vh
9171e6a20f
LLM observability for the fleet — pretty trace UI over the gateway: prompts, completions, reasoning, latency, token counts. The pretty layer LiteLLM's spend_logs lacked. - stacks/langfuse: v3 self-host stack (web/worker/postgres/clickhouse/redis/ minio) on ana-docker, adapted from upstream. UI on :3001 (gitea owns :3000). Project + API keys auto-provisioned via LANGFUSE_INIT_*. HOSTNAME=0.0.0.0 on langfuse-web so it's reachable via the published port while also on tnet. - litellm: enabled success_callback/failure_callback: ["langfuse"] (the passthrough env was already wired); keys + host go in the litellm .env. Verified: stack healthy, project keys authenticate, and a real gateway call landed a litellm-acompletion trace in Langfuse within ~6s. Secrets live only in the server .env (never committed).
45 lines
1.9 KiB
Bash
45 lines
1.9 KiB
Bash
# Langfuse v3 — copy to `.env` on the server and fill REAL secrets, then
|
|
# `docker compose up -d`. NEVER commit the real `.env`.
|
|
#
|
|
# Generate secrets (use hex to stay safe inside DATABASE_URL + .env parsing):
|
|
# openssl rand -hex 32 → ENCRYPTION_KEY (must be exactly 64 hex chars)
|
|
# openssl rand -hex 32 → NEXTAUTH_SECRET, SALT
|
|
# openssl rand -hex 16 → the passwords
|
|
# uuidgen → the pk-lf-/sk-lf- INIT keys
|
|
|
|
# --- Core ---
|
|
# Host port for the web UI. 3000 is taken by gitea on ana-docker → use 3001.
|
|
# NEXTAUTH_URL must match the URL you browse to (host:LANGFUSE_PORT).
|
|
LANGFUSE_PORT=3001
|
|
NEXTAUTH_URL=http://10.250.50.70:3001
|
|
NEXTAUTH_SECRET=CHANGEME # openssl rand -hex 32
|
|
SALT=CHANGEME # openssl rand -hex 32
|
|
ENCRYPTION_KEY=CHANGEME # openssl rand -hex 32 (exactly 64 hex chars)
|
|
|
|
# --- Postgres (password must match in DATABASE_URL) ---
|
|
POSTGRES_PASSWORD=CHANGEME
|
|
DATABASE_URL=postgresql://postgres:CHANGEME@postgres:5432/postgres
|
|
|
|
# --- ClickHouse / Redis ---
|
|
CLICKHOUSE_PASSWORD=CHANGEME
|
|
REDIS_AUTH=CHANGEME
|
|
|
|
# --- MinIO (S3 backend). The 3 S3 secret keys MUST equal MINIO_ROOT_PASSWORD;
|
|
# access-key-ids stay the compose default "minio" (= MINIO_ROOT_USER). ---
|
|
MINIO_ROOT_PASSWORD=CHANGEME
|
|
LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=CHANGEME
|
|
LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY=CHANGEME
|
|
LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY=CHANGEME
|
|
|
|
# --- Auto-provision org/project/user + API keys on first boot ---
|
|
# The PUBLIC/SECRET keys become LiteLLM's LANGFUSE_PUBLIC_KEY / LANGFUSE_SECRET_KEY.
|
|
LANGFUSE_INIT_ORG_ID=pfi
|
|
LANGFUSE_INIT_ORG_NAME=PFI
|
|
LANGFUSE_INIT_PROJECT_ID=gateway
|
|
LANGFUSE_INIT_PROJECT_NAME=LiteLLM Gateway
|
|
LANGFUSE_INIT_PROJECT_PUBLIC_KEY=pk-lf-CHANGEME
|
|
LANGFUSE_INIT_PROJECT_SECRET_KEY=sk-lf-CHANGEME
|
|
LANGFUSE_INIT_USER_EMAIL=lkraven@lkraven.com
|
|
LANGFUSE_INIT_USER_NAME=lkraven
|
|
LANGFUSE_INIT_USER_PASSWORD=CHANGEME # initial UI login password
|