Langfuse v3 LLM Observability and Tracing with Auto-SSL on Ubuntu

RECOMMENDED INSTANCE SIZING AND SECURITY GROUP SETUP

Minimum Instance Type: t3.xlarge (4 vCPU, 16 GB RAM, 50 GB gp3 root storage)

Recommended Production: m6i.xlarge, m7i.xlarge, or m6a.xlarge (4 vCPU, 16 GB RAM)

Security Group Inbound Rules:

Port 22 (TCP) - SSH administrative access (restrict to your IP or bastion CIDR)

Port 80 (TCP) - HTTP access and Let's Encrypt TLS verification (0.0.0.0/0)

Port 443 (TCP) - HTTPS encrypted web console and SDK ingestion API access (0.0.0.0/0)

Note: Internal services (Langfuse Web 3000, PostgreSQL 5432, ClickHouse 8123/9000, Redis 6379, MinIO 9000) are strictly isolated and must not be exposed externally.

RETRIEVING INITIAL CREDENTIALS On initial boot, the appliance automatically generates cryptographically random passwords, provisions the database tables, creates an initial organization, and generates your first project API keys. This initialization typically completes within 45 to 60 seconds.

Option A - Via SSH Terminal: Connect to your instance via SSH using your key pair: ssh -i /path/to/key.pem ubuntu@<INSTANCE_PUBLIC_IP>

Read the provisioned credentials file: cat /home/ubuntu/langfuse-credentials.txt

Option B - Via AWS Management Console: If you prefer not to SSH immediately, view the EC2 System Log:

Open the Amazon EC2 console.

Select your running instance.

Choose Actions > Monitor and troubleshoot > Get system log.

Locate the Langfuse initialization block displaying your Web Console URL, admin login, and generated project API keys.

ACCESSING THE WEB CONSOLE

Open a browser and navigate to: http://<INSTANCE_PUBLIC_IP>

Log in using the credentials from the credentials file:

Username: admin@example.com 

Password:

CONFIGURING A CUSTOM DOMAIN AND AUTOMATIC SSL (HTTPS) The image includes an automated TLS utility powered by Caddy. Before executing this setup, ensure your domain DNS A record points directly to your EC2 instance public IPv4 address.

SSH into the instance: ssh -i /path/to/key.pem ubuntu@<INSTANCE_PUBLIC_IP>

Run the SSL configuration helper: sudo langfuse-ssl <your-domain.com> [admin-email]

Example: sudo langfuse-ssl langfuse.example.com admin@example.com 

The helper provisions a Let's Encrypt certificate, updates the internal NEXTAUTH_URL environment setting, reloads Caddy, and enforces HTTPS. You can then access the interface securely at: https://<your-domain.com>

CONNECTING APPLICATION SDKS (PYTHON AND TYPESCRIPT) The appliance comes pre-seeded with a default organization and project. You can immediately send traces and spans using the pre-generated API keys found in /home/ubuntu/langfuse-credentials.txt.

Python SDK Setup: Install the SDK: pip install langfuse

Set environment variables in your application: export LANGFUSE_PUBLIC_KEY="pk-lf-..." export LANGFUSE_SECRET_KEY="sk-lf-..." export LANGFUSE_HOST="https://<your-domain.com>" (or "http://<INSTANCE_PUBLIC_IP>")

Example Python integration: from langfuse import Langfuse langfuse = Langfuse() trace = langfuse.trace(name="chat-completion") trace.update(output="LLM response")

TypeScript SDK Setup: Install the package: npm install langfuse

Configure client initialization: import { Langfuse } from "langfuse"; const langfuse = new Langfuse({ publicKey: "pk-lf-...", secretKey: "sk-lf-...", baseUrl: "https://<your-domain.com>" });

SERVICE MANAGEMENT AND MONITORING All application containers and reverse proxies are managed via standard systemd daemons:

Check overall stack service status: sudo systemctl status langfuse.service caddy.service

Check individual container states and health checks: sudo docker compose -f /opt/langfuse/docker-compose.yml ps

Restart the entire Langfuse stack: sudo systemctl restart langfuse.service

View live application and worker logs: sudo docker compose -f /opt/langfuse/docker-compose.yml logs -f langfuse-web sudo docker compose -f /opt/langfuse/docker-compose.yml logs -f langfuse-worker

Configuration environment file location: /opt/langfuse/.env