Introduction to LibreChat

LibreChat serves as a centralized hub for AI conversations, offering a familiar ChatGPT-like user experience enriched with advanced features and extensive customization capabilities.

Key Features

• Multi-Provider Support: Connect to OpenAI, Anthropic, Google, Groq, Mistral, and more
• Multimodal Conversations: Upload images, analyze documents, and chat with files
• Advanced Agents: Create AI assistants with custom tools and API actions
• RAG Integration: Chat with your documents using the built-in RAG pipeline
• MCP Support: Integrate with Model Context Protocol servers
• Web Search: Enable AI models to search the web for current information
• Plugin System: Extend functionality with built-in and custom plugins

Why Self-Host LibreChat?

• Data Privacy: Keep all conversations on your own infrastructure
• Cost Control: Use your own API keys without platform markup
• Customization: Full control over features, endpoints, and branding
• No Usage Limits: Avoid rate limits imposed by hosted solutions

Prerequisites and Requirements

Server Requirements

Note: With all features enabled (RAG, MeiliSearch, multiple endpoints), 4GB RAM is recommended for smooth operation.

Required Software

• Git: For cloning the LibreChat repository
• Docker Engine: Container runtime (v24.0+)
• Docker Compose: Container orchestration (v2.0+)
• Nginx: Reverse proxy for SSL termination
• Certbot: SSL certificate management with Let's Encrypt

API Keys

You will need API keys from one or more AI providers: OpenAI, Anthropic, Google AI, Groq, Mistral, OpenRouter, etc.

RamNode VPS Setup

Log in to your RamNode account at vps.ramnode.com, deploy a new server with Ubuntu 24.04 LTS and at least 2GB RAM.

Initial Server Configuration

Connect and update system

ssh root@your-server-ip  
apt update && apt upgrade -y  

Create non-root user

adduser librechat  
usermod -aG sudo librechat

# Configure SSH key for new user  
mkdir -p /home/librechat/.ssh  
cp ~/.ssh/authorized_keys /home/librechat/.ssh/  
chown -R librechat:librechat /home/librechat/.ssh  
chmod 700 /home/librechat/.ssh  
chmod 600 /home/librechat/.ssh/authorized_keys

su - librechat

Docker Installation

Install Docker dependencies

sudo apt install -y ca-certificates curl gnupg lsb-release

# Add Docker GPG key  
sudo install -m 0755 -d /etc/apt/keyrings  
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \  
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg  
sudo chmod a+r /etc/apt/keyrings/docker.gpg

Add Docker repository and install

echo "deb [arch=$(dpkg --print-architecture) \
  signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | \  
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update  
sudo apt install -y docker-ce docker-ce-cli containerd.io \  
docker-buildx-plugin docker-compose-plugin

Post-installation setup

# Add user to docker group  
sudo usermod -aG docker $USER  
newgrp docker

# Verify installation  
docker --version  
docker compose version

# Enable on boot  
sudo systemctl enable docker  
sudo systemctl enable containerd

LibreChat Deployment

Clone repository

cd ~  
git clone https://github.com/danny-avila/LibreChat.git  
cd LibreChat

Configure environment

cp .env.example .env

# Generate secure credentials  
openssl rand -hex 32  # For CREDS_KEY  
openssl rand -hex 16  # For CREDS_IV  
openssl rand -hex 32  # For JWT_SECRET  
openssl rand -hex 32  # For JWT_REFRESH_SECRET

Edit .env file

Essential environment variables

# Server Configuration  
HOST=0.0.0.0  
PORT=3080

# Credentials (REQUIRED)  
CREDS_KEY=your-32-byte-hex-key-here  
CREDS_IV=your-16-byte-hex-iv-here

# JWT Secrets  
JWT_SECRET=your-jwt-secret-here  
JWT_REFRESH_SECRET=your-jwt-refresh-secret-here

# Domain Configuration  
DOMAIN_CLIENT=https://chat.yourdomain.com  
DOMAIN_SERVER=https://chat.yourdomain.com

# MongoDB  
MONGO_URI=mongodb://mongodb:27017/LibreChat

# User Registration  
ALLOW_REGISTRATION=true  
ALLOW_EMAIL_LOGIN=true

# API Keys (add yours)  
OPENAI_API_KEY=sk-your-openai-key  
ANTHROPIC_API_KEY=sk-ant-your-anthropic-key  
GOOGLE_KEY=your-google-ai-key

Warning: Never commit your .env file to version control. It contains sensitive credentials.

Start LibreChat

docker compose up -d

# Verify containers  
docker compose ps

# Check logs  
docker compose logs -f api

Access LibreChat at http://your-server-ip:3080. The first user to register will automatically be granted admin privileges.

Nginx Reverse Proxy with SSL

Install Nginx and Certbot

sudo apt install -y nginx certbot python3-certbot-nginx

Create Nginx configuration

# /etc/nginx/sites-available/librechat  
server {  
    listen 80;  
    server_name chat.yourdomain.com;  
    return 301 https://$server_name$request_uri;  
}

server {  
    listen 443 ssl http2;  
    server_name chat.yourdomain.com;

ssl_certificate /etc/letsencrypt/live/chat.yourdomain.com/fullchain.pem;  
    ssl_certificate_key /etc/letsencrypt/live/chat.yourdomain.com/privkey.pem;  
    ssl_protocols TLSv1.2 TLSv1.3;  
    ssl_prefer_server_ciphers on;

client_max_body_size 100M;

location / {  
        proxy_pass http://127.0.0.1:3080;  
        proxy_http_version 1.1;  
        proxy_set_header Upgrade $http_upgrade;  
        proxy_set_header Connection "upgrade";  
        proxy_set_header Host $host;  
        proxy_set_header X-Real-IP $remote_addr;  
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        proxy_set_header X-Forwarded-Proto $scheme;  
        proxy_read_timeout 600s;  
    }  
}

Enable site and obtain SSL

sudo ln -s /etc/nginx/sites-available/librechat /etc/nginx/sites-enabled/  
sudo nginx -t  
sudo certbot --nginx -d chat.yourdomain.com  
sudo systemctl reload nginx

Security Hardening

Security Best Practices

• Use strong, unique passwords for all credentials
• Enable rate limiting for login and registration
• Restrict registration to invited users only if needed
• Keep Docker images updated regularly
• Configure firewall rules with UFW

Configure UFW firewall

sudo ufw default deny incoming  
sudo ufw default allow outgoing  
sudo ufw allow ssh  
sudo ufw allow 80/tcp  
sudo ufw allow 443/tcp  
sudo ufw enable

Troubleshooting

View container logs

Restart services

Update LibreChat

LibreChat Deployed Successfully!

Your self-hosted AI chat platform is now running. Access it at your configured domain and start chatting with multiple AI providers through a unified interface.