rrvsh/pantheon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(nix): add librechat module and enable for server

Browse source 
WARNING: This commit includes new files and secrets modifications.
This commit is contained in:
Mohammad Rafiq 2025-07-09 03:42:33 +08:00
parent 16fb62f03b
commit 9e77ea8e65
No known key found for this signature in database
7 changed files with 134 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
flake.lock generated
View file

@ -471,6 +471,7 @@
"nixpkgs": "nixpkgs",
"nur": "nur",
"nvf": "nvf",
"rrvsh-nixpkgs": "rrvsh-nixpkgs",
"sops-nix": "sops-nix",
"stable-diffusion-webui-nix": "stable-diffusion-webui-nix",
"stylix": "stylix",
@ -478,6 +479,22 @@
"text": "text"
}
},
"rrvsh-nixpkgs": {
"locked": {
"lastModified": 1750146550,
"narHash": "sha256-vFNbONVWIdYBqlKZoJScDRjnQ/euDmVqgCL2ebnsu7U=",
"owner": "rrvsh",
"repo": "nixpkgs",
"rev": "d7fa95990fd890bbd17ca8361f5d4e4935512c75",
"type": "github"
},
"original": {
"owner": "rrvsh",
"ref": "librechat-module",
"repo": "nixpkgs",
"type": "github"
}
},
"sops-nix": {
"inputs": {
"nixpkgs": [

2
flake.nix
View file

@ -15,6 +15,8 @@
systems.url = "github:nix-systems/default";
# nixos-unstable provides a binary cache for all packages.
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
# My fork for random shit
rrvsh-nixpkgs.url = "github:rrvsh/nixpkgs/librechat-module";
# home-manager manages our user packages and dotfiles
home-manager = {
url = "github:nix-community/home-manager";

2
nix/lib/services.nix
View file

@ -41,7 +41,7 @@ in
server.ddns.domains = singleton (mkRootDomain cfg.domain);
server.web-servers.nginx.proxies = singleton {
source = cfg.domain;
target = "http://${config.hostname}:${toString cfg.port}";
target = "http://${config.networking.hostName}:${toString cfg.port}";
};
};

4
nix/manifest.nix
View file

@ -63,6 +63,10 @@
mysql.enable = true;
postgresql.enable = true;
};
web-apps = {
librechat.enable = true;
librechat.domain = "chat.bwfiq.com";
};
};
};
};

87
nix/modules/server/web-apps/librechat.nix Normal file
View file

@ -0,0 +1,87 @@
{
lib,
inputs,
config,
...
}:
let
inherit (lib.lists) singleton;
inherit (config.flake.lib.options) mkStrOption;
inherit (config.flake.lib.services) mkWebApp;
inherit (config.flake.paths) secrets;
in
{
flake.modules.nixos.default =
{ config, ... }:
let
cfg = config.server.web-apps.librechat;
upstreamCfg = config.services.librechat;
in
mkWebApp {
inherit config;
name = "librechat";
defaultPort = 3080;
persistDirs = singleton {
directory = upstreamCfg.dataDir;
inherit (upstreamCfg) user group;
};
extraOptions.mongodbURI = mkStrOption "mongodb://${config.networking.hostName}:27017/LibreChat";
extraConfig = {
sops.secrets = {
"librechat/creds_key".sopsFile = secrets + "/librechat.yaml";
"librechat/creds_iv".sopsFile = secrets + "/librechat.yaml";
"librechat/jwt_secret".sopsFile = secrets + "/librechat.yaml";
"librechat/jwt_refresh_secret".sopsFile = secrets + "/librechat.yaml";
"keys/gemini".sopsFile = secrets + "/keys.yaml";
"keys/openrouter".sopsFile = secrets + "/keys.yaml";
};
services.librechat = {
enable = true;
openFirewall = true;
inherit (cfg) port;
env = {
HOST = "0.0.0.0";
ALLOW_REGISTRATION = "true";
NO_INDEX = "true";
MONGO_URI = cfg.mongodbURI;
DOMAIN_CLIENT = cfg.domain;
DOMAIN_SERVER = cfg.domain;
ENDPOINTS = "anthropic,agents,google";
};
credentials = {
CREDS_KEY = config.sops.secrets."librechat/creds_key".path;
CREDS_IV = config.sops.secrets."librechat/creds_iv".path;
JWT_SECRET = config.sops.secrets."librechat/jwt_secret".path;
JWT_REFRESH_SECRET = config.sops.secrets."librechat/jwt_refresh_secret".path;
OPENROUTER_KEY = config.sops.secrets."keys/openrouter".path;
GOOGLE_KEY = config.sops.secrets."keys/gemini".path;
};
settings = {
version = "1.1.4";
cache = true;
endpoints.custom = [
{
name = "OpenRouter";
apiKey = "\${OPENROUTER_KEY}";
baseURL = "https://openrouter.ai/api/v1";
models.default = [ "meta-llama/llama-3-70b-instruct" ];
models.fetch = true;
titleConvo = true;
titleModel = "current_model";
modelDisplayLabel = "OpenRouter";
}
];
interface = {
privacyPolicy = {
externalUrl = "https://librechat.ai/privacy-policy";
openNewTab = true;
};
};
};
};
};
}
// {
imports = singleton "${inputs.rrvsh-nixpkgs}/nixos/modules/services/web-apps/librechat.nix";
};
}

5
secrets/keys.yaml
View file

@ -1,5 +1,6 @@
keys:
cloudflare: ENC[AES256_GCM,data:p2IISOuU/ShoifW5OFY/6Bi6PI0iIiQoBfnV512f2z84U9QS/KEhzA==,iv:5AkwtNAK8mD2DbvXCtTeNeIrpF/GIsSyOYxy8G4Jsqo=,tag:u2xJcRBR5WTMWdzupx4tbQ==,type:str]
gemini: ENC[AES256_GCM,data:GwXVBsQdLesgP6PUZJRrLO5u6jd6XYFv9vjNTsojOwaWlxkDeRos,iv:w6Uz6j/MfpgQdIRYqJCneWqTsA+JEsB/T3cySVY2k3c=,tag:JY+LDar1UzC6qLKLichKnQ==,type:str]
sops:
age:
- recipient: age12l33pas8eptwjc7ewux3d8snyzfzwz0tn9qg5kw8le79fswmjgjqdjgyy6
@ -11,7 +12,7 @@ sops:
T3VyZXZnaGZaMVBnVko2Tlc2S3FpdDQKRiHCOtkHKugfquQfYkk4o9SMtZlo1CqZ
3i9+9Z516KS1+ERTklBUzZDBRZISY0c2nluO+tn71wnKAMIxetKryQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-07-08T18:05:51Z"
mac: ENC[AES256_GCM,data:YkQqkKw+OEKFtORp+WDwclazCk166JndSstoiJYbpdAKLxvEQLdScaGin7j0fIoeTCY1CytzAHAUt8iraZeHscIkPdz/3WGPOa23dt56ZEd+rK/OL+XIuOCsbz08+yVWgJWeeEeMZ8IinwA46kVVYI3+p4FxDBDXBvhl9x7+CG4=,iv:YHmM2mk2fKwefydYV29eEMaXlyHVKwyDZAHCnbnKb3Y=,tag:Ksb8N/1pnzDGpyGj8Z0fhg==,type:str]
lastmodified: "2025-07-08T19:37:17Z"
mac: ENC[AES256_GCM,data:Yel+wX5FjCntqxbvStDGs/Zzbgh6Ht2/7DmV4Xu8R/rVzjzGoO4DziEjpzaTLNxXLXbjfdOuucU9YPmdqSlf9FpjiB488Fjn7GMP53V74c7RiYZq3s+vpVIdnkEA52xgYqPY6sOJAoujjHJM3uRYgOM0XwkKONBfF5FrO6WdbvU=,iv:wg5U1V94oPUSnjCgMewW6L/dftOPWOgQl9qLF6o8Gps=,tag:SMqKnAKJBjCGHjPanjDk4A==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2

20
secrets/librechat.yaml Normal file
View file

@ -0,0 +1,20 @@
librechat:
creds_key: ENC[AES256_GCM,data:sELKgqif9ec6VV0Q9OVk8IbUAI5noPtUB1b1WrPvxjDzJODd9YoJHWiH+N0vwORje5LiuzqZ/0Kn/UMdPfy3qw==,iv:SFFW+P0vxy4s6TkaAyCNLLXLIBrdi8oMkm7Q/Vec/yk=,tag:ZNC0vMdyh+S204Qr0itvnw==,type:str]
creds_iv: ENC[AES256_GCM,data:h8RHcW7zt8CnKrYDGxlN/H9Wim4KpLaiFl2E2AK+YJY=,iv:xRctbyBFprN6Y1Lvk08EpzZNXa0owYCph+wqcOAR/Gw=,tag:ZdA0ibjyH1Y6DAd23mfJRQ==,type:str]
jwt_secret: ENC[AES256_GCM,data:mXMi0EenuU1EIZWUyLE3wkVTouJk2QPXIKV38sfwbKfjdc28GgdsaWtunaSpD4uYBrWCv1rXq5qj18ohlAKs/g==,iv:ZWZWgYzVQh+kRN4+EEBFdWc4aWGq5IDtlEVde9mzS7I=,tag:BmWQN9yI92RHJMy/pt8rRg==,type:str]
jwt_refresh_secret: ENC[AES256_GCM,data:iw+/E0wb2Ih1iQOaCCXBN5tj98Z2CdpaJMYOiuoTanjW7bvJXGfVObXKTBTtRs1P4TzCc4qK7mes5Sa6oajBpg==,iv:3mr3PYAjJ3bncATgfSwEyrIM2YioSfSu38NUfDmk6zs=,tag:RIYJ1YBaQVpwAmlo3CKg2Q==,type:str]
sops:
age:
- recipient: age12l33pas8eptwjc7ewux3d8snyzfzwz0tn9qg5kw8le79fswmjgjqdjgyy6
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArcko2MmowTkpKaDJTdjZE
NVdzbklXZngxaHhrbkhGTXlCNDkzNml4dnlZCjRWOFZCSWRKenZzN0dhYXplVzh0
OVdaUnRkS2dIYklFS2dwUXVxaElxNkkKLS0tICtxZDV0a2hIaUM2NFBwOGwxcklz
YWJyU0VKRXFxT29TSjR1KzE0ZHJGQncKrX5Sujd617WgFDYA5r63K4ZwoJpP9m8M
xexbGVHAeSyWNjOG7x5A9gYC1/dG3NY2l5xoITn0NKi68ZEfGD/J3w==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-07-08T19:37:50Z"
mac: ENC[AES256_GCM,data:LBkUPMR8D8+IVUugWzK4a51d0lkGJqnG5D9EkHC4aGXcuSpxpxkbUDXWsqK3u1FxxfCnR87ZhD+UGd3OV6Wvsl9/v968eC/3jxuZALnOgUGcTyUayo8qLq1J6HEFUDoUoH2tk/SF0Cn2r34fkcUd1NtRdQX+C0Zsc8Tk0zIRA8U=,iv:aUvg409sogxRBgYzNECW5eH7GsSAsYY9AHWmL0UD6PA=,tag:0pMoXeuF6DLCyIdDVsPmGA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2