LobeHub Integration¶

Connect LobeHub to stdapi.ai as its OpenAI-compatible backend. Chat, vision, image generation, and knowledge-base embeddings all run through Amazon Bedrock with a single connection.

About LobeHub¶

🔗 Links: Website | GitHub | Documentation

LobeHub (formerly LobeChat) is an open-source, self-hosted AI chat platform with a ChatGPT-like interface, a plugin/agent marketplace, and a built-in knowledge base for retrieval-augmented chat.

Key Features:

• Modern chat UI - Multi-session, multi-agent chat with Markdown, code, and file rendering
• Knowledge base - Upload documents and search them with semantic retrieval
• Vision and image generation - Analyze images in chat and generate new ones with the AI Image tool
• Single provider model - One "OpenAI" connection covers chat, vision, image generation, and embeddings
• Real accounts - Email/password (or SSO) registration, not a shared access code

Why LobeHub + stdapi.ai?¶

%%{init: {'flowchart': {'htmlLabels': true}} }%%
flowchart LR
  lobehub["<img src='../styles/logo_lobehub.svg' style='height:64px;width:auto;vertical-align:middle;' /> LobeHub"] --> stdapi["<img src='../styles/logo.svg' style='height:64px;width:auto;vertical-align:middle;' /> stdapi.ai"]
  stdapi --> bedrock["<img src='../styles/logo_amazon_bedrock.svg' style='height:64px;width:auto;vertical-align:middle;' /> Amazon Bedrock"]

Connect Your Own Instance¶

Point any running LobeHub instance—wherever you host it—at your stdapi.ai gateway. Nothing below requires the AWS sample in Part 2.

Prerequisites¶

Configuration¶

LobeHub is configured through environment variables. Unlike Open WebUI, LobeHub has no per-feature connection settings: one "OpenAI" provider covers chat, vision, image generation, and embeddings.

ENABLED_OPENAI    = "1"
OPENAI_API_KEY    = YOUR_STDAPI_KEY
OPENAI_PROXY_URL  = https://YOUR_STDAPI_URL/v1
OPENAI_MODEL_LIST = "-all,+anthropic.claude-sonnet-4-5-20250929-v1:0=Claude Sonnet 4.5<200000:vision:fc>,+stability.stable-image-core-v1:1=Stable Image Core<4096:imageOutput>"

OPENAI_MODEL_LIST both selects which models appear in the UI and tags their capabilities (vision, fc for tool calling, imageOutput), following LobeHub's model list syntax. Any model can be swapped for another Bedrock model available through stdapi.ai, as long as its capability tags match its modality.

Set the default models for chat and background tasks separately:

DEFAULT_AGENT_CONFIG = "model=anthropic.claude-sonnet-4-5-20250929-v1:0;provider=openai"
SYSTEM_AGENT         = "default=openai/amazon.nova-micro-v1:0"
DEFAULT_FILES_CONFIG = "embedding_model=openai/cohere.embed-v4:0"

• DEFAULT_AGENT_CONFIG — the default assistant's chat/vision model
• SYSTEM_AGENT — a fast, low-cost model for background tasks (topic naming, translation)
• DEFAULT_FILES_CONFIG — the embedding model backing the knowledge base

LobeHub calls POST /v1/chat/completions for chat and vision (see Chat Completions API), POST /v1/embeddings for the knowledge base (see Embeddings API), and POST /v1/images/generations for the AI Image tool (see Images Generations API).

For the full reference, see LobeHub's environment variables documentation.

Voice (TTS/STT)¶

LobeHub has no server-side environment variable for the default voice provider. In an agent's settings, under Text-to-Speech/Speech-to-Text, select OpenAI Audio — it reuses the same stdapi.ai connection already configured, with no extra key needed.

Two gateway-side details make that pairing more comfortable than it is upstream:

• Reading a long answer aloud takes one request. /v1/audio/speech accepts up to 100,000 characters — 24× the upstream limit — and speaks long input as it is synthesized rather than after the whole job finishes, so an essay-length reply needs no client-side splitting. Past 3,000 characters it needs a bucket for the serving region, except on generative voices, which reach 20,000 without one.
• Transcription can be cheaper. Naming amazon.nova-2-sonic-v1:0 as the speech-to-text model transcribes through Amazon Nova Sonic, the lowest-cost option here; it returns punctuated text with no timestamps, for recordings up to 10 minutes.

SSO and Authentication¶

LobeHub supports SSO providers (Google, GitHub, Microsoft, AWS Cognito, and others) and restricting registration to specific email domains via AUTH_ALLOWED_EMAILS / AUTH_DISABLE_EMAIL_PASSWORD. See LobeHub's authentication environment variables.

Deploy the Full Stack on AWS¶

The Terraform sample below is one worked example of a credible AWS deployment, not the only architecture that works. stdapi.ai's gateway is a normal HTTP service, and LobeHub can run wherever you already operate it—your own ECS, EKS, EC2, another cloud, or a laptop.

Architecture¶

The diagram below is the topology the sample builds: LobeHub sits behind a public load balancer with its own self-hosted Postgres database, while the stdapi.ai gateway has no public endpoint of its own.

%%{init: {'flowchart': {'htmlLabels': true, 'nodeSpacing': 20, 'rankSpacing': 40, 'subGraphTitleMargin': {'top': 8, 'bottom': 10}}} }%%
flowchart TB
  user["👤 Your users<br/>(browser)"]

  subgraph public["Your VPC · public subnets"]
    alb["<img src='../styles/logo_amazon_load_balancing.svg' style='height:40px;width:auto;vertical-align:middle;' /> Application Load Balancer<br/>fronts LobeHub only"]
  end

  subgraph private["Your VPC · private app subnets — no inbound route from the internet"]
    lobehub2["<img src='../styles/logo_lobehub.svg' style='height:40px;width:auto;vertical-align:middle;' /> LobeHub<br/>ECS Fargate"]
    stdapi2["<img src='../styles/logo.svg' style='height:40px;width:auto;vertical-align:middle;' /> stdapi.ai<br/>ECS Fargate"]
    postgres["ParadeDB Postgres<br/>ECS Fargate · EFS-backed"]
    valkey["<img src='../styles/logo_amazon_elasticache.svg' style='height:40px;width:auto;vertical-align:middle;' /> ElastiCache Valkey<br/>TLS + auth token"]
    egress["<img src='../styles/logo_amazon_vpc.svg' style='height:40px;width:auto;vertical-align:middle;' /> NAT gateways · one per AZ<br/>+ free S3 gateway endpoint"]
  end

  subgraph regional["AWS service endpoints · your account, the regions you configure"]
    bedrock2["<img src='../styles/logo_amazon_bedrock.svg' style='height:40px;width:auto;vertical-align:middle;' /> Amazon Bedrock"]
    s3["<img src='../styles/logo_amazon_s3.svg' style='height:40px;width:auto;vertical-align:middle;' /> Amazon S3<br/>SSE-KMS"]
  end

  user -->|"HTTPS or HTTP · restricted to your IP"| alb
  alb -->|"HTTP · private subnet"| lobehub2
  lobehub2 -->|"OpenAI API · API key<br/>Cloud Map private DNS<br/>no public endpoint"| stdapi2
  lobehub2 -->|"TLS · verify-full"| postgres
  lobehub2 -->|"TLS · auth token"| valkey
  lobehub2 -->|"S3 gateway endpoint<br/>IAM user access key"| s3
  stdapi2 --> egress
  egress -->|"HTTPS · SigV4"| bedrock2
  stdapi2 -->|"S3 gateway endpoint · task role"| s3

Two things stand out. LobeHub is the only service with a public address — the gateway resolves entirely through AWS Cloud Map private DNS, so no third party, and no public listener of its own, sits between your users and the models. And Amazon S3 is the one destination both applications reach directly through the account's S3 gateway endpoint rather than the NAT gateways, each under its own credential: LobeHub's static IAM user key for its uploads bucket, the gateway's task role for its own bucket of temporary multimodal objects.

What Each AWS Service Does Here¶

Why This Sample Self-Hosts Postgres¶

LobeHub's server DB mode requires ParadeDB's pg_search extension, and neither Amazon RDS nor Aurora PostgreSQL can load it — shared_preload_libraries on both engines is restricted to an AWS allow-list that does not include it, and the migration that enables the extension is unconditional, so LobeHub refuses to start without it. This sample therefore runs the official paradedb/paradedb image on ECS Fargate with its data directory on Regional EFS: one task, replaced stop-before-start on every deployment, because Postgres does not detect two postmasters sharing the same data directory. The sample's README, "The database: why this sample does not use Aurora", has the full mechanism, the alternatives considered, and what running Postgres on EFS does and does not cost you.

Security Measures in This Flow¶

• Authentication — LobeHub signs in its own users; every call it makes to the gateway carries a stdapi.ai API key that Terraform generates and injects as an ECS secrets entry, never a plain environment variable.
• Encryption in transit — HTTPS to the ALB when a domain and certificate are configured (plain HTTP otherwise, restricted to the deployer's IP), private-subnet HTTP from the ALB to LobeHub, TLS with an auth token to Valkey, and HTTPS with SigV4 from the gateway to Amazon Bedrock and S3. The Postgres hop is TLS too: Terraform creates a private certificate authority, issues a server certificate for the database's private DNS name — delivered to the container as a KMS-encrypted SSM SecureString parameter, never as a file on the shared volume — and LobeHub connects with sslmode=verify-full trusting that one authority, which makes the connection authenticated rather than merely encrypted.
• Encryption at rest — SSE-KMS on both S3 buckets, an encrypted Valkey replication group, and a KMS-encrypted, transit-encrypted EFS volume behind the self-hosted Postgres.
• Least privilege — each ECS task assumes its own role; the ALB's security group admits only the deployer's current IP, not the open internet; LobeHub's S3 access runs through a dedicated IAM user scoped to one bucket and one KMS key, because LobeHub's own S3 client needs a static access key and cannot assume the task role.
• Content policy — a Bedrock guardrail configured on the gateway applies to chat, vision and image generation alike, since LobeHub reaches all three through the same connection.
• Data handling — the gateway is stateless and holds request bodies in memory only; LobeHub's own content — chat history, uploaded files, knowledge-base embeddings — lives in the Postgres and S3 resources this sample creates, not in a service operated by LobeHub or stdapi.ai.

What's Included¶

Deploy LobeHub + stdapi.ai together with production infrastructure:

📦 stdapi-ai/samples/getting_started_lobehub

What's included:

• LobeHub on ECS Fargate, server DB mode
• stdapi.ai gateway connected to Amazon Bedrock, exposed as LobeHub's single "OpenAI" provider
• Self-hosted ParadeDB PostgreSQL (pg_search + pgvector) on EFS — see above
• Amazon S3 for file, avatar and knowledge-base uploads, private and SSE-KMS encrypted, served through presigned URLs
• ElastiCache Valkey for cache and sessions
• HTTPS with ALB on your own domain
• All environment variables pre-configured

Deploy:

git clone https://github.com/stdapi-ai/samples.git
cd samples/getting_started_lobehub/terraform
tofu init
tofu apply

Manual steps after apply:

• First account — register through the UI; there is no pre-provisioned admin user, unlike the n8n sample
• Image generation model — verify the model appears in the AI Image tool's model picker; this wiring was not exercised against a live deployment while building the sample

What It Costs to Run¶

Check a model's price before routing traffic to it with GET /model_pricing. Turning on COST_TRACKING puts a per-request cost on each usage entry — estimated from published AWS prices, not read back from your invoice — and is off by default.

What to Watch¶

The gateway writes one structured request (or request_stream for streamed chat) event per call, carrying the request id, path, status code, execution_time_ms, the model that served it, and the AWS-billed token, character or second counts recorded in its nested usage list. Turning on CLOUDWATCH_METRICS republishes those same counts as flat CloudWatch EMF metrics in the stdapi namespace, dimensioned by Model — with a second [Model, Currency] set for the Cost metric — so a dashboard can plot token consumption without parsing the JSON logs.

fields Model, InputTokens, OutputTokens
| filter _aws.CloudWatchMetrics is not null
| stats sum(InputTokens) as input_tokens, sum(OutputTokens) as output_tokens, count(*) as calls by Model
| sort input_tokens + output_tokens desc

For the prompts and completions themselves rather than metadata, turn on Amazon Bedrock's own model invocation logging, which stays off by default and is configured entirely on the AWS side.

Next Steps¶