Runtime topology

Flow

flowchart TD
  browser[Browser and desktop clients]
  appvhost[nginx: lobe.loca.zone]
  s3vhost[nginx: s3.lobe.loca.zone]
  wikivhost[nginx: wiki.lobe.loca.zone]
  loopapp[127.0.0.1:52100 to 3210]
  loops3[127.0.0.1:52101 to 9000]
  lobe[LobeHub 2.2.15]
  pg[ParadeDB PostgreSQL 17]
  redis[Redis 7 cache]
  rustfs[RustFS S3 API]
  init[rustfs-init one shot]
  search[SearXNG]
  litellm[LiteLLM lllm-proxy]
  wiki[Atomic Quartz dist]
  pgvol[(lobe_postgres_data)]
  redisvol[(lobe_redis_data)]
  rustvol[(lobe_rustfs_data)]

  browser --> appvhost --> loopapp --> lobe
  browser --> s3vhost --> loops3 --> rustfs
  browser --> wikivhost --> wiki
  lobe --> pg --> pgvol
  lobe --> redis --> redisvol
  lobe --> rustfs --> rustvol
  init --> rustfs
  lobe --> search
  lobe -->|lllm_default| litellm

Pinned services

Service	Container	Image reference	Exposure and role
lobe	lobe	lobehub/lobehub:2.2.15@sha256:9186fbb2a1cd593eada518560695e1f14f0fa570ed987ba1bf1b3008456422ca	Loopback 52100 to 3210; application, auth session, database client, S3 client, cache client, search client, and model client
postgresql	lobe-postgres	paradedb/paradedb:latest-pg17@sha256:044b8cc5b40159714e88e3f546fc74de11cf215c030190cc82c6627015d728ea	Private port 5432; database lobechat; shared_preload_libraries=pg_search
redis	lobe-redis	redis:7-alpine@sha256:ff02b58f971e7d7d156a1267e283fcbbeee91773b6aa36c49dac28ecfe28eadf	Private port 6379; cache with AOF enabled and save 60 1000
rustfs	lobe-rustfs	rustfs/rustfs:latest@sha256:41fe89380f4120a337790c02af192c3fe7bb55c3edc2e6e9357b487b47c6ab21	Loopback 52101 to S3 API 9000; console disabled
rustfs-init	lobe-rustfs-init	minio/mc:latest@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727	One-shot bucket creation and policy application; exits after success
searxng	lobe-searxng	searxng/searxng@sha256:addd2cf36efb4b9815a2820a522aef7cce4da0d1c0e4527f6675f5663332fc9b	Private port 8080; settings mounted read-only; secret key overridden from the environment

The tags retained before each digest are human-readable selectors only. The manifest digest is the immutable runtime pin.

Networks

• lobe-network:
  • private bridge for all six services
  • runtime Docker name: lobe_lobe-network
  • carries PostgreSQL, Redis, RustFS, initialization, and SearXNG traffic
• lllm_default:
  • existing external Docker network
  • attached only to lobe in this Compose project
  • resolves lllm-proxy:4000; no host gateway path is used

Startup ordering

• Lobe waits for:
  • PostgreSQL health from pg_isready -U postgres
  • Redis health from redis-cli ping
  • RustFS health from its /health endpoint
  • successful completion of rustfs-init
• rustfs-init waits for RustFS health, then:
  • creates bucket lobe if absent
  • applies bucket.config.json
  • grants anonymous s3:GetObject on objects in that bucket
• Lobe health uses the image Node runtime to fetch its internal root at http://127.0.0.1:3210/.
• Long-running services use restart: unless-stopped; rustfs-init uses restart: "no".

Data authority

• lobe_postgres_data:
  • authoritative relational state
  • must be protected by a custom-format pg_dump
• lobe_rustfs_data:
  • authoritative object state
  • must be protected by an mc mirror
• lobe_redis_data:
  • reconstructible cache
  • persistence improves continuity but is not an authoritative backup target

PostgreSQL and RustFS must be backed up as a matched pair before upgrades. Volume existence alone is not recovery evidence.

Ingress behavior

• application vhost:
  • sends lobe.loca.zone to loopback port 52100
  • preserves host and forwarding headers plus WebSocket upgrade headers
  • disables proxy buffering and cache for streamed responses
  • uses 86400-second read and send timeouts
  • accepts request bodies up to 128m
• object vhost:
  • sends the unmodified path on s3.lobe.loca.zone to loopback port 52101
  • preserves Host and Origin for S3 signatures and CORS
  • disables request and response buffering
  • accepts request bodies up to 128m
• wiki vhost:
  • serves the active current release
  • resolves $uri, $uri.html, then $uri/; otherwise returns 404
  • caches immutable assets for one year

See endpoints for the complete endpoint register and backups-restore for recovery procedures.