Langfuse

cpln helm install RELEASE_NAME oci://ghcr.io/controlplane-com/templates/langfuse \
  --version 1.2.1 --gvc GVC_NAME \
  --set langfuse.auth.secretName=AUTH_SECRET_NAME \
  --set objectStore.aws.bucket=YOUR_BUCKET_NAME \
  --set objectStore.aws.region=us-east-1 \
  --set objectStore.aws.cloudAccountName=YOUR_CLOUD_ACCOUNT_NAME \
  --set objectStore.aws.policyName=YOUR_IAM_POLICY_NAME \
  --set postgres.credentials.password='YOUR-POSTGRES-PASSWORD' \
  --set redis.auth.password='YOUR-REDIS-PASSWORD' \
  --set clickhouse.config.password='YOUR-CLICKHOUSE-PASSWORD'

objectStore:
  provider: aws # Options: aws, gcp
  aws:
    bucket: my-langfuse-bucket
    region: us-east-1
    cloudAccountName: my-langfuse-cloudaccount # Control Plane Cloud Account — keyless S3 access
    policyName: my-langfuse-policy # pre-created AWS IAM policy scoped to the bucket above
  gcp:
    bucket: my-langfuse-bucket
    credentialsSecretName: my-langfuse-gcs-credentials # REQUIRED prerequisite dictionary secret when provider is gcp: accessKeyId, secretAccessKey

langfuse:
  publicUrl: "" # custom domain WITH scheme, e.g. https://langfuse.example.com; empty = the platform canonical endpoint

  web:
    image: langfuse/langfuse:3.225.2
    minReplicas: 2 # Keep at 2+ for zero-downtime rolling deploys
    maxReplicas: 5
    resources:
      minCpu: 500m
      maxCpu: 1000m
      minMemory: 1Gi
      maxMemory: 2Gi

  worker:
    image: langfuse/langfuse-worker:3.225.2
    replicas: 1
    resources:
      minCpu: 250m
      maxCpu: 500m
      minMemory: 512Mi
      maxMemory: 1Gi

  auth:
    secretName: my-langfuse-auth # REQUIRED prerequisite dictionary secret — create it BEFORE installing (see Prerequisites)
    disableSignup: true # false opens self-service registration to anyone who can reach the UI
    organizationName: Langfuse # organization created for the first-run admin

publicAccess:
  enabled: true # false keeps the UI reachable only from inside the GVC
internalAccess:
  type: same-gvc # options: none, same-gvc, same-org, workload-list
  workloads: [] # used with workload-list, e.g. //gvc/GVC_NAME/workload/WORKLOAD_NAME

postgres:
  image: postgres:18
  resources:
    minCpu: 250m
    maxCpu: 1
    minMemory: 512Mi
    maxMemory: 1Gi
  credentials: # the chart writes these into the secret named below — nothing for you to create
    username: langfuse
    password: change-me-langfuse-db
    database: langfuse
  config:
    credentialsSecretName: my-langfuse-db-credentials # secret names are org-wide — give each release its own
  volumeset:
    capacity: 10 # initial capacity in GiB (minimum is 10)

redis:
  image: redis:7.4
  resources:
    minCpu: 100m
    maxCpu: 400m
    minMemory: 256Mi
    maxMemory: 512Mi
  auth:
    password: change-me-langfuse-redis
  volumeset:
    capacity: 10 # initial capacity in GiB (minimum is 10)

clickhouse:
  image: clickhouse/clickhouse-server:25.10
  resources:
    minCpu: 1
    maxCpu: 2
    minMemory: 2Gi
    maxMemory: 4Gi
  config:
    password: change-me-langfuse-clickhouse
    database: langfuse
  volumeset:
    capacity: 10 # initial capacity in GiB (minimum is 10)

curl https://YOUR_LANGFUSE_ENDPOINT/api/public/health

curl -X POST https://YOUR_LANGFUSE_ENDPOINT/api/public/ingestion \
  -H "Content-Type: application/json" \
  -u "YOUR_PUBLIC_KEY:YOUR_SECRET_KEY" \
  -d '{
    "batch": [{
      "id": "event-1",
      "type": "trace-create",
      "timestamp": "2026-01-01T00:00:00.000Z",
      "body": {
        "id": "my-first-trace",
        "name": "my-first-trace",
        "input": "Hello",
        "output": "Hello back"
      }
    }]
  }'

cpln volumeset snapshot create RELEASE_NAME-pg-vs --gvc GVC_NAME --snapshot-name NAME
cpln volumeset snapshot get RELEASE_NAME-pg-vs --gvc GVC_NAME

postgres:
  backup:
    enabled: false
    image: ghcr.io/controlplane-com/backup-images/postgres-backup:18.1.0 # tag 18.1.0 = Postgres 18, 17.1.0 = Postgres 17
    schedule: "0 2 * * *"   # daily at 2am UTC
    provider: aws # Options: aws, gcp, or minio
    aws:
      bucket: my-postgres-bucket
      region: us-east-1
      cloudAccountName: my-s3-cloud-account
      policyName: my-postgres-backup-policy # bucket-scoped IAM policy
      prefix: postgres/backups # folder name where your backups will be stored

langfuse.auth.nextAuthSecret was removed in 1.1.0. Put it in the prerequisite dictionary secret
named by langfuse.auth.secretName (key: nextAuthSecret) — see the README.