How to Self-Host LibreChat on Linux VPS for Production Use

Updated on Aug 22, 2026
Mila H
7 MINS READ
Table of Contents
Self-Host LibreChat on Linux VPS

If you want a private and multi-model AI workspace that you fully control, the best way is to self-host LibreChat on Linux VPS in a production-ready configuration. This gives you strict control over data, predictable costs, and the freedom to wire any AI provider or local model stack you need.

In this guide, you’ll learn how to self-host LibreChat on Linux VPS with Docker Compose, configure a secure .env file and docker-compose settings, and set up LibreChat behind HTTPS on a real domain.

VPS Requirements and Base Tools for LibreChat

To self-host LibreChat on Linux VPS in production, you must start with a fresh Linux VPS that meets some minimum specs:

  • OS: Ubuntu 22.04 or newer with SSH access and sudo.
  • Resources: At least 2 vCPU, 4 to 8 GB RAM, 20+ GB disk, especially if you also run RAG/Ollama on the same host.
  • Network: A public IP and a domain with an A record pointing to the VPS so you can self-host LibreChat on Linux VPS behind HTTPS.

If you need a reliable server to self-host LibreChat on Linux VPS, you can check PerLod's Linux VPS options.

Now you must prepare your VPS and install the required tools. First, run the system update and install the required packages:

Bash
sudo apt updatesudo apt upgrade -ysudo apt install curl git ca-certificates gnupg -y

Then install Docker and the Compose plugin from the official repo so you can reliably self-host LibreChat on Linux VPS using containers:

Bash
# Add Docker’s key and reposudo install -m 0755 -d /etc/apt/keyringscurl -fsSL https://download.docker.com/linux/ubuntu/gpg | \sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg echo \  "deb [arch=$(dpkg --print-architecture) \  signed-by=/etc/apt/keyrings/docker.gpg] \  https://download.docker.com/linux/ubuntu \  $(lsb_release -cs) stable" | \  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null sudo apt updatesudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

Add your user to the docker group, log out and log in, and verify:

Bash
sudo usermod -aG docker $USERdocker --versiondocker compose version

At this point, your Linux VPS can run containers, and you’re ready to self-host LibreChat on Linux VPS in a controlled way.

Step 1. Clone LibreChat and Set up Configuration

At this point, you must clone LibreChat and prepare configuration templates. To do this, run the commands below:

Bash
git clone https://github.com/danny-avila/LibreChat.gitcd LibreChat cp .env.example .envcp librechat.example.yaml librechat.yaml

The .env file holds server-level configuration, secrets, and provider keys, and the YAML file controls features, routes, and model providers. Together, they define how you self-host LibreChat on Linux VPS with the exact behavior you want.

For production use, you must customize both. For this purpose, proceed to the next steps.

Step 2. Configure LibreChat .env Settings

Open the .env and set the core runtime variables so LibreChat runs in production mode and listens safely when you self-host LibreChat on Linux VPS:

Bash
nano .env

Core Server and Domain Settings

Adjust the core server and domain settings:

Bash
# RuntimeNODE_ENV=productionHOST=0.0.0.0PORT=3080 # Domain (replace with your real domain)DOMAIN_CLIENT=https://chat.example.comDOMAIN_SERVER=https://chat.example.com

Key points:

  • NODE_ENV=production enables optimized builds and production-only behaviors, such as cache headers, logging changes, etc.
  • HOST=0.0.0.0 lets the API bind to all interfaces; the reverse proxy will front it.
  • DOMAIN_CLIENT and DOMAIN_SERVER must be set to your external HTTPS URL; otherwise, CORS and cookies may misbehave when you self-host LibreChat on Linux VPS behind Nginx or Traefik.

Database and Search Endpoints

For a simple Docker-based deployment, MongoDB and Meilisearch run as containers. When you self-host LibreChat on Linux VPS this way, wire them via internal service names:

Bash
# MongoDB (internal service name from compose)MONGO_URI=mongodb://mongodb:27017/LibreChat # MeilisearchMEILI_HOST=http://meilisearch:7700

This avoids hard-coding localhost and keeps your DB accessible only from inside the Docker network.

Authentication, Security, and Admin Panel

Production deployment needs strong secrets and controlled registration. You must generate proper keys and lock user creation:

Bash
# Sessions and JWT (examples – generate your own 32+ char secrets)SESSION_SECRET=$(openssl rand -hex 32)JWT_SECRET=$(openssl rand -hex 32) # Registration and securityALLOW_REGISTRATION=falseREQUIRE_EMAIL_VERIFICATION=trueDEBUG_LOGGING=falseCONSOLE_JSON=true

Recommendations:

  • Generate secrets with openssl rand -hex 32 and paste them into .env. Never commit these to Git.
  • Set ALLOW_REGISTRATION=false once you’ve created your admin account, so nobody can randomly sign up on your production system.
  • Disable noisy debug logging and use JSON logs for easier ingestion into tools like Loki or ELK.

If you use the bundled admin panel service, also configure:

Bash
ADMIN_PANEL_PORT=3090ADMIN_PANEL_SESSION_SECRET=$(openssl rand -hex 32)ADMIN_PANEL_URL=https://chat.example.com/admin

That ensures the admin UI and OAuth/SSO redirects work correctly with a separate admin panel.

AI Provider Keys and RAG Endpoints

Finally, add provider API keys so your LibreChat deployment can talk to models:

Bash
# Examples – fill in what you actually useOPENAI_API_KEY=sk-...ANTHROPIC_API_KEY=....GOOGLE_API_KEY=.... # Optional RAG backend if you run one as a serviceRAG_API_URL=http://rag_api:8000

Note: When you self-host LibreChat on Linux VPS, you can mix cloud providers such as OpenAI/Anthropic/Gemini with local engines like Ollama and vLLM by adding the corresponding keys and endpoints in .env plus librechat.yaml.

Step 3. Docker Compose File to Self-host LibreChat on Linux VPS

LibreChat’s default docker-compose.yml already defines core services, but for production you may want explicit resource limits, restart policies, and clean internal networking.

A simplified production-style file could look like this:

YAML
services:  librechat-api:    image: registry.librechat.ai/danny-avila/librechat-dev-api:latest    restart: always    env_file: .env    depends_on:      - mongodb      - meilisearch    ports:      - "3080:3080"    networks:      - librechat-net    deploy:      resources:        limits:          cpus: "1.5"          memory: 2G   mongodb:    image: mongo:7    restart: always    volumes:      - mongo_data:/data/db    networks:      - librechat-net   meilisearch:    image: getmeili/meilisearch:v1.6    restart: always    volumes:      - meili_data:/meili_data    networks:      - librechat-net networks:  librechat-net: volumes:  mongo_data:  meili_data:

With this compose file:

  • The API uses the production image and reads settings from .env to avoid duplicating config.
  • MongoDB and Meilisearch stay on a private librechat-net network, isolated from the internet.
  • restart: always helps the stack auto-recover after reboots or small failures.

Note: For customizations, including extra volumes, log mounts, or added services like Ollama, you can use docker-compose.override.yml so your changes don’t conflict with upstream updates.

Start the stack:

Bash
docker compose up -ddocker compose ps

Step 4. Configure Nginx Reverse Proxy for LibreChat

To expose your deployment with TLS, you can use Nginx. This is a safe step to self-host LibreChat on Linux VPS for real users.

Use the command below to install Nginx and the Certbot plugin on your server:

Bash
sudo apt install nginx certbot python3-certbot-nginx -y

Then, use the command below to create a site config with your desired text editor like nano:

Bash
sudo nano /etc/nginx/sites-available/librechat.conf

Add this config to the file with your registered domain name:

Bash
server {    listen 80;    server_name chat.example.com;     location / {        proxy_pass http://127.0.0.1:3080;        proxy_set_header Host $host;        proxy_set_header X-Real-IP $remote_addr;        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;        proxy_set_header X-Forwarded-Proto $scheme;    }}

Once you are done, enable the site and get a certificate:

Bash
sudo ln -s /etc/nginx/sites-available/librechat.conf /etc/nginx/sites-enabled/sudo nginx -tsudo systemctl reload nginxsudo certbot --nginx -d chat.example.com

Once this is done, you can access the LibreChat UI from:

Bash
https://chat.example.com

Create an account and log in:

Create LibreChat account

Now you reach your LibreChat deployment:

Access LibreChat UI

Hardening and Maintaining LibreChat on Linux VPS

To keep your self-hosted LibreChat healthy long-term, you can follow these best practices:

  • Backups: Regularly back up the mongo_data and meili_data volumes or use external MongoDB/Meili instances with managed backups.
  • Updates: Pull new images periodically with docker compose pull && docker compose up -d so your self-hosted LibreChat stays current.
  • Monitoring: Use Nginx and container logs into your existing stack to watch performance and errors.
  • Access control: Keep registration disabled, invite only known users, and consider putting LibreChat behind a VPN or SSO if you self-host LibreChat on Linux VPS for enterprises.

Tips: For centralized container logging, you can pair this LibreChat stack with Grafana Alloy and Loki using Docker. Check this guide on Centralized Docker Logging with Grafana Alloy and Loki.

Conclusion

Setting up a production-ready environment to self-host LibreChat on Linux VPS is mainly about a reliable VPS with Docker, a secure .env file, a clean docker-compose.yml, and Nginx with HTTPS in front. With those in place, you can self-host LibreChat safely, then add RAG, local models, multiple AI providers, and integrate it into your logging and security tools.

We hope you enjoy this guide. For more detailed information about remote Docker deployment, you can check the official LibreChat docs.

No. LibreChat itself runs fine on a CPU‑only Linux VPS with Docker; the main requirements are RAM, disk, and a stable network. You only need GPUs if you plan to host heavy local models on the same server instead of using cloud APIs.

Yes. You can create an admin account, disable open registration, and then invite users manually or connect SSO/OAuth.

Stop the stack, pull new images, then start it again. Keep your .env, librechat.yaml, and volumes healthy, and test changes in a staging VPS if you’re running LibreChat for a team.

Prev PostGitOps Deployment Pipeline: Self-Hosted ArgoCD on Kubernetes
Next PostSelf-Host Harbor Registry with Docker Compose, TLS, and Trivy
Category:Server Applications & Stacks
Tag:

We use cookies to run PerLod and to understand how the site is used. You can accept everything, or open Manage to turn individual categories off. Cookie policy.