LobeHub SSOT

2 min read

LobeHub SSOT

This vault is the operational source of truth for LobeHub at lobe.loca.zone. The deployment is a pinned Docker Compose stack rooted at ~/dev/lobe, uses native Authelia OIDC, reaches the existing LiteLLM gateway over an external Docker network, and owns its PostgreSQL and RustFS data.

Current state

  • release:
    • version: 2.2.15
    • image: lobehub/lobehub:2.2.15@sha256:9186fbb2a1cd593eada518560695e1f14f0fa570ed987ba1bf1b3008456422ca
    • Compose project: lobe
  • public surfaces:
    • application: https://lobe.loca.zone
    • object API: https://s3.lobe.loca.zone
    • wiki: https://wiki.lobe.loca.zone
  • host publishes:
    • LobeHub: 127.0.0.1:52100 to container port 3210
    • RustFS S3 API: 127.0.0.1:52101 to container port 9000
    • PostgreSQL, Redis, SearXNG, and the RustFS console have no published socket
  • identity:
    • LobeHub Better Auth delegates OIDC to Authelia with client ID lobe
    • email and password login is disabled; there is no local break-glass account
    • nginx deliberately has no auth_request gate on the application vhost
  • model access:
    • route: Lobe container to lllm-proxy:4000/v1 on external network lllm_default
    • scoped virtual key alias: lobe
    • permitted aliases: fast, oss-120b, free
  • data authority:
    • authoritative: PostgreSQL volume lobe_postgres_data and RustFS volume lobe_rustfs_data
    • reconstructible cache: Redis volume lobe_redis_data
    • object consequence: anonymous s3:GetObject is enabled for bucket lobe; uploaded object URLs are publicly readable, while writes remain signed

Operating invariants

  • Validate with sudo -n docker compose config --quiet; never run the rendering form because it interpolates secrets.
  • Pin every container image by digest. A mutable tag without @sha256: is not an accepted deployment state.
  • Take both the PostgreSQL custom-format dump and the RustFS mirror before an upgrade.
  • Do not treat a Docker volume as a backup.
  • Keep native OIDC at the application layer. An nginx forward-auth redirect would break desktop, API, and agent traffic.
  • Keep the LiteLLM virtual key scoped to exactly the three approved aliases; never substitute the LiteLLM master key.
  • Treat every uploaded object URL as public information unless the bucket policy is deliberately redesigned.

Start here