5.2 KiB
5.2 KiB
Podman langfuse
- Podman langfuse
Setup langfuse Project
- Copy and rename this folder to active/container_langfuse
- Find and replace langfuse with the name of the service.
- Create the rootless user to run the podman containers
- Write the compose.yaml spec for your service
- Convert the compose.yaml spec to a quadlet
- Install the quadlet on the podman server
- Expose the quadlet service
- Install a backup service and timer
Install langfuse
Create the langfuse user
# SSH into your podman server as root
useradd langfuse
loginctl enable-linger $(id -u langfuse)
systemctl --user --machine=langfuse@.host enable podman-restart
systemctl --user --machine=langfuse@.host enable --now podman.socket
mkdir -p /home/langfuse/.config/containers/systemd
Write the langfuse compose spec
Edit the compose.yaml at active/container_langfuse/compose/compose.yaml
A Note on Volumes
Named volumes are stored at /home/langfuse/.local/share/containers/storage/volumes/.
Convert langfuse compose spec to quadlets
Run the following to convert a compose.yaml into the various .container files for systemd:
# Generate the systemd service
podman run \
--security-opt label=disable \
--rm \
-v $(pwd)/active/container_langfuse/compose:/compose \
-v $(pwd)/active/container_langfuse/quadlets:/quadlets \
quay.io/k9withabone/podlet \
-f /quadlets \
-i \
--overwrite \
compose /compose/compose.yaml
# Copy the files to the server
export PODMAN_SERVER=
scp -r active/container_langfuse/quadlets/. $PODMAN_SERVER:/home/langfuse/.config/containers/systemd/
ssh $PODMAN_SERVER chown -R langfuse:langfuse /home/langfuse/.config/containers/systemd/
Create any container-mounted directories
SSH into your podman server as root:
machinectl shell langfuse@
podman unshare
mkdir some_volume
# Chown to the namespaced user with UID 1000
# This will be some really obscure UID outside the namespace
# This will also solve most permission denied errors
chown -R 1000:1000 some_volume
Start and enable your systemd quadlet
SSH into your podman server as root:
machinectl shell langfuse@
systemctl --user daemon-reload
systemctl --user restart langfuse
# Enable auto-update service which will pull new container images automatically every day
systemctl --user enable --now podman-auto-update.timer
Expose langfuse
- If you need a domain, follow the DDNS instructions
- For a web service, follow the Caddy instructions
- Finally, follow your OS's guide for opening ports via its firewall service.
firewalld
# command to get current active zone and default zone
firewall-cmd --get-active-zones
firewall-cmd --get-default-zone
# command to open 443 on tcp
firewall-cmd --permanent --zone=<zone> --add-port=443/tcp
# command to open 80 and 443 on tcp and udp
firewall-cmd --permanent --zone=<zone> --add-port={80,443}/{tcp,udp}
# command to list available services and then open http and https
firewall-cmd --get-services
firewall-cmd --permanent --zone=<zone> --add-service={http,https}
Backup langfuse
Follow the Borg Backup instructions
Upgrade langfuse
Upgrade Quadlets
Upgrades should be a repeat of writing the compose spec and installing the quadlets
export PODMAN_SERVER=
scp -r quadlets/. $PODMAN_SERVER$:/home/langfuse/.config/containers/systemd/
ssh langfuse systemctl --user daemon-reload
ssh langfuse systemctl --user restart langfuse
Uninstall
# Stop the user's services
systemctl --user disable podman-restart
podman container stop --all
systemctl --user disable --now podman.socket
systemctl --user disable --now podman-auto-update.timer
# Delete the user (this won't delete their home directory)
# userdel might spit out an error like:
# userdel: user langfuse is currently used by process 591255
# kill those processes and try again
userdel langfuse
Notes
SELinux
https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/
:z allows a container to share a mounted volume with all other containers.
:Z allows a container to reserve a mounted volume and prevents any other container from accessing.