Endpoint reference

Public HTTPS

Origin	Purpose	Upstream	Authentication and exposure
https://lobe.loca.zone	LobeHub application, API, and streaming	http://127.0.0.1:52100	Native Better Auth OIDC; no nginx auth_request
https://s3.lobe.loca.zone	RustFS S3 API	http://127.0.0.1:52101	Anonymous reads allowed by bucket policy; writes signed; no console
https://wiki.lobe.loca.zone	Static LobeHub SSOT	active Quartz current release	Public
https://auth.loca.zone	Authelia OIDC issuer	existing Authelia service	one_factor for client lobe

OIDC callback: https://lobe.loca.zone/api/auth/callback/authelia.

All three Lobe-owned names also listen on HTTP port 80: ACME challenges are served from the common webroot and every other request redirects to the same HTTPS host and URI.

Host-loopback publishes

Host socket	Container target	Owner
127.0.0.1:52100	lobe:3210	LobeHub application
127.0.0.1:52101	rustfs:9000	RustFS S3 API

Both binds are loopback-only. Nginx is the public ingress.

Private Compose routes

Route	Consumer	Role
postgresql:5432	LobeHub	ParadeDB PostgreSQL 17 database lobechat
redis:6379	LobeHub	Redis cache with prefix lobechat
rustfs:9000	LobeHub and rustfs-init	S3-compatible object API
searxng:8080	LobeHub	private search service
http://localhost:3210	LobeHub container	internal application origin
http://127.0.0.1:3210/	LobeHub healthcheck	container-local application health

These routes use the private lobe-network; none is a public hostname.

External model route

Route	Network	Credential boundary
http://lllm-proxy:4000/v1	external lllm_default	LiteLLM virtual key alias lobe permits fast, oss-120b, and free only

Only the lobe service joins lllm_default. PostgreSQL, Redis, RustFS, rustfs-init, and SearXNG remain on the private network.

Nginx behavior

• application vhost:
  • request-body limit: 128m
  • forwards Host, real IP, forwarded chain, and forwarded scheme
  • forwards Upgrade and Connection
  • proxy buffering: off
  • proxy cache: off
  • read and send timeout: 86400 seconds
• object vhost:
  • request-body limit: 128m
  • unmodified request path
  • preserves Host and Origin for signatures and CORS
  • request buffering: off
  • response buffering: off
  • read and send timeout: 300 seconds
• wiki vhost:
  • static lookup order: $uri, $uri.html, $uri/, then 404
  • immutable asset cache: one year

TLS

• Certbot lineage: lobe.loca.zone
• certificate files used by all three TLS vhosts:
  • /etc/letsencrypt/live/lobe.loca.zone/fullchain.pem
  • /etc/letsencrypt/live/lobe.loca.zone/privkey.pem
• SANs:
  • lobe.loca.zone
  • wiki.lobe.loca.zone
  • s3.lobe.loca.zone
• verified expiry: 2026-11-27

Deliberately absent surfaces

• no PostgreSQL host port
• no Redis host port
• no SearXNG host port
• no RustFS console
• no separate LiteLLM deployment or host-gateway route
• no nginx auth gate in front of LobeHub
• no local email or password login

Object-read consequence

rustfs-init applies bucket.config.json to bucket lobe, granting anonymous s3:GetObject. Any party holding an uploaded object URL can read that object without an application session. Upload, overwrite, and deletion remain signature-protected.