mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-09-12 01:18:43 +00:00
5ee910e44c
* feat: add search stack PoC infrastructure (Track 1)
Docker Compose stack for PLAN.md's new chat-search architecture:
ferretdb 2.7.0 + its postgres-documentdb 17 backing store (wal_level=logical
for the later CDC spike), a new dedicated chat_search_db (PostgreSQL 17 +
pgvector, non-default credentials, three least-privilege roles per the
Security roles section), and clickhouse (26.3 LTS). vectordb/rag_api are
untouched, per decision 3.
All four image tags verified against their registries via curl (ghcr.io
manifest lookups, Docker Hub tags API) before pinning. Host ports checked
against every existing compose file in the repo to avoid collisions.
The role-provisioning init script and healthcheck script were both actually
run against live containers once Docker became available mid-task: full
Mongo-wire round trip against ferretdb, real INSERT/SELECT proving the
writer's default-privilege grants and the reader's deny-by-default posture
against a throwaway pgvector table, wal_level and pgvector/pg_trgm extension
checks. One bug only surfaced at runtime and is fixed: psql does not
interpolate :'var' inside dollar-quoted DO $$ ... $$ blocks, so role
creation/idempotency uses \gset + \if/\else/\endif instead.
* 🔐 chore: require operator-supplied FerretDB credentials
The chat_search_db and ClickHouse services already refused to start without
operator-supplied passwords; FerretDB's backing PostgreSQL still fell back to
a working ferretdb/ferretdb pair, so the stack booted with a known credential
even though it holds projected chat content. That is the same shape as the
myuser/mypassword default the search plan calls out on the existing vectordb
service.
All four FerretDB credential references now use ${VAR:?} - compose, the
healthcheck script, and the README examples - and .env.example ships
REPLACE_ME placeholders instead of literals.
The differential-test harness at packages/data-schemas/misc/ferretdb keeps its
fixture credentials; it holds only throwaway test data.
48 lines
2 KiB
Text
48 lines
2 KiB
Text
# Copy to search/.env (gitignored by the repo's `.env*` rule) and replace
|
|
# every REPLACE_ME_* value before running `docker compose up`. Generate real
|
|
# secrets, e.g.:
|
|
#
|
|
# for var in CHAT_SEARCH_BOOTSTRAP_PASSWORD CHAT_SEARCH_OWNER_PASSWORD \
|
|
# CHAT_SEARCH_WRITER_PASSWORD CHAT_SEARCH_READER_PASSWORD \
|
|
# CLICKHOUSE_PASSWORD; do
|
|
# val=$(openssl rand -base64 24 | tr -d '=+/')
|
|
# sed -i "s#^${var}=.*#${var}=${val}#" search/.env
|
|
# done
|
|
#
|
|
# See search/README.md for the full credentials map and what each DSN is
|
|
# used for.
|
|
|
|
# --- FerretDB + its backing PostgreSQL (DocumentDB flavor) ---
|
|
# FerretDB 2.x forwards these same credentials to the Mongo wire protocol
|
|
# (see search/README.md "How FerretDB auth works"), so this pair is the
|
|
# database password for all projected chat content. Generate it like the
|
|
# others above - no default is supplied and compose refuses to start without
|
|
# it.
|
|
FERRETDB_PG_USER=REPLACE_ME_ferretdb_user
|
|
FERRETDB_PG_PASSWORD=REPLACE_ME_ferretdb_password
|
|
FERRETDB_PG_DB=postgres
|
|
|
|
# --- chat_search_db (new, dedicated PostgreSQL 17 + pgvector) ---
|
|
# Non-default credentials at provisioning (PLAN.md decision 3) - nothing
|
|
# connects to this instance as `postgres`/`postgres` or reuses vectordb's
|
|
# myuser/mypassword.
|
|
CHAT_SEARCH_DB=chat_search
|
|
CHAT_SEARCH_BOOTSTRAP_USER=chat_search_admin
|
|
CHAT_SEARCH_BOOTSTRAP_PASSWORD=REPLACE_ME_bootstrap_password
|
|
CHAT_SEARCH_OWNER_PASSWORD=REPLACE_ME_owner_password
|
|
CHAT_SEARCH_WRITER_PASSWORD=REPLACE_ME_writer_password
|
|
CHAT_SEARCH_READER_PASSWORD=REPLACE_ME_reader_password
|
|
|
|
# --- ClickHouse ---
|
|
CLICKHOUSE_DB=chat_search
|
|
CLICKHOUSE_USER=chat_search
|
|
CLICKHOUSE_PASSWORD=REPLACE_ME_clickhouse_password
|
|
|
|
# --- Host port overrides (defaults already avoid every port used by the
|
|
# repo's other compose files - see search/README.md port map) ---
|
|
# FERRETDB_HOST_PORT=27021
|
|
# FERRETDB_DEBUG_HOST_PORT=8089
|
|
# FERRETDB_PG_HOST_PORT=5434
|
|
# CHAT_SEARCH_DB_HOST_PORT=5435
|
|
# CLICKHOUSE_HTTP_HOST_PORT=8123
|
|
# CLICKHOUSE_NATIVE_HOST_PORT=9000
|