Langfuse on Cloudron - Community Package

[LoudLemur]

Langfuse: community package now available

TL;DR: Langfuse is an open-source LLM observability platform. It captures the traces and generations from your AI apps — prompts, completions, model, token usage, latency and cost — so you can actually see what your LLM calls are doing. Now packaged for Cloudron and ready to install. Built and tested on Cloudron 9.x; unofficial and community-maintained.

Links

• Project homepage: https://langfuse.com
• Upstream repo: https://github.com/langfuse/langfuse
• 🧱 Cloudron package repo: https://github.com/OrcVole/langfuse-cloudron

Self-hosted, so there's no public demo to click — once installed it has a full web UI at your chosen domain, behind your Cloudron login. (Screenshot below.)

---

How to install

Community packages aren't in the App Store, so install via the CLI or easily as explained here:

Installation

• Click on the Add custom app drop down top right in the App Store and choose Community app:
• Then paste in the CloudronVersions.json URL into the box that pops up:

# recommended: install the published community build from the versions URL
cloudron install \
  --versions-url https://raw.githubusercontent.com/OrcVole/langfuse-cloudron/main/CloudronVersions.json \
  --location langfuse.example.com

# or pin the prebuilt image directly (digest is in CloudronVersions.json)
cloudron install \
  --image ghcr.io/orcvole/langfuse-cloudron@sha256:3e1388815ef1d0faecd9f4571e174d8ffa0e2d2a01a658119629c62d5e501dbb \
  --location langfuse.example.com

# or build it yourself from the repo
git clone https://github.com/OrcVole/langfuse-cloudron.git
cd langfuse-cloudron
cloudron build
cloudron install --image your-registry/langfuse:latest --location langfuse.example.com

Minimums: 5 GiB RAM (ClickHouse is the main consumer; a 4 GiB constrained option is documented). Addons used: localstorage, postgresql, redis, oidc, and sendmail (optional). It also claims one extra subdomain for trace-media presigned URLs — Cloudron prompts for it during install. Needs box version 9.1.0+.

First run: sign in with your Cloudron account (OIDC SSO). Create a project, then copy your public and secret API keys from the Langfuse UI (Settings → API Keys) for your SDKs or the OTLP endpoint. The trace-encryption key is generated for you and preserved across updates and restores — you never have to manage it.

---

For users

Why try it: if you're building anything with LLMs and can't see what your prompts, completions, costs and latencies actually are, Langfuse is the open-source answer — self-hosted, on your own box.

What you get out of the box:

• Trace and generation capture from the Langfuse SDKs (Python/JS) or any OpenTelemetry/OTLP client — prompts, completions, model, tokens, cost, latency.
• Evals, datasets, prompt management and dashboards layered on top of those traces.
• Cloudron-specific wins: SSO through your Cloudron login, automatic backups (the bundled ClickHouse, the trace media and the secrets all ride along), one-click updates with your encryption key preserved, and all state under /app/data.

Good fit if you run AI apps and want self-hosted observability instead of shipping traces to a SaaS. Probably not for you if you only need basic request logging, or if you specifically need the enterprise/EE features — this ships the MIT core only.

---

🧰 For packagers: what we learned

What helped

• Cloudron's postgresql and redis addons cover two of Langfuse's four stores out of the box, so only ClickHouse and S3 needed bundling.
• localstorage gives /app/data backup and restore for free — the bundled ClickHouse and MinIO data ride along with it, no custom backup hook needed.

What was tricky and how we solved it

• Langfuse ships musl (Alpine) Node and Prisma engine binaries, but the Cloudron base is glibc. Because the ELF interpreter is per-binary, the two coexist: we run the upstream musl Node and musl Prisma engines in place via an isolated musl loader, with PRISMA_*_ENGINE pointed at version-agnostic paths so Prisma doesn't try to re-detect the platform.
• ClickHouse defaulted to listening on all interfaces — removed the docker-related config so it binds localhost only.
• MinIO collided with ClickHouse on a port; moved MinIO to alternate ports.
• A bootstrap script used a bashism (&>) but /bin/sh is dash — run it with bash, not sh.

Still rough and open questions

• Memory sizing: ClickHouse is the swing factor. We default to 5 GiB; real-world footprint reports would be very welcome.

---

️ For the Cloudron team

Maintenance burden: Langfuse is very actively developed and releases often, so expect regular version bumps — but the build takes a single LANGFUSE_VERSION arg, so a rebump is one line plus a rebuild.

Why it would suit the App Store: LLM observability is a hot category with real demand, the upstream is clean with official Docker images, ingestion is the vendor-neutral OTLP standard, and the core is MIT.

Friction worth knowing about: the versions-url install path silently requires packagerName in the manifest (it's stricter than the documented schema and fails install without it); and the httpPorts contract (manifest key = the runtime env var that holds the subdomain FQDN) took some trial and error to get right.

---

For the app's developers and contributors

A few low-effort things that help packagers a lot:

• Document the musl-vs-glibc assumption explicitly — that the Node and Prisma binaries are musl surprises anyone packaging onto a glibc base.
• Keep the single-encryption-key and single-data-directory model; it's what makes backup/restore clean.
• Keep tagging releases and publishing the changelog so we can track update triggers.

Package source and PRs welcome here: https://github.com/OrcVole/langfuse-cloudron. Happy to co-maintain.

---

Unlocks

Once it's running, you can:

• Point any LLM app's OpenTelemetry exporter or Langfuse SDK at your own instance and watch traces and generations land in real time.
• Track token usage and cost per model, feature or user across all your AI apps — fully self-hosted, nothing leaves your box.

Synergies

Pairs nicely with other Cloudron apps:

• Langfuse + Open WebUI: Open WebUI's built-in OpenTelemetry export lands infrastructure traces in Langfuse over TLS (point OTEL_EXPORTER_OTLP_ENDPOINT at the Langfuse OTLP path with OTEL_OTLP_SPAN_EXPORTER=http); for rich per-generation tracing, use Open WebUI's Pipelines Langfuse filter.
• Langfuse + your own AI code: any app or script using the Langfuse Python/JS SDK — RAG pipelines, agents, batch jobs — gets a full trace and generation tree, including model, prompt and token usage.

---

Feedback, bug reports, and "works on my install" confirmations all welcome below.

[LoudLemur]

Also note the earlier work of @lanhild

https://github.com/Lanhild/langfuse-cloudron

[LoudLemur]

Update: hardening pass complete, production-proven, and one correction on backups

A few days on from the original post, the package has been through a full integration and hardening pass on a live Cloudron box. Most of this is good news. There is also one correction to a claim in the original that is important enough to lead with.

️ Correction: bundled-ClickHouse backup needs care (a fix is in progress)

The original post said that /app/data backup "just works, no custom backup hook needed." That holds right up until ClickHouse happens to be running a background merge during the backup snapshot.

Here is the race. ClickHouse continuously creates and deletes temporary merge directories under its store (tmp_merge_*, tmp_insert_*, tmp_fetch_*). Cloudron's rsync syncer walks that tree, and if one of those directories disappears between enumeration and read, readTree receives null and crashes on .sort(). The part that matters: that crash aborts the entire server backup run, not only Langfuse. Every app scheduled after it is left on the previous night's snapshot. The failure is timing-dependent, so it appears intermittently with no configuration change on your side.

This affects any ClickHouse-backed package (Plausible, PostHog, SigNoz, and others), so we have filed it upstream as a platform robustness issue: https://forum.cloudron.io/topic/15663/backup-task-crashes-when-a-clickhouse-app-deletes-a-temp-merge-dir-mid-snapshot. A single null-guard before the sort would fix it for every affected app.

Until that lands, the workaround (full detail in KNOWN-ISSUES.md:

• Exclude Langfuse from the automatic backup schedule so a racy run cannot abort the others, and back it up out of band.
• One correction to the obvious workaround: Cloudron will not back up a stopped app, so "stop the app, then back it up" is not a valid path. A quiesced backup has to be a filesystem-level snapshot taken outside the platform, or you simply re-run the schedule, since it is a timing collision and usually clears on the next attempt.

The real fix is the next release. Version 0.2.0 moves the ClickHouse store to a persistentDir and backs it up as a consistent logical dump through backupCommand and restoreCommand, which removes the race structurally, because the syncer never walks the live store at all. It is scoped and tracked, and it gets its own backup-and-restore round-trip gate before it ships.

What is new since the original

• A full hardening pass on the live instance, covering the code, configuration and dependency surface, container capabilities, the network surface, the authentication surface, and secrets at rest and in transit. Verdict: pass. The write-up is here: SECURITY.md. In short: the internal services (ClickHouse and the worker) are unreachable from outside; the only surface open without a login is /api/public/*, which is API-key gated by design; secrets are 0600; and the encryption key is byte-identical across both update and restore.
• Production-proven from the public package: installed from the versions-url exactly as any operator would, OIDC single sign-on confirmed end to end, presigned trace-media working through the proxy, update and backup-restore both preserving the encryption key, and memory measured under sustained ingestion (peak around 2.6 GiB, with the 5 GiB default holding comfortably).

Integration note: agentgateway

If you are considering wiring agentgateway's own traces into Langfuse, it will not work on agentgateway 1.3.1, and the cause is not on the Langfuse side. Its config.tracing OTLP exporter sends cleartext even when the endpoint is https://, and Cloudron's TLS-terminating proxy rejects that with a 400. Langfuse accepts the identical payload over TLS without complaint. agentgateway simply will not negotiate TLS for trace export, and there is no configuration option to change that. Filed upstream: [agentgateway issue — link]. Open WebUI and the Langfuse SDKs both handle TLS correctly, so the integrations described in the original post work as written.

What is next

Version 0.2.0 is the ClickHouse backup rework described above. Source, issues and pull requests are here: https://github.com/OrcVole/langfuse-cloudron. Real-world memory-footprint reports and "works on my install" confirmations remain very welcome.