Langfuse LLM Observability Observability · Langfuse 4.56.0 Launch on AWS

Operations¶

This page covers running Langfuse day to day: how it is secured, how to manage the stack, where logs go, what to back up, how updates work and how to get help.

Security model¶

Loopback only. Every Compose port, including the web UI and the data services, is published on 127.0.0.1. Nothing listens on a public interface.
Per-instance secrets. Database and service passwords, encryption keys, the admin password and the first project's API keys are created on first boot. The image contains none of them, and no database.
File permissions. /etc/langfuse is readable by root only. The ubuntu user cannot read the environment file, the admin password, the project keys or the Redis configuration.
Secrets off the command line. The Redis password lives in a mounted configuration file, not in process arguments.
No telemetry. TELEMETRY_ENABLED=false.

Keep the security group closed to inbound traffic, and connect with Session Manager or SSH restricted to your administrative range.

Manage the stack¶

sudo systemctl status langfuse
sudo systemctl restart langfuse
sudo systemctl stop langfuse

See the containers and their health:

sudo docker compose -f /opt/langfuse/docker-compose.yml \
  --env-file /etc/langfuse/langfuse.env ps

The first-boot service, sushi-langfuse-firstboot, runs before the stack on every boot. It creates the secrets only if langfuse.env is missing, and restores file permissions.

Logs¶

sudo journalctl -u langfuse --no-pager
sudo journalctl -u sushi-langfuse-firstboot --no-pager
sudo docker compose -f /opt/langfuse/docker-compose.yml \
  --env-file /etc/langfuse/langfuse.env logs --tail 100 langfuse-web langfuse-worker

Backups¶

Your traces, users and projects live in the Docker volumes, and the keys that open them live in /etc/langfuse. Back them up together: a volume without its langfuse.env cannot be read, and replacing the instance without the volumes loses your data.

Stop the stack, so the databases are consistent:
```
sudo systemctl stop langfuse
```
Take an EBS snapshot of the root volume, or archive the Langfuse volumes under /var/lib/docker/volumes/ together with /etc/langfuse/.
Start the stack again:
```
sudo systemctl start langfuse
```

Keep backups private. They contain every password and key of the stack.

Postgres 18

The stack runs Postgres 18. Do not restore a Postgres 17 data directory into it. Moving data from an older major version needs a dump and restore into a fresh database.

Updates¶

Ubuntu packages receive unattended security updates.
Langfuse and its services are not updated by apt, and you should not pull new container images. A new release comes as a new version of the image. There is no in-place upgrade: launch the new version, restore your volumes and /etc/langfuse if you want to keep your data, and point your applications at the new instance.

Support¶

Software Sushi supports the packaging, first-boot setup and this documentation. Email info@softwaresushi.com with your Langfuse version (shown by the health endpoint), what you ran and the error. Never include passwords, API keys or langfuse.env. Upstream Langfuse support is not included.

Last updated October 13, 2026 · Suggest an improvement