Langfuse LLM Observability Observability · Langfuse 4.56.0 Launch on AWS

Configuration¶

This page shows where the Langfuse stack's configuration lives and how to change it safely. Make every change as root, then restart the langfuse service.

Where things live¶

Path	What it is
`/opt/langfuse/docker-compose.yml`	The Compose stack: services, pinned images, loopback ports and volumes.
`/etc/langfuse/langfuse.env`	Values for the stack: URL, passwords, encryption keys and first-project settings. Created on first boot and not overwritten afterwards. Root only.
`/etc/langfuse/admin.password`	The admin password created on first boot. Root only.
`/etc/langfuse/project-api.env`	The first project's public and secret keys. Root only.
`/etc/langfuse/redis.conf`	Redis password and settings, mounted read-only into Redis.
Docker named volumes	Postgres, ClickHouse, Redis and MinIO data. List them with `sudo docker volume ls`.

How settings reach the containers¶

The service runs docker compose with /etc/langfuse/langfuse.env as its environment file. Compose substitutes those values into the environment sections of docker-compose.yml. A container only receives the variables listed there, so a new line in langfuse.env alone has no effect.

To change a setting that is already listed, such as NEXTAUTH_URL, edit its value in langfuse.env. To add an upstream Langfuse setting that is not listed, add it to the environment section of langfuse-web (and of langfuse-worker if the worker needs it) in docker-compose.yml, then set the value in langfuse.env.

For example, to turn off self sign-up on the login page, add this line under langfuse-web → environment:

      AUTH_DISABLE_SIGNUP: ${AUTH_DISABLE_SIGNUP:-false}

and this line to /etc/langfuse/langfuse.env:

AUTH_DISABLE_SIGNUP=true

See the Langfuse self-hosting configuration for the settings Langfuse supports.

Apply a change¶

sudo systemctl restart langfuse
systemctl is-active langfuse
curl -sS http://127.0.0.1:3000/api/public/health

The restart stops the containers and starts them again. Data in the volumes is kept. The UI can take a minute or two to answer again.

Change the URL¶

NEXTAUTH_URL is the address users open in their browser. It defaults to http://127.0.0.1:3000, which matches Session Manager port forwarding. If you put a reverse proxy in front of Langfuse, set it to the address users open through the proxy, then restart.

Reach Langfuse from other machines¶

Every port is published on 127.0.0.1 only. Choose one of these:

Session Manager port forwarding for your workstation, see Open the UI.
Run your instrumented application on the same instance.
A TLS reverse proxy on the instance that you install and manage, which forwards to 127.0.0.1:3000. Bind it to the instance's private address, use a certificate your clients trust, allow its port in the security group only from your applications' security groups, and update NEXTAUTH_URL.

Keep the data services private

Do not change the Compose ports to 0.0.0.0, and do not open ports 5432, 6379, 8123, 9000, 9090 or 9091 to anything. Only the web port should ever sit behind a proxy.

Things to leave alone¶

Do not change the generated passwords, SALT or ENCRYPTION_KEY in langfuse.env. The databases and stored data already use them.
Do not run docker compose pull, and do not change the image references. The stack uses pinned local images; a new Langfuse version comes as a new version of the image.
Do not edit /etc/langfuse/redis.conf. First boot checks that it matches the Redis password in langfuse.env and stops if it does not.

Last updated October 13, 2026 · Suggest an improvement