+LibreChat +pgadmin
This commit is contained in:
@@ -1,6 +1,12 @@
|
||||
{
|
||||
{lib, ...}: {
|
||||
imports = [
|
||||
./baserow.nix
|
||||
./librechat.nix
|
||||
./portainer.nix
|
||||
];
|
||||
system.activationScripts.createPodmanNetworkWeb = lib.mkAfter ''
|
||||
if ! /run/current-system/sw/bin/podman network exists web; then
|
||||
/run/current-system/sw/bin/podman network create web --subnet=10.89.0.0/24 --internal
|
||||
fi
|
||||
'';
|
||||
}
|
||||
|
||||
109
hosts/AZ-CLD-1/services/containers/librechat.nix
Normal file
109
hosts/AZ-CLD-1/services/containers/librechat.nix
Normal file
@@ -0,0 +1,109 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
envFile = config.age.secrets.librechat-env.path;
|
||||
in {
|
||||
virtualisation.oci-containers = {
|
||||
containers.meilisearch = {
|
||||
image = "getmeili/meilisearch:v1.12.3";
|
||||
autoStart = true;
|
||||
volumes = ["librechat_meili:/meili_data"];
|
||||
environment = {
|
||||
MEILI_HTTP_ADDR = "0.0.0.0:7700";
|
||||
MEILI_NO_ANALYTICS = "true";
|
||||
};
|
||||
environmentFiles = [envFile];
|
||||
extraOptions = ["--ip=10.89.0.20" "--network=web"];
|
||||
};
|
||||
|
||||
containers.rag_api = {
|
||||
image = "ghcr.io/danny-avila/librechat-rag-api-dev-lite:latest";
|
||||
autoStart = true;
|
||||
environment = {
|
||||
RAG_PORT = "8000";
|
||||
# pgvector connection to host Postgres
|
||||
DB_HOST = "10.89.0.1"; # your host on the 'web' network
|
||||
DB_PORT = "5432";
|
||||
# embeddings: pick one (OpenAI default, or HF/Ollama per docs)
|
||||
# EMBEDDINGS_PROVIDER = "openai";
|
||||
# RAG_OPENAI_API_KEY is read by RAG API (can also use OPENAI_API_KEY).
|
||||
};
|
||||
environmentFiles = [envFile];
|
||||
dependsOn = ["meilisearch"];
|
||||
extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.21" "--network=web"];
|
||||
ports = ["127.0.0.1:8000:8000"]; # optional: expose to host for debugging
|
||||
};
|
||||
|
||||
containers.mongodb = {
|
||||
image = "mongo:7";
|
||||
autoStart = true;
|
||||
volumes = [
|
||||
"librechat_mongo:/data/db"
|
||||
"/var/backup/mongodb:/data/backups"
|
||||
];
|
||||
# Enable auth once users exist; see Mongo auth doc.
|
||||
# command = [ "mongod", "--auth" ];
|
||||
extraOptions = ["--ip=10.89.0.22" "--network=web"];
|
||||
};
|
||||
|
||||
containers.librechat = {
|
||||
image = "ghcr.io/danny-avila/librechat-dev-api:latest";
|
||||
autoStart = true;
|
||||
ports = ["127.0.0.1:3040:3080"];
|
||||
dependsOn = ["mongodb" "rag_api" "meilisearch"];
|
||||
environment = {
|
||||
HOST = "0.0.0.0";
|
||||
NODE_ENV = "production";
|
||||
# Mongo URI (start without auth; switch to mongodb://user:pass@mongodb:27017/LibreChat after Step 4)
|
||||
MONGO_URI = "mongodb://mongodb:27017/LibreChat";
|
||||
MEILI_HOST = "http://meilisearch:7700";
|
||||
RAG_PORT = "8000";
|
||||
RAG_API_URL = "http://rag_api:8000";
|
||||
};
|
||||
environmentFiles = [envFile];
|
||||
volumes = [
|
||||
# Config file still needs to be a bind mount for host management
|
||||
"/var/lib/librechat/librechat.yaml:/app/librechat.yaml:ro"
|
||||
# Use named volumes for application data
|
||||
"librechat_images:/app/client/public/images"
|
||||
"librechat_uploads:/app/uploads"
|
||||
"librechat_logs:/app/api/logs"
|
||||
];
|
||||
extraOptions = ["--ip=10.89.0.23" "--network=web"];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."mongo-nightly-dump" = {
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = ''
|
||||
${pkgs.podman}/bin/podman exec mongodb \
|
||||
sh -lc 'mongodump --uri="mongodb://adminUser:securePassword@localhost:27017/?authSource=admin" \
|
||||
--out /data/backups/$(date +%F)'
|
||||
'';
|
||||
ExecStartPost = ''
|
||||
# Clean up old backups from within the container
|
||||
${pkgs.podman}/bin/podman exec mongodb \
|
||||
sh -lc 'find /data/backups -maxdepth 1 -type d -mtime +14 -exec rm -rf {} +'
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.timers."mongo-nightly-dump" = {
|
||||
wantedBy = ["timers.target"];
|
||||
timerConfig.OnCalendar = "daily";
|
||||
timerConfig.RandomizedDelaySec = "15m";
|
||||
};
|
||||
|
||||
services.traefik.dynamicConfigOptions.http = {
|
||||
services.librechat.loadBalancer.servers = [{url = "http://localhost:3040/";}];
|
||||
routers.librechat = {
|
||||
rule = "Host(`chat.az-gruppe.com`)";
|
||||
tls.certResolver = "ionos";
|
||||
service = "librechat";
|
||||
entrypoints = "websecure";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,10 +1,14 @@
|
||||
{pkgs, ...}: {
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
enableTCPIP = true;
|
||||
package = pkgs.postgresql_17;
|
||||
settings = {
|
||||
ssl = true;
|
||||
ssl = true;
|
||||
};
|
||||
extensions = with pkgs.postgresql17Packages; [
|
||||
pgvector
|
||||
@@ -18,6 +22,10 @@
|
||||
CREATE DATABASE kestra;
|
||||
ALTER DATABASE kestra OWNER to kestra;
|
||||
|
||||
CREATE USER librechat_rag WITH ENCRYPTED PASSWORD 'librechat_rag';
|
||||
CREATE DATABASE librechat_rag;
|
||||
ALTER DATABASE librechat_rag OWNER to librechat_rag;
|
||||
|
||||
CREATE USER n8n WITH ENCRYPTED PASSWORD 'n8n';
|
||||
CREATE DATABASE n8n;
|
||||
ALTER DATABASE n8n OWNER to n8n;
|
||||
@@ -32,38 +40,55 @@
|
||||
'';
|
||||
authentication = pkgs.lib.mkOverride 10 ''
|
||||
# Local connections (Unix socket)
|
||||
local all postgres peer
|
||||
local n8n n8n scram-sha-256
|
||||
local outline outline scram-sha-256
|
||||
local vaultwarden vaultwarden scram-sha-256
|
||||
local all postgres peer
|
||||
local n8n n8n scram-sha-256
|
||||
local outline outline scram-sha-256
|
||||
local vaultwarden vaultwarden scram-sha-256
|
||||
|
||||
# Localhost connections (IPv4 and IPv6)
|
||||
host all postgres 127.0.0.1/32 scram-sha-256
|
||||
host all postgres ::1/128 scram-sha-256
|
||||
|
||||
host outline outline 127.0.0.1/32 scram-sha-256
|
||||
host outline outline ::1/128 scram-sha-256
|
||||
host all postgres 127.0.0.1/32 scram-sha-256
|
||||
host all postgres ::1/128 scram-sha-256
|
||||
|
||||
host n8n n8n 127.0.0.1/32 scram-sha-256
|
||||
host n8n n8n ::1/128 scram-sha-256
|
||||
host outline outline 127.0.0.1/32 scram-sha-256
|
||||
host outline outline ::1/128 scram-sha-256
|
||||
|
||||
host vaultwarden vaultwarden 127.0.0.1/32 scram-sha-256
|
||||
host vaultwarden vaultwarden ::1/128 scram-sha-256
|
||||
host n8n n8n 127.0.0.1/32 scram-sha-256
|
||||
host n8n n8n ::1/128 scram-sha-256
|
||||
|
||||
host vaultwarden vaultwarden 127.0.0.1/32 scram-sha-256
|
||||
host vaultwarden vaultwarden ::1/128 scram-sha-256
|
||||
|
||||
# Podman network connections for Baserow
|
||||
host baserow baserow 10.89.0.0/24 scram-sha-256
|
||||
host kestra kestra 10.89.0.0/24 scram-sha-256
|
||||
host baserow baserow 10.89.0.0/24 scram-sha-256
|
||||
host kestra kestra 10.89.0.0/24 scram-sha-256
|
||||
host librechat_rag librechat_rag 10.89.0.0/24 scram-sha-256
|
||||
|
||||
# Deny all other connections
|
||||
local all all reject
|
||||
host all all 0.0.0.0/0 reject
|
||||
host all all ::/0 reject
|
||||
local all all reject
|
||||
host all all 0.0.0.0/0 reject
|
||||
host all all ::/0 reject
|
||||
'';
|
||||
};
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
startAt = "03:10:00";
|
||||
databases = ["baserow" "kestra" "n8n" "outline" "vaultwarden"];
|
||||
databases = ["baserow" "kestra" "librechat_rag" "n8n" "outline" "vaultwarden"];
|
||||
};
|
||||
services.pgadmin = {
|
||||
enable = true;
|
||||
initialPasswordFile = "${config.age.secrets.pgadmin-pw.path}";
|
||||
initialEmail = "sascha.koenig@azintec.com";
|
||||
};
|
||||
|
||||
# Traefik configuration specific to baserow
|
||||
services.traefik.dynamicConfigOptions.http = {
|
||||
services.pgadmin.loadBalancer.servers = [{url = "http://localhost:5050/";}];
|
||||
routers.pgadmin = {
|
||||
rule = "Host(`pg.az-gruppe.com`)";
|
||||
tls.certResolver = "ionos";
|
||||
service = "pgadmin";
|
||||
entrypoints = "websecure";
|
||||
};
|
||||
};
|
||||
networking.firewall = {
|
||||
extraCommands = ''
|
||||
|
||||
Reference in New Issue
Block a user