AZ-Intec-GmbH/AZ-NIX
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

+LibreChat +pgadmin

Browse Source
This commit is contained in:
sascha.koenig
2025-09-03 14:20:31 +02:00
parent bb707f6ab4
commit e3593466d7
12 changed files with 713 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
hosts/AZ-CLD-1/secrets.nix
View File

@@ -7,19 +7,26 @@
baserow-env = {
file = ../../secrets/baserow-env.age;
};
librechat-env = {
file = ../../secrets/librechat-env.age;
};
n8n-env = {
file = ../../secrets/n8n-env.age;
};
outline-env = {
file = ../../secrets/outline-env.age;
owner = "outline";
owner = "outline";
};
pgadmin-pw = {
file = ../../secrets/pgadmin-pw.age;
owner = "pgadmin";
};
vaultwarden-env = {
file = ../../secrets/vaultwarden-env.age;
};
hetzner-s3-az-intern-secret-key = {
file = ../../secrets/hetzner-s3-az-intern-secret-key.age;
owner = "outline";
owner = "outline";
};
hetzner-s3-az-intern-access-key = {
file = ../../secrets/hetzner-s3-az-intern-access-key.age;

8
hosts/AZ-CLD-1/services/containers/default.nix
View File

@@ -1,6 +1,12 @@
{
{lib, ...}: {
imports = [
./baserow.nix
./librechat.nix
./portainer.nix
];
system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''
if ! /run/current-system/sw/bin/podman network exists web; then
/run/current-system/sw/bin/podman network create web --subnet=10.89.0.0/24 --internal
fi
'';
}

109
hosts/AZ-CLD-1/services/containers/librechat.nix Normal file
View File

@@ -0,0 +1,109 @@
{
config,
pkgs,
...
}: let
envFile = config.age.secrets.librechat-env.path;
in {
virtualisation.oci-containers = {
containers.meilisearch = {
image = "getmeili/meilisearch:v1.12.3";
autoStart = true;
volumes = ["librechat_meili:/meili_data"];
environment = {
MEILI_HTTP_ADDR = "0.0.0.0:7700";
MEILI_NO_ANALYTICS = "true";
};
environmentFiles = [envFile];
extraOptions = ["--ip=10.89.0.20" "--network=web"];
};
containers.rag_api = {
image = "ghcr.io/danny-avila/librechat-rag-api-dev-lite:latest";
autoStart = true;
environment = {
RAG_PORT = "8000";
# pgvector connection to host Postgres
DB_HOST = "10.89.0.1"; # your host on the 'web' network
DB_PORT = "5432";
# embeddings: pick one (OpenAI default, or HF/Ollama per docs)
# EMBEDDINGS_PROVIDER = "openai";
# RAG_OPENAI_API_KEY is read by RAG API (can also use OPENAI_API_KEY).
};
environmentFiles = [envFile];
dependsOn = ["meilisearch"];
extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.21" "--network=web"];
ports = ["127.0.0.1:8000:8000"]; # optional: expose to host for debugging
};
containers.mongodb = {
image = "mongo:7";
autoStart = true;
volumes = [
"librechat_mongo:/data/db"
"/var/backup/mongodb:/data/backups"
];
# Enable auth once users exist; see Mongo auth doc.
# command = [ "mongod", "--auth" ];
extraOptions = ["--ip=10.89.0.22" "--network=web"];
};
containers.librechat = {
image = "ghcr.io/danny-avila/librechat-dev-api:latest";
autoStart = true;
ports = ["127.0.0.1:3040:3080"];
dependsOn = ["mongodb" "rag_api" "meilisearch"];
environment = {
HOST = "0.0.0.0";
NODE_ENV = "production";
# Mongo URI (start without auth; switch to mongodb://user:pass@mongodb:27017/LibreChat after Step 4)
MONGO_URI = "mongodb://mongodb:27017/LibreChat";
MEILI_HOST = "http://meilisearch:7700";
RAG_PORT = "8000";
RAG_API_URL = "http://rag_api:8000";
};
environmentFiles = [envFile];
volumes = [
# Config file still needs to be a bind mount for host management
"/var/lib/librechat/librechat.yaml:/app/librechat.yaml:ro"
# Use named volumes for application data
"librechat_images:/app/client/public/images"
"librechat_uploads:/app/uploads"
"librechat_logs:/app/api/logs"
];
extraOptions = ["--ip=10.89.0.23" "--network=web"];
};
};
systemd.services."mongo-nightly-dump" = {
serviceConfig = {
Type = "oneshot";
ExecStart = ''
${pkgs.podman}/bin/podman exec mongodb \
sh -lc 'mongodump --uri="mongodb://adminUser:securePassword@localhost:27017/?authSource=admin" \
--out /data/backups/$(date +%F)'
'';
ExecStartPost = ''
# Clean up old backups from within the container
${pkgs.podman}/bin/podman exec mongodb \
sh -lc 'find /data/backups -maxdepth 1 -type d -mtime +14 -exec rm -rf {} +'
'';
};
};
systemd.timers."mongo-nightly-dump" = {
wantedBy = ["timers.target"];
timerConfig.OnCalendar = "daily";
timerConfig.RandomizedDelaySec = "15m";
};
services.traefik.dynamicConfigOptions.http = {
services.librechat.loadBalancer.servers = [{url = "http://localhost:3040/";}];
routers.librechat = {
rule = "Host(`chat.az-gruppe.com`)";
tls.certResolver = "ionos";
service = "librechat";
entrypoints = "websecure";
};
};
}

67
hosts/AZ-CLD-1/services/postgres.nix
View File

@@ -1,10 +1,14 @@
{pkgs, ...}: {
{
config,
pkgs,
...
}: {
services.postgresql = {
enable = true;
enableTCPIP = true;
package = pkgs.postgresql_17;
settings = {
ssl = true;
ssl = true;
};
extensions = with pkgs.postgresql17Packages; [
pgvector
@@ -18,6 +22,10 @@
CREATE DATABASE kestra;
ALTER DATABASE kestra OWNER to kestra;
CREATE USER librechat_rag WITH ENCRYPTED PASSWORD 'librechat_rag';
CREATE DATABASE librechat_rag;
ALTER DATABASE librechat_rag OWNER to librechat_rag;
CREATE USER n8n WITH ENCRYPTED PASSWORD 'n8n';
CREATE DATABASE n8n;
ALTER DATABASE n8n OWNER to n8n;
@@ -32,38 +40,55 @@
'';
authentication = pkgs.lib.mkOverride 10 ''
# Local connections (Unix socket)
local all postgres peer
local n8n n8n scram-sha-256
local outline outline scram-sha-256
local vaultwarden vaultwarden scram-sha-256
local all postgres peer
local n8n n8n scram-sha-256
local outline outline scram-sha-256
local vaultwarden vaultwarden scram-sha-256
# Localhost connections (IPv4 and IPv6)
host all postgres 127.0.0.1/32 scram-sha-256
host all postgres ::1/128 scram-sha-256
host outline outline 127.0.0.1/32 scram-sha-256
host outline outline ::1/128 scram-sha-256
host all postgres 127.0.0.1/32 scram-sha-256
host all postgres ::1/128 scram-sha-256
host n8n n8n 127.0.0.1/32 scram-sha-256
host n8n n8n ::1/128 scram-sha-256
host outline outline 127.0.0.1/32 scram-sha-256
host outline outline ::1/128 scram-sha-256
host vaultwarden vaultwarden 127.0.0.1/32 scram-sha-256
host vaultwarden vaultwarden ::1/128 scram-sha-256
host n8n n8n 127.0.0.1/32 scram-sha-256
host n8n n8n ::1/128 scram-sha-256
host vaultwarden vaultwarden 127.0.0.1/32 scram-sha-256
host vaultwarden vaultwarden ::1/128 scram-sha-256
# Podman network connections for Baserow
host baserow baserow 10.89.0.0/24 scram-sha-256
host kestra kestra 10.89.0.0/24 scram-sha-256
host baserow baserow 10.89.0.0/24 scram-sha-256
host kestra kestra 10.89.0.0/24 scram-sha-256
host librechat_rag librechat_rag 10.89.0.0/24 scram-sha-256
# Deny all other connections
local all all reject
host all all 0.0.0.0/0 reject
host all all ::/0 reject
local all all reject
host all all 0.0.0.0/0 reject
host all all ::/0 reject
'';
};
services.postgresqlBackup = {
enable = true;
startAt = "03:10:00";
databases = ["baserow" "kestra" "n8n" "outline" "vaultwarden"];
databases = ["baserow" "kestra" "librechat_rag" "n8n" "outline" "vaultwarden"];
};
services.pgadmin = {
enable = true;
initialPasswordFile = "${config.age.secrets.pgadmin-pw.path}";
initialEmail = "sascha.koenig@azintec.com";
};
# Traefik configuration specific to baserow
services.traefik.dynamicConfigOptions.http = {
services.pgadmin.loadBalancer.servers = [{url = "http://localhost:5050/";}];
routers.pgadmin = {
rule = "Host(`pg.az-gruppe.com`)";
tls.certResolver = "ionos";
service = "pgadmin";
entrypoints = "websecure";
};
};
networking.firewall = {
extraCommands = ''