RAGFlow

RAGFlow is an open-source Retrieval-Augmented Generation (RAG) engine built on deep document understanding. It combines robust document layout parsing (PDF, Word, spreadsheets, slides, images, and more) with a configurable retrieval pipeline so you can ground LLM answers in your own knowledge base with traceable citations.

What's included

This app deploys the full self-hosted RAGFlow stack in one shot:

RAGFlow server (infiniflow/ragflow:v0.26.4) — the web UI, HTTP API, admin server, and task executor. This is the version-pinned image RAGFlow ships as the lightweight variant since v0.22 (no bundled embedding models).
Elasticsearch 8.11.3 — the document/vector engine used for full-text and hybrid search over parsed document chunks. A one-shot ragflow-es-init helper container runs before it to fix ownership of the data directory (Elasticsearch's image runs as uid 1000, but Docker auto-creates bind-mount directories as root; without this step Elasticsearch crash-loops on first install and the whole stack never comes up).
MySQL 8.0 — relational metadata store (users, datasets, chat sessions, configuration). The rag_flow database is created automatically via MYSQL_DATABASE on first boot.
MinIO — S3-compatible object storage for uploaded documents and generated artifacts.
Valkey (Redis-compatible) 8.0.2 — cache and task queue for the ingestion pipeline.

Models

No LLM or embedding model is bundled or hard-coded into this deployment. After installing, open Settings → Model Providers in the RAGFlow UI and add an Ollama provider pointing at your existing Ollama server on this instance:

Base URL: http://ollama-nvidia:11434
Fallback (if the container-name route doesn't resolve): http://172.18.0.1:11434

Admin bootstrap and public-exposure sequence (read before exposing)

This app installs with self-registration ON by default so you can create the first (admin) account. Follow this sequence exactly:

Install and wait for ragflow-server to report healthy.
Visit the app on the LAN (http://<tipi-local-domain-or-ip>), register the first account — this becomes the admin account — and confirm you can sign in and reach the dashboard.
Open this app's settings in the Runtipi dashboard and turn Enable Self-Registration OFF, then save. This re-applies the app config with RAGFLOW_REGISTER_ENABLED=false, which is translated internally to RAGFlow's REGISTER_ENABLED=0.
Only after step 3 is confirmed, assign a public domain (ragflow.alexzaw.dev) and enable Traefik exposure from the dashboard.

Do not skip step 3 before going public — leaving self-registration on for an internet-facing instance lets anyone create an account.

Session/JWT signing secret

A random 32-byte hex value is generated at install time and passed as RAGFLOW_SECRET_KEY, which RAGFlow uses directly (common/settings.py: init_secret_key()) to sign session cookies and JWTs, as long as it's at least 32 characters — ours is 64 hex characters. If this field were ever left empty, RAGFlow's own fallback still applies: it auto-generates a secret and persists it in Redis (ragflow:system:secret_key), so sessions survive container restarts either way. The explicit field is stronger because it doesn't depend on Redis data surviving a wipe/reset.

Residual public-exposure risk

RAGFlow has no built-in 2FA and its own auth surface has not been independently audited by this deployment. Before assigning the public domain, put this app behind Cloudflare Access or an authentik forward-auth gate at the network layer, in addition to the registration lockdown above.

3.7 KiB Raw Blame History