Langfuse #2447

Name of the Script

Langfuse

Script Type

CT (LXC Container)

Script path

No response

Where does it run?

None

Does this script support arm64?

arm64 not tested

Tested on

• Proxmox VE
• Incus

📋 Script Details

App: Langfuse, an open-source LLM engineering platform (tracing, evaluations, prompt management, metrics). Created May 2023, actively maintained, over 35,000 GitHub stars, tagged release source archives. Initial target: v4.63.0.

• Upstream: https://github.com/langfuse/langfuse
• Self-hosting docs: https://langfuse.com/self-hosting
• Object storage: https://github.com/seaweedfs/seaweedfs

Script type: CT (LXC), bare-metal, no Docker or Docker Compose. Files: ct/langfuse.sh, install/langfuse-install.sh, json/langfuse.json.

• Builds the web and worker applications from the official release tarball, with Node.js 24, the pnpm version the release declares, and the Rust toolchain its native worker addon needs.
• Installs PostgreSQL 17, ClickHouse (unclustered migrations), Redis and a single-node SeaweedFS S3 service natively, each as a systemd service.
• Keeps databases, event storage and worker health on loopback; the web interface listens on port 3000.
• Keeps configuration in /opt/langfuse_data/.env, outside the replaceable source directory; the notes cover backups and taking a container snapshot before updating.
• On first start, upstream's LANGFUSE_INIT_* variables create the admin account, a Default project and its API keys. The admin login comes from var_admin_email (default admin@example.com) and var_admin_pass (generated when empty). They are saved to ~/langfuse.creds, then the one-time values are removed from .env. Sign-up stays disabled.
• Updates are health-gated: the version marker only advances after migrations and both health checks pass. SeaweedFS and golang-migrate are updated from their own releases.
• The migration unit only wants, not requires, the local PostgreSQL, ClickHouse, Redis and SeaweedFS units, so any of them can be replaced by an existing server configured in .env.
• Defaults: 4 CPU, 16 GiB RAM, 100 GB disk, unprivileged Debian 13. During the source build the container peaked at 11 GiB including page cache.
• Media uploads and batch exports are not configured by default; they need a client-reachable S3 endpoint.

Upstream sources inspected: web/Dockerfile, worker/Dockerfile, docker-compose.yml, the release's package manifests and entrypoints, native Rust addon requirements, and the PostgreSQL/ClickHouse migration scripts. Langfuse's documented deployment uses containers, so this keeps the equivalent native packaging.

Testing: nested Proxmox VE 9.2.21 (amd64), local checkout of the candidate branch (steveonjava/ProxmoxVED langfuse-native-lxc, 080a14a) with core 1ed2485, mode=mydefaults and a 30 GB disk override.

• Install: 25.5 min. All services active; only port 3000 is reachable from outside the container. The supplied admin email and password were used as given, and the login and API keys in ~/langfuse.creds (mode 600) work. Sign-up is refused and .env keeps no LANGFUSE_INIT_* values. The password appears only in the creds file (helper log, container files and journal checked).
• OTLP ingest and v2 readback, single-count usage and cost, and S3 event storage passed. Wrong passwords, wrong API keys and anonymous S3 access were rejected.
• Restarting PostgreSQL, ClickHouse, Redis or SeaweedFS left Langfuse running and healthy.
• Updates: already current (13 s, nothing touched); SeaweedFS and golang-migrate only (54 s, Langfuse untouched); forced full rebuild (11 min; .env, S3 identity and creds file unchanged; marker advanced only after the health checks).
• Reboot: web ready in about 13 s, earlier traces still readable.
• External Redis: with .env pointed at another Redis and redis-server masked, Langfuse started and kept working, including after a reboot.
• A deleted API key stays deleted after a restart.

Contract tests also cover failed builds and failed health checks not advancing the version marker, and invalid admin email or password input falling back to the default email or a generated password. arm64 and Incus were not tested.