mirror of
https://github.com/lobehub/lobehub.git
synced 2026-09-20 04:56:13 +08:00
Arvin Xu
c5ec20abab
* ✨ feat(docker): run self-hosted Compose chats in Gateway Mode by default - Add the lobehub-gateway service to docker-compose and wire the lobe service to it; AGENT_GATEWAY_INTERNAL_URL keeps server pushes on the Compose network while browsers use AGENT_GATEWAY_URL. - S3_INTERNAL_ENDPOINT routes the server's own S3 requests to rustfs:9000 while presigned URLs keep the browser-facing S3_ENDPOINT, which local mode sets to localhost and the container cannot reach. - setup.sh generates a per-deployment JWKS_KEY and gateway token and writes the gateway URL for each deploy mode; the .env template drops the public JWKS key. - Warn loudly at container startup when an upgraded stack lacks the gateway settings or still uses the public example JWKS_KEY, and document the upgrade. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * 🔒 fix(docker): pass only the public JWK to the gateway container The gateway only needs the public half of JWKS_KEY to verify browser sessions, but it received the full private key set, so anyone able to read the gateway environment could sign tokens LobeHub trusts. setup.sh now also writes JWKS_PUBLIC_KEY (the same key without d/p/q/dp/dq/qi), Compose passes only that to the gateway, and the startup check warns when it is missing, still contains private fields, or does not match JWKS_KEY. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
88 lines
3.8 KiB
Bash
88 lines
3.8 KiB
Bash
# Proxy, if you need it
|
|
# HTTP_PROXY=http://localhost:7890
|
|
# HTTPS_PROXY=http://localhost:7890
|
|
|
|
# Allowed email addresses for login, separated by commas
|
|
# When set, only emails in the list can log in, other users cannot log in
|
|
# Leave empty to allow all users to register
|
|
# AUTH_ALLOWED_EMAILS=user1@example.com,user2@example.com
|
|
|
|
# Disable user registration (SSO-only mode)
|
|
# When set to 1, users cannot register via email/password, only SSO login is allowed
|
|
# AUTH_DISABLE_EMAIL_PASSWORD=1
|
|
|
|
# ===========================
|
|
# ====== Preset config ======
|
|
# ===========================
|
|
# if no special requirements, no need to change
|
|
LOBE_PORT=3210
|
|
RUSTFS_PORT=9000
|
|
RUSTFS_ADMIN_PORT=9001
|
|
APP_URL=http://localhost:3210
|
|
# INTERNAL_APP_URL is used for internal server-to-server communication.
|
|
# Required for Docker Compose deployments, otherwise features like
|
|
# AI image generation will fail when APP_URL is a host/LAN IP.
|
|
INTERNAL_APP_URL=http://localhost:3210
|
|
|
|
# Secrets (auto-generated by setup.sh)
|
|
KEY_VAULTS_SECRET=YOUR_KEY_VAULTS_SECRET
|
|
AUTH_SECRET=YOUR_AUTH_SECRET
|
|
# Shared token between LobeHub and the gateway service (auto-generated by setup.sh)
|
|
GATEWAY_SERVICE_TOKEN=YOUR_GATEWAY_SERVICE_TOKEN
|
|
# RS256 key set that signs internal JWTs (auto-generated by setup.sh)
|
|
JWKS_KEY=YOUR_JWKS_KEY
|
|
# The same key without its private fields; only this one is passed to the gateway,
|
|
# which verifies browser sessions with it (auto-generated by setup.sh)
|
|
JWKS_PUBLIC_KEY=YOUR_JWKS_PUBLIC_KEY
|
|
|
|
# Postgres related, which are the necessary environment variables for DB
|
|
LOBE_DB_NAME=lobechat
|
|
POSTGRES_PASSWORD=uWNZugjBqixf8dxC
|
|
|
|
# RUSTFS S3 configuration
|
|
S3_ENDPOINT=http://localhost:9000
|
|
RUSTFS_ACCESS_KEY=admin
|
|
RUSTFS_SECRET_KEY=YOUR_RUSTFS_PASSWORD
|
|
|
|
# Configure the bucket information of RUSTFS
|
|
RUSTFS_LOBE_BUCKET=lobe
|
|
|
|
# ===========================
|
|
# ====== Agent Gateway ======
|
|
# ===========================
|
|
# Gateway Mode runs agents on the server and streams them to the browser through
|
|
# the `gateway` service. AGENT_GATEWAY_URL must be the gateway address as seen by
|
|
# the browser (auto-configured by setup.sh). Behind a reverse proxy, enable
|
|
# WebSocket upgrades for it.
|
|
AGENT_GATEWAY_PORT=8787
|
|
DEVICE_GATEWAY_PORT=8788
|
|
AGENT_GATEWAY_URL=http://localhost:8787
|
|
# Device gateway address used by the LobeHub server inside the Compose network
|
|
DEVICE_GATEWAY_URL=http://gateway:8788
|
|
|
|
# ===========================
|
|
# == Optional Elasticsearch ==
|
|
# ===========================
|
|
# LobeHub searches with PostgreSQL pg_search by default. To run the optional
|
|
# single-node Elasticsearch shipped with this Compose file instead, read
|
|
# https://lobehub.com/docs/self-hosting/advanced/full-text-search first.
|
|
# The service is off unless you opt in with COMPOSE_PROFILES:
|
|
# 1. Uncomment the ES_* lines below and enable the Elasticsearch service, then run `docker compose up -d`
|
|
# and the one-off backfill: `docker compose run --rm fts-search-reindex --apply --fresh-run --yes`
|
|
# COMPOSE_PROFILES=elasticsearch
|
|
# 2. Once the backfill status is ready_for_incremental_sync, also start the sync worker:
|
|
# COMPOSE_PROFILES=elasticsearch,elasticsearch-sync
|
|
# 3. Once the Outbox has caught up, switch search traffic explicitly (never automatic):
|
|
# FTS_SEARCH_PROVIDER=elasticsearch
|
|
#
|
|
# The bundled Elasticsearch runs with security disabled and is reachable only inside
|
|
# the Compose network, so plaintext HTTP without an API key must be enabled explicitly.
|
|
# Do not set ES_API_KEY together with an http:// URL and never publish port 9200.
|
|
# ES_URL=http://elasticsearch:9200
|
|
# ES_ALLOW_INSECURE_HTTP=true
|
|
# ES_INDEX_NAMESPACE=lobehub
|
|
# JVM heap of the Elasticsearch container: at most half of the memory you give it (min. 1g).
|
|
# ES_JAVA_OPTS=-Xms1g -Xmx1g
|
|
# Seconds the sync worker sleeps after a drain that found no more work.
|
|
# FTS_SEARCH_SYNC_INTERVAL_SECONDS=15
|