Architecture

The deployment is one private Compose stack plus one narrowly shared model-gateway network. Nginx terminates public TLS; LobeHub owns application authentication; PostgreSQL and RustFS own durable state.

Pages

• runtime-topology
  • exact service images, networks, ports, health dependencies, data flows, and volume authority
• auth-model
  • Better Auth OIDC against Authelia, SSO-only behavior, secret placement, and the reason nginx must not gate the app

Authority split

• nginx:
  • terminates TLS for lobe.loca.zone, s3.lobe.loca.zone, and wiki.lobe.loca.zone
  • proxies the app and S3 API from host loopback
  • serves the wiki as static files
  • does not authenticate LobeHub users
• LobeHub:
  • owns user sessions through Better Auth
  • initiates native OIDC against Authelia
  • selects only the three LiteLLM aliases exposed by its scoped key
• Authelia:
  • authenticates the user and issues OIDC claims for client lobe
  • applies one_factor with implicit consent
• LiteLLM:
  • mediates provider access
  • enforces the lobe virtual key model allowlist
• PostgreSQL:
  • owns authoritative application and identity-linked database state
• RustFS:
  • owns authoritative uploaded objects
  • exposes anonymous reads from bucket lobe; object writes remain signed
• Redis:
  • supplies reconstructible cache state
• SearXNG:
  • supplies private search over the Compose network and has no host publish

Design boundaries

• public application traffic enters only through nginx and loopback port 52100
• public object traffic enters only through nginx and loopback port 52101
• private data services remain on lobe-network
• only the Lobe service also joins external network lllm_default
• the RustFS console is disabled rather than hidden behind another route
• the wiki is public and independent of the application session