ENDPOINT routes the server's own S3 requests to rustfs:9000 while
presigned URLs keep the browser-facing S3_ENDPOINT, which local mode sets to
localhost and the container cannot reach.
- setup.sh generates a per-deployment JWKS_KEY and gateway token and writes the
gateway URL for each deploy mode; the .env template drops the public JWKS key.
- Warn loudly at container startup when an upgraded stack lacks the gateway
settings or still uses the public example JWKS_KEY, and document the upgrade.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* 🔒 fix(docker): pass only the public JWK to the gateway container
The gateway only needs the public half of JWKS_KEY to verify browser
sessions, but it received the full private key set, so anyone able to read
the gateway environment could sign tokens LobeHub trusts. setup.sh now also
writes JWKS_PUBLIC_KEY (the same key without d/p/q/dp/dq/qi), Compose passes
only that to the gateway, and the startup check warns when it is missing,
still contains private fields, or does not match JWKS_KEY.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
- Apply a bucket CORS rule in rustfs-init so browser uploads to RustFS through
presigned URLs are not blocked by the preflight.
- Preload pg_cron and pg_stat_statements alongside pg_search, matching the
ParadeDB image default. Its first-start bootstrap creates pg_cron under set -e,
so preloading only pg_search aborted initialization, restarted the container
and failed the first docker compose up with an unhealthy database.
- Probe PostgreSQL health over TCP with a start period. During initialization the
image runs a temporary socket-only server, so the socket probe passed early and
LobeHub's migrations failed with ECONNREFUSED until it had restarted repeatedly.
- setup.sh downloads templates from lobehub/lobehub main, uses curl with a wget
fallback, and detects the host IP on macOS where hostname -I is missing.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* 📝 docs: fix outdated content across the docs site
Audited docs/ against the current codebase and fixed stale content that
drifted after major refactors (Clerk/NextAuth → Better Auth, src/server →
apps/server, src/{config,envs,locales} → packages/*, model-bank updates).
- self-hosting/auth: mark removed NextAuth/Clerk pages with deprecation
warnings; fix microsoft/zitadel alias claims and the Logto callback path
- environment-variables & advanced: correct wrong defaults (S3_SET_ACL,
AI_IMAGE_DEFAULT_IMAGE_NUM, index/proxy URLs), drop non-existent env vars
and fictional feature flags, fix OIDC config guidance
- development: update refactored paths, Better Auth, .mjs configs, remove
the MSW section (msw is not a dependency)
- providers & model examples: replace retired model ids with in-bank ones;
fix comfyui frontmatter corruption
- usage: rename Moderator→Orchestrator, GTD→Task, correct shortcut keys,
channel capability tables, Feishu/Lark WebSocket mode
- platform/migration: fix dead links, docker service name, npx/npm → bun
EN and zh-CN pairs updated together.
* 📝 docs: fix Logto callback path and AUTH_SECRET deprecation guidance
- Revert Logto/Sealos callback URLs to /api/auth/callback/logto to match
the runtime SSO redirectURI override
- Narrow legacy auth Callout: AUTH_SECRET remains required for Better Auth;
mark NEXT_AUTH_SECRET as deprecated in zh-CN
* 📝 docs: refresh agent skills for locales, env, auth, and agentRun paths
Align OSS agent guidance with post-refactor layout:
- packages/locales/src/default + bun run i18n
- packages/env/src for env schemas (@/envs alias)
- spa-auth shell + src/routes/auth segments
- chat agentRun/transports/hetero instead of aiChat
* 📝 docs: document APP_URL as required for Better Auth base URL
Self-hosted auth uses appEnv.APP_URL as baseURL, not request-header
auto-detection. NEXT_PUBLIC_AUTH_URL remains deprecated.
* 📝 docs: note self-host search provider setup for web search
Built-in lobe-web-browsing needs no client plugin, but self-hosted
servers still require SEARCH_PROVIDERS / SEARXNG_URL (default SearXNG).
* 📝 docs: point feature guide welcome UI at AgentHome
Opening message/questions on the agent chat page live in
src/features/AgentHome, not Onboarding WelcomeMessage.
* 📝 docs: Remove Langfuse docs; enable pg_search
Delete Langfuse observability guides (langfuse.mdx and langfuse.zh-CN.mdx). Update Docker self-hosting docs to add `-c shared_preload_libraries=pg_search` to the ParadeDB docker run command and clarify that the ParadeDB image includes pgvector and pg_search and that pg_search must be explicitly enabled; apply the same clarification to the Chinese documentation.
* 📝 docs: Document 'video' capability in model list
Add a `video` entry to the extension capabilities table in docs/self-hosting/advanced/model-list.mdx and its Chinese translation (model-list.zh-CN.mdx) to document Video Comprehension support.
* 📝 docs: Add agent feature flags & update thread text
Add documentation entries for new system agent feature flags: generationTopic (AI image automatic topic naming), inputCompletion (input auto-completion suggestions), and promptRewrite (prompt optimization before generation). Also reword the thread/branch conversation entry to clarify automatic title generation. Apply the same updates to the Chinese localization file.
* 📝 docs: Document AGENT_GATEWAY_SERVICE_TOKEN env var
Add documentation for the AGENT_GATEWAY_SERVICE_TOKEN environment variable to the self-hosting environment variables pages (English and Chinese). The new entries specify that the variable is optional, describe it as the authentication token used between Gateway Mode and a self-deployed Agent Gateway, and include default (-) and example (`dev-secret`). Files changed: docs/self-hosting/environment-variables/basic.mdx and basic.zh-CN.mdx.
Arvin Xu