ragflow: add RAGFlow v0.26.4 RAG platform (ES engine, models via ollama)

apps/ragflow/metadata/description.md

@@ -0,0 +1,80 @@
+# RAGFlow
+
+RAGFlow is an open-source Retrieval-Augmented Generation (RAG) engine built on
+deep document understanding. It combines robust document layout parsing (PDF,
+Word, spreadsheets, slides, images, and more) with a configurable retrieval
+pipeline so you can ground LLM answers in your own knowledge base with
+traceable citations.
+
+## What's included
+
+This app deploys the full self-hosted RAGFlow stack in one shot:
+
+- **RAGFlow server** (`infiniflow/ragflow:v0.26.4`) — the web UI, HTTP API,
+  admin server, and task executor. This is the version-pinned image RAGFlow
+  ships as the lightweight variant since v0.22 (no bundled embedding models).
+- **Elasticsearch 8.11.3** — the document/vector engine used for full-text and
+  hybrid search over parsed document chunks. A one-shot `ragflow-es-init`
+  helper container runs before it to fix ownership of the data directory
+  (Elasticsearch's image runs as uid 1000, but Docker auto-creates bind-mount
+  directories as root; without this step Elasticsearch crash-loops on first
+  install and the whole stack never comes up).
+- **MySQL 8.0** — relational metadata store (users, datasets, chat sessions,
+  configuration). The `rag_flow` database is created automatically via
+  `MYSQL_DATABASE` on first boot.
+- **MinIO** — S3-compatible object storage for uploaded documents and
+  generated artifacts.
+- **Valkey (Redis-compatible) 8.0.2** — cache and task queue for the ingestion
+  pipeline.
+
+## Models
+
+No LLM or embedding model is bundled or hard-coded into this deployment.
+After installing, open **Settings → Model Providers** in the RAGFlow UI and
+add an **Ollama** provider pointing at your existing Ollama server on this
+instance:
+
+- Base URL: `http://ollama-nvidia:11434`
+- Fallback (if the container-name route doesn't resolve): `http://172.18.0.1:11434`
+
+## Admin bootstrap and public-exposure sequence (read before exposing)
+
+This app installs with **self-registration ON** by default so you can create
+the first (admin) account. Follow this sequence exactly:
+
+1. Install and wait for `ragflow-server` to report healthy.
+2. Visit the app on the LAN (`http://<tipi-local-domain-or-ip>`), register the
+   first account — this becomes the admin account — and confirm you can sign
+   in and reach the dashboard.
+3. Open this app's settings in the Runtipi dashboard and turn **Enable
+   Self-Registration** OFF, then save. This re-applies the app config with
+   `RAGFLOW_REGISTER_ENABLED=false`, which is translated internally to
+   RAGFlow's `REGISTER_ENABLED=0`.
+4. Only after step 3 is confirmed, assign a public domain
+   (`ragflow.alexzaw.dev`) and enable Traefik exposure from the dashboard.
+
+Do not skip step 3 before going public — leaving self-registration on for an
+internet-facing instance lets anyone create an account.
+
+## Session/JWT signing secret
+
+A random 32-byte hex value is generated at install time and passed as
+`RAGFLOW_SECRET_KEY`, which RAGFlow uses directly (`common/settings.py:
+init_secret_key()`) to sign session cookies and JWTs, as long as it's at
+least 32 characters — ours is 64 hex characters. If this field were ever
+left empty, RAGFlow's own fallback still applies: it auto-generates a secret
+and persists it in Redis (`ragflow:system:secret_key`), so sessions survive
+container restarts either way. The explicit field is stronger because it
+doesn't depend on Redis data surviving a wipe/reset.
+
+## Residual public-exposure risk
+
+RAGFlow has no built-in 2FA and its own auth surface has not been
+independently audited by this deployment. Before assigning the public
+domain, put this app behind Cloudflare Access or an authentik forward-auth
+gate at the network layer, in addition to the registration lockdown above.
+
+## Links
+
+- Source: https://github.com/infiniflow/ragflow
+- Docs: https://ragflow.io/docs