Skip to content
LibreChat AI Platform & Data · LibreChat 0.8.8 Launch on AWS

Configuration

This page lists the LibreChat paths, the MongoDB fields the image accepts, and the Bedrock permissions. /opt/sushi/docs/README.md on the instance is the package reference.

Where things live

Path What it is
librechat.service The application service. It runs as the non-login librechat user.
127.0.0.1:3080 Chat UI. Open http://localhost:3080 through a Session Manager forward.
/etc/librechat Configuration and the original identity.env. Back this directory up with application state.
/var/lib/librechat Uploads, images, application data, and logs.
~/.config/librechat/acceptance.json Optional owner email and password for the saved-chat check. Mode 0600. Created only when you run the check.
~/librechat-results Receipts from a successful saved-chat check.
/opt/sushi/docs/demo.sh Saved-chat check. Exit 3 means it is waiting for the browser.
/opt/sushi/bin/librechat-acceptance Reread of an earlier verified turn.
/opt/sushi/docs/README.md Image notes.
/opt/sushi/docs/DEMO.md Demo notes.
/usr/share/doc/librechat Application and Node license notices, plus sources/.

Program files are read-only. Conversation documents live in the external MongoDB database, not in /var/lib/librechat.

Database connection

sudo sushi-librechat configure prompts for the MongoDB URI and does not echo it. The URI must include the application database and the authentication source. Use TLS with certificate and hostname verification, and authenticate with SCRAM-SHA-256.

For a custom CA, the supported fields are only:

Field What it is
mongodb_uri The TLS connection string.
mongodb_ca_file Path to your PEM CA certificate.

Put them in a regular JSON file, mode 0600, owned by the administrator. Pass only the filename:

sudo sushi-librechat configure --connection-file <filename>

Do not put the URI on the command line. Wait until librechat.service is connected before sudo sushi-librechat create-owner.

Amazon Bedrock

The supplied model is amazon.nova-lite-v1:0 in us-east-1. The instance role needs:

  • bedrock:InvokeModel
  • bedrock:InvokeModelWithResponseStream

The account must have access to that model. The image has no static AWS credentials and no provider account. A prompt you send from the UI is a real model request.

Owner account

create-owner collects the email, name, username, and password in the shell. The password length is 16 to 128 characters. The name length is 3 to 80 characters. Public registration and social login stay off. A second run does not replace an administrator that already exists.

Artifact previews

Previews on this image are static.

  • HTML, SVG, Markdown, and Office previews show sanitized markup.
  • React, JSX, and TSX artifacts can be edited as source, copied, and downloaded. They do not run as an interactive preview.
  • Mermaid diagrams use the native renderer.
  • Sandpack and Nodebox interactive JavaScript execution are unavailable.
  • Artifact scripts, remote resources, and preview link navigation are unavailable. A preview can look different from an interactive upstream preview.
  • Downloads contain the source or the original attachment.

What this image does not include

Search, RAG, MCP servers, image-processing workflows, Redis, a MongoDB server, model weights, and a provider account are not part of this package. Do not follow upstream instructions that install those services onto this image.

Last updated November 1, 2026 · Suggest an improvement