Self-host logtide

logtide README

How to install logtide

DB_PASSWORD, REDIS_PASSWORD, API_KEY_SECRET, PUBLIC_API_URL, STORAGE_ENGINE

# Create project directory
mkdir logtide && cd logtide

# Download docker-compose.yml and environment template
curl -O https://raw.githubusercontent.com/logtide-dev/logtide/main/docker/docker-compose.yml
curl -O https://raw.githubusercontent.com/logtide-dev/logtide/main/docker/.env.example
mv .env.example .env

# Edit .env with secure passwords
nano .env

# Start LogTide
docker compose up -d

# Add the LogTide Helm repository
helm repo add logtide https://logtide-dev.github.io/logtide-helm-chart
helm repo update

# Install LogTide
helm install logtide logtide/logtide --namespace logtide --create-namespace --set timescaledb.auth.password=<your-db-password> --set redis.auth.password=<your-redis-password>

How to configure logtide

• API_KEY_SECRETAPI key encryption secret (minimum 32 characters)

  API key encryption secret (minimum 32 characters)

• AUTH_RATE_LIMIT_LOGIN=20Max login attempts per window

  Max login attempts per window

• AUTH_RATE_LIMIT_WINDOW=900000 (15 min)Rate limit window in milliseconds

  Rate limit window in milliseconds

• CAPABILITY_DEFAULTS_JSONJSON object overriding capability defaults for every org (entitlement rows still win). Values: boolean, integer >= 0, or null for unlimited. Invalid JSON, unknown capability or wrong type aborts startup.

  JSON object overriding capability defaults for every org (entitlement rows still win). Values: boolean, integer >= 0, or null for unlimited. Invalid JSON, unknown capability or wrong type aborts startup.

• CLICKHOUSE_DATABASE
• CLICKHOUSE_HOSTCLICKHOUSE (when using --profile clickhouse)

  CLICKHOUSE (when using --profile clickhouse)

• CLICKHOUSE_PASSWORD
• CLICKHOUSE_PORT
• CLICKHOUSE_USERNAME
• DB_NAME=logtideDatabase settings (defaults work for most setups)

  Database settings (defaults work for most setups)

• DB_PASSWORDDatabase password (use a strong random password)

  Database password (use a strong random password)

• DB_USER=logtide
• FLUENT_BIT_API_KEYFluent Bit API key (REQUIRED when using --profile logging or --profile metrics) Project-scoped ingestion key, created in the UI under Project > Settings > API Keys. It starts with "lp_" and is shown only once. If left empty, Fluent Bit sends an empty X-API-Key header and every ingest request is rejected with 401 while the containers still look healthy. NOTE: the Fluent Bit container only runs when

  Fluent Bit API key (REQUIRED when using --profile logging or --profile metrics) Project-scoped ingestion key, created in the UI under Project > Settings > API Keys. It starts with "lp_" and is shown only once. If left empty, Fluent Bit sends an empty X-API-Key header and every ingest request is rejected with 401 while the containers still look healthy. NOTE: the Fluent Bit container only runs when

• FLUENT_BIT_IMAGEFluent Bit image (for log collection) Default: fluent/fluent-bit:4.2.2 For Raspberry Pi / ARM64, you may need to build your own image or use: - cr.fluentbit.io/fluent/fluent-bit:4.2.2 (official multi-arch) - Custom ARM64 build

  Fluent Bit image (for log collection) Default: fluent/fluent-bit:4.2.2 For Raspberry Pi / ARM64, you may need to build your own image or use: - cr.fluentbit.io/fluent/fluent-bit:4.2.2 (official multi-arch) - Custom ARM64 build

• FRONTEND_URL=http://localhost:3000 (dev)Frontend URL for OIDC redirects

  Frontend URL for OIDC redirects

• INITIAL_ADMIN_EMAILEmail address for the admin account

  Email address for the admin account

• INITIAL_ADMIN_NAMEDisplay name (defaults to "Admin")

  Display name (defaults to "Admin")

• INITIAL_ADMIN_PASSWORDPassword (minimum 8 characters)

  Password (minimum 8 characters)

• LOGTIDE_ADMIN_SERVICE_TOKENStatic bearer (min 32 characters) letting an external billing service call the org entitlements and retention admin endpoints. Generate: openssl rand -base64 48

  Static bearer (min 32 characters) letting an external billing service call the org entitlements and retention admin endpoints. Generate: openssl rand -base64 48

• LOGTIDE_BACKEND_IMAGEDocker images (pin versions for production stability)

  Docker images (pin versions for production stability)

• LOGTIDE_BILLING_API_TOKEN
• LOGTIDE_BILLING_API_URLIn-app billing (optional, for hosted deployments) When BOTH are set, owners/admins get a Billing page (Settings > Billing) that the backend proxies to an external billing service. Setting only one of the two aborts startup. The URL may be http or https; the call is service to service, so keep it on a private network and never send it over the internet in clear. Token: min 32 characters, shared wit

  In-app billing (optional, for hosted deployments) When BOTH are set, owners/admins get a Billing page (Settings > Billing) that the backend proxies to an external billing service. Setting only one of the two aborts startup. The URL may be http or https; the call is service to service, so keep it on a private network and never send it over the internet in clear. Token: min 32 characters, shared wit

• LOGTIDE_FRONTEND_IMAGE
• LOGTIDE_PRIVACY_URL
• LOGTIDE_TERMS_URLRequire Terms of Service and Privacy Policy acceptance at registration (and again whenever LOGTIDE_TERMS_VERSION changes). Set all three or none: a partial set aborts startup. URLs must be https (http only for localhost). Ingestion with existing API keys is never blocked.

  Require Terms of Service and Privacy Policy acceptance at registration (and again whenever LOGTIDE_TERMS_VERSION changes). Set all three or none: a partial set aborts startup. URLs must be https (http only for localhost). Ingestion with existing API keys is never blocked.

• LOGTIDE_TERMS_VERSION
• LOGTIDE_UPGRADE_SIGNING_SECRETMin 32 characters. Generate with: openssl rand -base64 48

  Min 32 characters. Generate with: openssl rand -base64 48

• LOGTIDE_UPGRADE_URLExternal billing handoff (optional, for hosted deployments) When BOTH are set, owners/admins see Upgrade / Manage billing buttons on the usage page. Clicking one redirects to LOGTIDE_UPGRADE_URL with a short-lived (10 minute) HMAC-SHA256 signed token (?t=...). The token never contains LogTide session credentials. Setting only one of the two aborts startup. URL must be https (http is allowed only f

  External billing handoff (optional, for hosted deployments) When BOTH are set, owners/admins see Upgrade / Manage billing buttons on the usage page. Clicking one redirects to LOGTIDE_UPGRADE_URL with a short-lived (10 minute) HMAC-SHA256 signed token (?t=...). The token never contains LogTide session credentials. Setting only one of the two aborts startup. URL must be https (http is allowed only f

• MAX_ORGANIZATION_CREATIONS_PER_USER_PER_MONTHMax organizations one user may create per UTC calendar month, even if they delete them again (positive integer, unset = unlimited).

  Max organizations one user may create per UTC calendar month, even if they delete them again (positive integer, unset = unlimited).

• MAX_ORGANIZATIONS_PER_USERMax organizations one user may own (positive integer, unset = unlimited).

  Max organizations one user may own (positive integer, unset = unlimited).

• MONGODB_AUTH_SOURCE
• MONGODB_DATABASE
• MONGODB_HOSTMONGODB (when using --profile mongodb)

  MONGODB (when using --profile mongodb)

• MONGODB_PASSWORD
• MONGODB_PORT
• MONGODB_USERNAME
• PUBLIC_API_URLFrontend API URL - AUTO-DETECTED in most cases, no configuration needed! How auto-detection works: - Access via http://192.168.1.100:3000 → API auto-detected at http://192.168.1.100:8080 - Access via https://logtide.example.com (port 80/443) → Uses relative URLs (assumes reverse proxy) Only set this if you have a non-standard setup:

  Frontend API URL - AUTO-DETECTED in most cases, no configuration needed! How auto-detection works: - Access via http://192.168.1.100:3000 → API auto-detected at http://192.168.1.100:8080 - Access via https://logtide.example.com (port 80/443) → Uses relative URLs (assumes reverse proxy) Only set this if you have a non-standard setup:

• REDIS_PASSWORDRedis password (use a strong random password)

  Redis password (use a strong random password)

• REDIS_URLNot set = uses PostgreSQL alternatives

  Not set = uses PostgreSQL alternatives

• REGISTRATION_RATE_LIMIT_PER_HOURExtra per-IP cap on POST /auth/register per hour (positive integer, unset = off).

  Extra per-IP cap on POST /auth/register per hour (positive integer, unset = off).

• REQUIRE_EMAIL_VERIFICATIONMake new local users confirm their email before creating projects or API keys. Requires SMTP_HOST, otherwise startup fails.

  Make new local users confirm their email before creating projects or API keys. Requires SMTP_HOST, otherwise startup fails.

• SMTP_FROM
• SMTP_HOSTEMAIL NOTIFICATIONS (optional)

  EMAIL NOTIFICATIONS (optional)

• SMTP_PASS
• SMTP_PORT
• SMTP_USERSMTP_USER and SMTP_PASS are optional - omit for unauthenticated SMTP (e.g. port 25)

  SMTP_USER and SMTP_PASS are optional - omit for unauthenticated SMTP (e.g. port 25)

• STORAGE_ENGINESTORAGE ENGINE (default: timescale) Options: timescale, clickhouse, mongodb

  STORAGE ENGINE (default: timescale) Options: timescale, clickhouse, mongodb

• SYSLOG_TZ_OFFSETTimezone offset in hours for RFC 3164 syslog timestamps, which carry no timezone (e.g. 1 for CET, 2 for CEST, 8 for UTC+8, -5 for EST). If your devices send local time and this is unset, their logs are stored with a shifted timestamp and can land outside the UI's default 24h window.

  Timezone offset in hours for RFC 3164 syslog timestamps, which carry no timezone (e.g. 1 for CET, 2 for CEST, 8 for UTC+8, -5 for EST). If your devices send local time and this is unset, their logs are stored with a shifted timestamp and can land outside the UI's default 24h window.