LibreChat

Last reviewed Aug 26, 2026 · 939 words

LibreChat is the ChatGPT clone you deploy when more than one person needs a chat UI and you want one API bill instead of a $20-per-seat ChatGPT Plus subscription each. Nothing else open source matches its provider coverage: OpenAI, Anthropic, Google, Azure, Bedrock, and any OpenAI-compatible endpoint, switchable per conversation. The price is that "one container" is not on the menu. A real install is 5 containers and a YAML file, and the YAML file is where 80% of your time goes.

The stack is five containers, and you want all of them

The compose file in the LibreChat repo brings up the API server, MongoDB for users and conversations, Meilisearch for conversation search, a pgvector Postgres for file embeddings, and a small rag_api service that does the chunking. People strip it to API plus Mongo to save RAM, then lose search and file upload and wonder why the product feels thin. Leave it whole. The full stack idles around the catalogue's 2 GB figure and is happy on a 4 GB VPS; it has no GPU requirement of its own because inference happens elsewhere.

The app listens on port 3080. Put a reverse proxy in front with TLS before anyone types a password, and never expose MongoDB (27017) or Meilisearch (7700) beyond the compose network, which the stock file already handles.

librechat.yaml does the work the .env only starts

The .env file holds secrets and switches; librechat.yaml defines what users actually see, and the LibreChat docs document every key in it. For a home lab the interesting block is endpoints.custom, because it is how local models arrive. Pointing it at Ollama on the host looks like this:

endpoints:
  custom:
    - name: "Ollama"
      apiKey: "ollama"
      baseURL: "http://host.docker.internal:11434/v1/"
      models:
        fetch: true
      titleConvo: true
      titleModel: "current_model"

fetch: true pulls the model list from Ollama at startup, so pulling a new model needs no LibreChat edit. The same shape works for LiteLLM, vLLM, OpenRouter, or a Groq key: anything that speaks the OpenAI API. Three things trip people: the file must be mounted into the container (the stock compose has the line commented out), host.docker.internal needs extra_hosts on Linux, and a YAML indentation slip fails silently to defaults rather than crashing.

Close registration and generate real secrets before day two

Registration is open by default so you can create your own account. Do that, then set ALLOW_REGISTRATION=false and restart. Invite family through the admin-side invite flow or by briefly reopening it. JWT_SECRET, CREDS_KEY, and CREDS_IV ship with example values in .env.example; replace them with output from openssl rand -hex 32 (and -hex 16 for the IV) or every stored API key in your database is encrypted with a key that is on GitHub.

For a group that already has an identity provider, LibreChat supports OpenID Connect, plus Google, GitHub, Discord, and LDAP. Turn ALLOW_SOCIAL_LOGIN on and email registration off, and the account problem disappears.

The bill is per token, and you decide who pays

Two models exist. You put your API keys in .env and everyone shares them, or you set an endpoint's key to user_provided and each person pastes their own in the UI. Shared keys are the pleasant choice for a household and the dangerous choice for anything larger, which is what the balance system is for: CHECK_BALANCE=true gives each user a token credit you top up, and conversations stop when it hits zero. A family using frontier models a few times a day lands in the single-digit dollars per month at last check; a teenager who discovers image generation does not. Set the balance. The wider cost-control patterns are in the self-hosted AI stack post, including routing cheap questions to a local model first.

Agents and RAG are free; the code sandbox is not

File upload with retrieval works out of the box once rag_api and pgvector are running, and the Agents builder (tools, file search, custom instructions, shareable across users) is part of the MIT-licensed app. Two features reach outside your box: web search needs a search provider key, and the Code Interpreter runs on LibreChat's own hosted sandbox service with a separate paid API key. Neither is required, and neither leaks your chat history, but "fully self-contained" stops at those 2 lines.

When Open WebUI is the better answer

If you run one machine, one user, and mostly local models, Open WebUI installs as a single container, discovers Ollama automatically, and you are chatting in 5 minutes. LibreChat earns its 5 containers when you have 3 or more users, need SSO, or want to switch between 4 paid providers in the same thread. Anyone weighing this against the hosted product should read the ChatGPT alternatives page first, because the honest answer for a solo user who never wants to touch YAML is still ChatGPT.

What I'd do

Full compose stack on a 4 GB box, Caddy in front with TLS, registration closed after my own account, real secrets generated. One custom endpoint for Ollama on the GPU machine, one Anthropic key and one OpenAI key shared, balances enabled at a modest monthly top-up per person. Update by pulling tags monthly and reading the release notes, because librechat.yaml schema changes do land a few times a year. Configured like that it has replaced 3 ChatGPT subscriptions in my house for a fraction of the cost, and nobody has noticed the difference except me.