Getting started¶
Launch LibreChat, connect the external MongoDB database you manage, create the first owner, and sign in through a Session Manager tunnel.
You need: an AWS account that can subscribe on AWS Marketplace, launch
EC2, and start Session Manager; a reachable MongoDB deployment with TLS and
SCRAM-SHA-256; and permission to call Amazon Nova Lite in us-east-1. On
your workstation, install the AWS CLI and the Session Manager plugin.
1. Subscribe¶
Open the LibreChat listing, choose View purchase options, review the terms, and subscribe. When the subscription is active, choose Launch your software.
2. Launch the instance¶
On the EC2 launch page:
- Choose t3.large (8 GiB of memory), Ubuntu 24.04, x86_64.
- Under Configure storage, use an encrypted gp3 root volume of at least 40 GiB.
- Require IMDSv2.
- Attach an IAM instance profile that includes
AmazonSSMManagedInstanceCore. Add the Bedrock permissions in Prepare MongoDB and Bedrock before you send a chat. - Allow outbound access to Systems Manager, your MongoDB endpoint, and Amazon Bedrock. Leave inbound application ports closed.
- Choose Launch instance.
3. Connect¶
Wait until cloud-init and automatic first boot finish. First boot creates the encryption and session identity once. LibreChat then waits for your database configuration. An unconfigured status is expected until you finish step 5.
In the EC2 console, select the instance, choose Connect, then Session Manager, then Connect. Or:
The sudo -iu ubuntu line is run inside the Session Manager shell. The
published guide uses Session Manager for this connection.
4. Prepare MongoDB and Bedrock¶
Supply a MongoDB deployment you manage. This image does not create a database server or a database account.
- The deployment must be reachable from the instance.
- Use TLS, and verify the certificate and hostname. Do not turn certificate verification off. Use the TLS connection string your database provider supports.
- Authenticate with SCRAM-SHA-256.
- Put the application database name, and the authentication source your provider requires, in the MongoDB URI.
- The database user needs the permissions the application uses.
The supplied model is Amazon Bedrock, Amazon Nova Lite, model
amazon.nova-lite-v1:0, in us-east-1. The instance role must allow both
bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream for that
model, and the AWS account must have access to it. The image contains no
static AWS credentials.
5. Create the owner¶
Run these in the instance shell. configure prompts for the MongoDB URI and
does not echo it. Wait until the service has connected before you create the
owner.
sudo sushi-librechat configure
sudo systemctl status librechat.service --no-pager
sudo sushi-librechat create-owner
create-owner asks for an email, a name, a username, and a password.
The password must be 16 to 128 characters. The name must be 3 to 80
characters. Keep those values out of shell arguments, logs, screenshots, and
support mail.
Public registration and social login are disabled. If an administrator
already exists, create-owner leaves that account in place.
If the database needs a custom CA, put mongodb_uri and mongodb_ca_file in
a JSON file. mongodb_ca_file points at your PEM CA certificate. The file
must be a regular file, mode 0600, owned by the administrator. Pass only
the filename:
Do not put the URI in the command arguments.
6. Open the chat UI¶
On your workstation, run the published forward. It asks for the EC2 instance
ID and uses Region us-east-1. Leave the terminal open.
printf "EC2 instance ID: "
IFS= read -r LIBRECHAT_INSTANCE_ID
aws ssm start-session --region us-east-1 --target "$LIBRECHAT_INSTANCE_ID" \
--document-name AWS-StartPortForwardingSession \
--parameters '{"portNumber":["3080"],"localPortNumber":["3080"]}'
Open http://localhost:3080 and sign in with the owner account you created.
The service listens only on 127.0.0.1:3080. Keep the forwarded port on
localhost.
In the UI, select Bedrock / Amazon Nova Lite and start a new conversation that is not temporary. Sending a prompt makes a real model request and can incur Bedrock charges.
Artifact previews on this image are static. See Artifact previews before you rely on them.
7. Check a saved conversation¶
This check is optional. Switch to ubuntu. The Python command asks for the
owner email and password, writes ~/.config/librechat/acceptance.json as
mode 0600, and does not print the password. It refuses to replace a file
that is already there. Keep a correct file.
umask 077
python3 -c '
import getpass, json, os
from pathlib import Path
values = {"email": input("Owner email: "), "password": getpass.getpass("Owner password (hidden): ")}
path = Path.home() / ".config/librechat/acceptance.json"
path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with path.open("x") as stream:
os.fchmod(stream.fileno(), 0o600)
json.dump(values, stream)
stream.write("\n")
'
bash /opt/sushi/docs/demo.sh
That demo prepares a challenge and exits 3 while it waits for you to act in the browser. Exit 3 means the check is not finished. It is not a successful demo.
Send the printed challenge once, from a new non-temporary browser chat, using Bedrock / Amazon Nova Lite. Wait until the response is complete. Then run:
The CLI does not send a chat request. It reads the saved user and assistant
turn through the authenticated API and checks the challenge, the completion,
the parent message, and the model. Only a successful read prints
SUSHI_CUSTOMER_DEMO_PASSED. Receipts are saved under ~/librechat-results.
If the wait times out, the challenge is still there. Inspect the UI and run the verify command again before you send another challenge.
After a service restart or a reboot, reread an earlier verified turn without another model request:
That command needs an earlier successful receipt and no challenge still waiting. It checks saved message hashes. It does not turn an unfinished check into a success.
The listing usage text names this form for the same reread:
The getting-started page linked from the listing shows the
librechat-acceptance command above. These pages do not treat the two forms
as proven aliases.
Next, see Configuration for the files those commands use.
Last updated November 1, 2026 · Suggest an improvement