81 lines
3.7 KiB
Markdown
81 lines
3.7 KiB
Markdown
# RAGFlow
|
|
|
|
RAGFlow is an open-source Retrieval-Augmented Generation (RAG) engine built on
|
|
deep document understanding. It combines robust document layout parsing (PDF,
|
|
Word, spreadsheets, slides, images, and more) with a configurable retrieval
|
|
pipeline so you can ground LLM answers in your own knowledge base with
|
|
traceable citations.
|
|
|
|
## What's included
|
|
|
|
This app deploys the full self-hosted RAGFlow stack in one shot:
|
|
|
|
- **RAGFlow server** (`infiniflow/ragflow:v0.26.4`) — the web UI, HTTP API,
|
|
admin server, and task executor. This is the version-pinned image RAGFlow
|
|
ships as the lightweight variant since v0.22 (no bundled embedding models).
|
|
- **Elasticsearch 8.11.3** — the document/vector engine used for full-text and
|
|
hybrid search over parsed document chunks. A one-shot `ragflow-es-init`
|
|
helper container runs before it to fix ownership of the data directory
|
|
(Elasticsearch's image runs as uid 1000, but Docker auto-creates bind-mount
|
|
directories as root; without this step Elasticsearch crash-loops on first
|
|
install and the whole stack never comes up).
|
|
- **MySQL 8.0** — relational metadata store (users, datasets, chat sessions,
|
|
configuration). The `rag_flow` database is created automatically via
|
|
`MYSQL_DATABASE` on first boot.
|
|
- **MinIO** — S3-compatible object storage for uploaded documents and
|
|
generated artifacts.
|
|
- **Valkey (Redis-compatible) 8.0.2** — cache and task queue for the ingestion
|
|
pipeline.
|
|
|
|
## Models
|
|
|
|
No LLM or embedding model is bundled or hard-coded into this deployment.
|
|
After installing, open **Settings → Model Providers** in the RAGFlow UI and
|
|
add an **Ollama** provider pointing at your existing Ollama server on this
|
|
instance:
|
|
|
|
- Base URL: `http://ollama-nvidia:11434`
|
|
- Fallback (if the container-name route doesn't resolve): `http://172.18.0.1:11434`
|
|
|
|
## Admin bootstrap and public-exposure sequence (read before exposing)
|
|
|
|
This app installs with **self-registration ON** by default so you can create
|
|
the first (admin) account. Follow this sequence exactly:
|
|
|
|
1. Install and wait for `ragflow-server` to report healthy.
|
|
2. Visit the app on the LAN (`http://<tipi-local-domain-or-ip>`), register the
|
|
first account — this becomes the admin account — and confirm you can sign
|
|
in and reach the dashboard.
|
|
3. Open this app's settings in the Runtipi dashboard and turn **Enable
|
|
Self-Registration** OFF, then save. This re-applies the app config with
|
|
`RAGFLOW_REGISTER_ENABLED=false`, which is translated internally to
|
|
RAGFlow's `REGISTER_ENABLED=0`.
|
|
4. Only after step 3 is confirmed, assign a public domain
|
|
(`ragflow.alexzaw.dev`) and enable Traefik exposure from the dashboard.
|
|
|
|
Do not skip step 3 before going public — leaving self-registration on for an
|
|
internet-facing instance lets anyone create an account.
|
|
|
|
## Session/JWT signing secret
|
|
|
|
A random 32-byte hex value is generated at install time and passed as
|
|
`RAGFLOW_SECRET_KEY`, which RAGFlow uses directly (`common/settings.py:
|
|
init_secret_key()`) to sign session cookies and JWTs, as long as it's at
|
|
least 32 characters — ours is 64 hex characters. If this field were ever
|
|
left empty, RAGFlow's own fallback still applies: it auto-generates a secret
|
|
and persists it in Redis (`ragflow:system:secret_key`), so sessions survive
|
|
container restarts either way. The explicit field is stronger because it
|
|
doesn't depend on Redis data surviving a wipe/reset.
|
|
|
|
## Residual public-exposure risk
|
|
|
|
RAGFlow has no built-in 2FA and its own auth surface has not been
|
|
independently audited by this deployment. Before assigning the public
|
|
domain, put this app behind Cloudflare Access or an authentik forward-auth
|
|
gate at the network layer, in addition to the registration lockdown above.
|
|
|
|
## Links
|
|
|
|
- Source: https://github.com/infiniflow/ragflow
|
|
- Docs: https://ragflow.io/docs
|