# RAGFlow

RAGFlow is an open-source Retrieval-Augmented Generation (RAG) engine built on
deep document understanding. It combines robust document layout parsing (PDF,
Word, spreadsheets, slides, images, and more) with a configurable retrieval
pipeline so you can ground LLM answers in your own knowledge base with
traceable citations.

## What's included

This app deploys the full self-hosted RAGFlow stack in one shot:

- **RAGFlow server** (`infiniflow/ragflow:v0.26.4`) — the web UI, HTTP API,
  admin server, and task executor. This is the version-pinned image RAGFlow
  ships as the lightweight variant since v0.22 (no bundled embedding models).
- **Elasticsearch 8.11.3** — the document/vector engine used for full-text and
  hybrid search over parsed document chunks. A one-shot `ragflow-es-init`
  helper container runs before it to fix ownership of the data directory
  (Elasticsearch's image runs as uid 1000, but Docker auto-creates bind-mount
  directories as root; without this step Elasticsearch crash-loops on first
  install and the whole stack never comes up).
- **MySQL 8.0** — relational metadata store (users, datasets, chat sessions,
  configuration). The `rag_flow` database is created automatically via
  `MYSQL_DATABASE` on first boot.
- **MinIO** — S3-compatible object storage for uploaded documents and
  generated artifacts.
- **Valkey (Redis-compatible) 8.0.2** — cache and task queue for the ingestion
  pipeline.

## Models

No LLM or embedding model is bundled or hard-coded into this deployment.
After installing, open **Settings → Model Providers** in the RAGFlow UI and
add an **Ollama** provider pointing at your existing Ollama server on this
instance:

- Base URL: `http://ollama-nvidia:11434`
- Fallback (if the container-name route doesn't resolve): `http://172.18.0.1:11434`

## Admin bootstrap and public-exposure sequence (read before exposing)

This app installs with **self-registration ON** by default so you can create
the first (admin) account. Follow this sequence exactly:

1. Install and wait for `ragflow-server` to report healthy.
2. Visit the app on the LAN (`http://<tipi-local-domain-or-ip>`), register the
   first account — this becomes the admin account — and confirm you can sign
   in and reach the dashboard.
3. Open this app's settings in the Runtipi dashboard and turn **Enable
   Self-Registration** OFF, then save. This re-applies the app config with
   `RAGFLOW_REGISTER_ENABLED=false`, which is translated internally to
   RAGFlow's `REGISTER_ENABLED=0`.
4. Only after step 3 is confirmed, assign a public domain
   (`ragflow.alexzaw.dev`) and enable Traefik exposure from the dashboard.

Do not skip step 3 before going public — leaving self-registration on for an
internet-facing instance lets anyone create an account.

## Session/JWT signing secret

A random 32-byte hex value is generated at install time and passed as
`RAGFLOW_SECRET_KEY`, which RAGFlow uses directly (`common/settings.py:
init_secret_key()`) to sign session cookies and JWTs, as long as it's at
least 32 characters — ours is 64 hex characters. If this field were ever
left empty, RAGFlow's own fallback still applies: it auto-generates a secret
and persists it in Redis (`ragflow:system:secret_key`), so sessions survive
container restarts either way. The explicit field is stronger because it
doesn't depend on Redis data surviving a wipe/reset.

## Residual public-exposure risk

RAGFlow has no built-in 2FA and its own auth surface has not been
independently audited by this deployment. Before assigning the public
domain, put this app behind Cloudflare Access or an authentik forward-auth
gate at the network layer, in addition to the registration lockdown above.

## Links

- Source: https://github.com/infiniflow/ragflow
- Docs: https://ragflow.io/docs