Self-host LobeHub: a shared AI chat platform on your own model APIs

LobeHub (formerly LobeChat) is an open-source AI chat platform. It supports dozens of model providers, including OpenAI, Anthropic, Google and DeepSeek, and has multi-user accounts, chat history, file uploads, knowledge bases and agents. The interface is complete, which makes it a good shared AI entry point for a team or family.

The server version needs a database and file storage, and building it from scratch takes a lot of setup. Zenavo's LobeHub template packages all of it. This guide goes from deployment to backups. If you prefer a lighter single-container chat UI that only needs one domain, see Open WebUI.

The server, Zenavo and the model providers' APIs are billed separately. LobeHub doesn't provide models itself; chats go to the providers you configure.

What the template includes

Open the LobeHub template. After deployment the project has four services:

Service	What it does
lobehub	The app itself, image lobehub/lobehub:2.3.3, HTTP port 3210
postgresql	Accounts, chats, settings and encrypted API keys, with a full-text search extension (ParadeDB, PostgreSQL 17)
redis	Cache and sessions
rustfs	S3-compatible file storage for uploaded images and files; port 9000 is the S3 API, 9001 the admin console

The template recommends reserving 2 GB of memory. The database password, the sign-in encryption key (AUTH_SECRET) and the API key encryption key (KEY_VAULTS_SECRET) are all generated at deployment.

Prepare two domains

LobeHub needs two public addresses:

• App URL, such as https://chat.example.com, for opening LobeHub;
• File storage URL, such as https://files.example.com, which the browser accesses directly to upload and view images.

First add DNS A records for both subdomains pointing to the server. Then connect a Linux server to Zenavo, open the template, enter both URLs (without a trailing slash), choose the server and deploy.

Bind the domains

After deployment, bind each one:

1. On the lobehub service's Networking tab, bind chat.example.com to port 3210;
2. On the rustfs service's Networking tab, bind files.example.com to port 9000.

The domains must match the ones you entered at deployment. Once HTTPS is active, open https://chat.example.com. See Domains for the steps.

Port 9001 is RustFS's admin console. It doesn't need a public domain, and we don't recommend giving it one.

Register, then restrict sign-ups

Open the app and register the first account with an email and password.

By default the template lets anyone sign up. If this is for your team or family only, add the allowed emails or domains in the lobehub service's Variable, then save and restart:

AUTH_ALLOWED_EMAILS=example.com,friend@gmail.com

You can enter full email addresses or just domains, separated by commas. After that, emails not on the list can't sign up.

When you need email verification or password resets, set up SMTP:

SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=noreply@example.com
SMTP_PASS=your SMTP password
AUTH_EMAIL_VERIFICATION=1

With port 465, change SMTP_SECURE to true. Without SMTP, sign-up and login still work; you just can't send verification or password reset emails.

Connect models

There are two ways, and you can use both.

Everyone enters their own key. After logging in, open Settings → AI Service Provider, choose a provider, enter the API key, add a proxy URL if needed, and click Check. The key is encrypted with KEY_VAULTS_SECRET and stored in the database; other users can't see it.

The admin provides keys for everyone. Set provider keys in the lobehub service's Variable, and every user can use them directly without entering their own:

OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
DEEPSEEK_API_KEY=sk-...

For OpenAI-compatible providers or gateways, change the address with OPENAI_PROXY_URL, for example to point at your self-hosted New API, Magpie or LiteLLM gateway at https://api.example.com/v1, then have the gateway issue LobeHub its own key with a quota limit. To give LobeHub free live web search, add self-hosted SearXNG in the same project; to also reach a personal assistant from Telegram or Discord, pair it with OpenClaw.

Keys you provide for everyone are used by anyone who can log in, and spend your quota. Before setting them, restrict sign-ups as in the previous section.

About uploaded files

Uploaded images and files are stored in rustfs's lobe bucket. The template makes this bucket publicly readable so browsers can show images directly: anyone who knows a file's URL can open it without logging in. URLs contain a random path and can't be listed or searched, but don't upload sensitive files you wouldn't accept being opened from a link.

Images sent to models are converted to base64 and put directly in the request (the template sets LLM_VISION_IMAGE_USE_BASE64=1), so model providers don't need access to your file domain.

Back up

There are two parts to back up:

• postgresql: accounts, chats, settings and encrypted keys are all here. Back it up any time from its Backup & Restore tab, with no downtime, or set up automatic backups.
• rustfs: uploaded files. This is a volume backup, which requires the project to be stopped, so do it in a maintenance window.

One more thing to keep separately: KEY_VAULTS_SECRET in the lobehub service's variables. When you restore the database into a new deployment, you must use the same value, or the API keys stored in the database can't be decrypted. Don't change it after deployment.

A backup is only reliable once you've restored and checked it. For data that matters, also download a backup to keep.

Upgrade

The template pins lobehub/lobehub:2.3.3. Before upgrading, read LobeHub's release notes and back up postgresql, then go to the lobehub service's Settings → Source, change the image tag to the new version and deploy. The database schema migrates automatically on startup, so always back up before upgrading.

FAQ

Login redirects fail after the page opens? Check that the domain bound to lobehub exactly matches the app URL you entered at deployment, including https:// and with no trailing slash. If you changed the domain, update APP_URL (for the file storage address, S3_ENDPOINT) to the new address in the lobehub service's Variable, then restart.

Image uploads fail? Most likely files.example.com isn't bound to rustfs's port 9000, or its HTTPS certificate isn't active yet. Open the domain directly in your browser: if it connects (even if it shows an error message), the binding is correct.

AI replies are empty or fail? First click Check in Settings → AI Service Provider to confirm the key and model work. With a third-party proxy, check whether the address needs to end in /v1.

How big a server do I need? The template recommends reserving 2 GB of memory for LobeHub. With PostgreSQL, Redis and RustFS on top, use a server with 4 GB of memory or more. Model inference runs at the provider and doesn't use your server's CPU.

Start from the LobeHub template: prepare two domains, restrict sign-ups right after deploying, then connect your models.