LibreChat

Search the Azure Marketplace for LibreChat on Ubuntu 24.04 and choose your VM size.

Attach a network security group (NSG) that allows TCP 22 (SSH) from your management network. Also allow TCP 80 / 443 (the interface) from the networks that need it. In production, front port 80 with TLS (see Step 10).

RG="librechat-prod"; LOCATION="eastus"; VM_NAME="librechat-01" IMAGE_URN="sac1647283583153:librechat-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name lc-vnet --address-prefix 10.90.0.0/16 --subnet-name lc-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name lc-nsg az network nsg rule create -g "$RG" --nsg-name lc-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name lc-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:librechat-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_D2s_v5 --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name lc-vnet --subnet lc-subnet --nsg lc-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Docker runs the Compose stack. LibreChat listens on loopback 127.0.0.1:3080, and nginx fronts the interface on port 80 and proxies its streamed responses.

sudo systemctl is-active docker librechat nginx
sudo ss -tln | grep -E ':80 |127.0.0.1:3080' curl -s -o /dev/null -w 'GET /health -> HTTP %{http_code}\n' http://127.0.0.1/health

All three services report active, LibreChat is bound to 127.0.0.1:3080, nginx is bound to :80, and the health endpoint returns HTTP 200 through nginx.

Nothing sensitive ships in the image. MongoDB has zero users, so every instance starts at the sign-up screen. The per-instance info note in /root is root-only and holds no credential, only the resolved URL. The per-instance secrets file is also readable only by root.

echo "MongoDB user count: $(sudo docker exec librechat-mongodb mongosh LibreChat --quiet --eval 'db.users.countDocuments()')"
sudo grep -E '^LIBRECHAT_URL|^NOTE' /root/librechat-info.txt
sudo stat -c '%n perms=%a owner=%U:%G' /opt/librechat/.env

The user count is 0, so no admin exists. The note tells you to create your own account at the sign-up screen. The .env file that holds the per-instance secrets is 600 root:root.

Open http://<vm-ip>/ in your browser. No administrator ships and registration is open, so LibreChat shows its sign-up screen.

Select Sign up, enter a Name, your Email and a strong Password, confirm the password, and submit. The first account you create is yours, so pick a real password.

After you sign up, LibreChat opens the chat workspace, with the model and endpoint selector at the top and the message box ready.

LibreChat is provider-neutral, so you choose which models to use. Open the endpoint and model selector at the top of the chat. It lists providers such as OpenAI, Anthropic, Google and any custom OpenAI-compatible endpoint.

Pick a provider and add your API key when prompted. Alternatively, configure a custom endpoint that points at a hosted or local model server.

You manage your keys and account preferences from Settings, reached from the menu by your account at the bottom of the sidebar. Once a provider is connected, select one of its models in the chat and send a prompt.

docker --version nginx -v sudo docker compose -f /opt/librechat/docker-compose.yml ps
sudo docker image ls --format '{{.Repository}}:{{.Tag}} {{.Size}}' | grep -E 'librechat|mongo|meili'

Docker runs the three-container Compose stack, nginx fronts it, and the librechat-api, librechat-mongodb and librechat-meilisearch containers all report Up.

LibreChat data (users, conversations, uploads) lives in Docker named volumes captured into the image. The first-boot service keeps every instance current.

sudo docker volume ls --format '{{.Name}}' | grep librechat systemctl is-enabled librechat-firstboot.service apt-mark showhold

The librechat_mongodb, librechat_meili, librechat_uploads, librechat_logs and librechat_images volumes hold the data. The first-boot service has already run once and disabled itself on this instance, and there are no held packages, so the OS security baseline is intact.

The baked images are present, so the stack starts immediately while the first-boot pull fetches any newer release.

nginx already fronts LibreChat on port 80 and is ready for TLS. Point a DNS record at your VM, then obtain a certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot installs the certificate, rewrites the nginx server block for TLS, and sets up automatic renewal. LibreChat is then served over HTTPS.

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for LibreChat. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes approximately one to two minutes after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud LibreChat Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=librechat-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched:

• LibreChat 0.8 on Ubuntu 24.04: SSH login user ubuntu

The first-boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you log in for the first time.

ssh <login-user>@<public-ip>
sudo cat /root/librechat-credentials.txt

The output is a plain text file containing the LibreChat URL, the login email (admin@example.com) and the password. Copy these values somewhere secure.

From the same SSH session, confirm that the deployment is healthy. The health endpoint is open:

curl -fsS -o /dev/null -w 'health HTTP %{http_code}\n' http://127.0.0.1/health

A health HTTP 200 response confirms that the full stack (nginx, the LibreChat server, MongoDB and Meilisearch) is serving.

Open a web browser and go to http://<public-ip>/. LibreChat shows its sign-in page. Enter the email and password from /root/librechat-credentials.txt and select Continue.

The sign-in page is served on first boot with a per-instance login and registration disabled.

After you sign in, you reach the chat interface. The first-boot service set LibreChat's domain to the instance's own address automatically, so the app works immediately on its launch address.

The conversation interface offers one UI for many model providers, with conversation search and presets.

The image ships no model provider API keys, so you must connect at least one provider before you can chat. Select Select a model at the top of the chat and choose a provider, for example OpenAI, Anthropic, or a custom OpenAI-compatible endpoint. Enter your API key when prompted. Keys you enter in the UI are encrypted at rest with this instance's unique key.

For AWS Bedrock, give the instance an IAM role with Bedrock access and configure the Bedrock endpoint.

To use a private model server in the same VPC (for example an Ollama or vLLM instance), point a custom endpoint at its address. Prompts then never leave your account.

You can also set provider defaults server-side in /opt/LibreChat/.env and /opt/LibreChat/librechat.yaml. After editing, restart the service with sudo systemctl restart librechat.

LibreChat includes an Agent Marketplace for building and sharing AI agents across categories. Open it from the left sidebar.

The Agent Marketplace is where you discover and use AI agents.

Meilisearch provides conversation search. Use the search box in the sidebar once you have some conversations.

By default, open registration is disabled, so the instance is not open to the world on launch. To let users self-register, set ALLOW_REGISTRATION=true in /opt/LibreChat/.env and restart. To add a user from the command line without enabling registration, run:

cd /opt/LibreChat && sudo -u librechat npm run create-user -- <your-email> "<full name>" <username> --email-verified=true

For any production deployment, serve LibreChat over HTTPS so that session tokens and prompts cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

The following steps assume that a DNS record points your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d librechat.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, set the domain so that LibreChat generates correct links, then restart:

sudo sed -i 's|^DOMAIN_CLIENT=.*|DOMAIN_CLIENT=https://<your-domain>|; s|^DOMAIN_SERVER=.*|DOMAIN_SERVER=https://<your-domain>|' /opt/LibreChat/.env
sudo systemctl restart librechat

LibreChat keeps its state in MongoDB and uploaded files under /opt/LibreChat. Back up both together:

sudo mongodump --db LibreChat --archive=<backup-dir>/librechat-mongo-$(date +%F).archive
sudo tar -czf <backup-dir>/librechat-files-$(date +%F).tgz -C /opt/LibreChat uploads

Ship both artifacts to an Amazon S3 bucket or another object store. The database and application tiers are on their own EBS volumes, so you can also take coordinated EBS snapshots.

Ubuntu's unattended-upgrades is enabled by default for kernel and package updates. To upgrade LibreChat itself, follow the upgrade guidance at https://www.librechat.ai/docs.

For larger deployments, decouple LibreChat from the single-instance pattern:

• Move MongoDB to Amazon DocumentDB or a managed MongoDB and update MONGO_URI in /opt/LibreChat/.env
• Run Meilisearch on its own instance and point MEILI_HOST at it
• Put the web tier behind an Application Load Balancer with sticky sessions and scale horizontally
• Serve static assets through Amazon CloudFront

The official LibreChat documentation at https://www.librechat.ai/docs covers each of these.