nixos/librechat: add meilisearch support (#481465)

Author: SuperSandro2000

nixos/modules/services/search/meilisearch.nix

@@ -121,6 +121,9 @@ in
         Path to file which contains the master key.
         By doing so, all routes will be protected and will require a key to be accessed.
         If no master key is provided, all routes can be accessed without requiring any key.
+
+        You can generate a master key by running `openssl rand -base64 36`.
+        Alternatively, you can start Meilisearch without a master key and use the pre-generated key from the service's logs that can be obtained by `journalctl -u meilisearch | grep -- --master-key`.
       '';
       default = null;
       type = lib.types.nullOr lib.types.path;

nixos/modules/services/web-apps/librechat.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.services.librechat;
+  meiliCfg = config.services.meilisearch;
   format = pkgs.formats.yaml { };
   configFile = format.generate "librechat.yaml" cfg.settings;
   exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
@@ -155,6 +156,26 @@ in
     };
 
     enableLocalDB = lib.mkEnableOption "a local mongodb instance";
+
+    meilisearch = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Whether to enable and configure Meilisearch locally for Librechat.
+              You will manually need to set `services.meilisearch.masterKeyFile`.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        See [LibreChat search feature](https://www.librechat.ai/docs/features/search).
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -178,6 +199,12 @@ in
           You can use https://www.librechat.ai/toolkit/creds_generator to generate these.
         '';
       }
+      {
+        assertion = cfg.meilisearch.enable -> meiliCfg.masterKeyFile != null;
+        message = ''
+          LibreChat's Meilisearch integration requires `services.meilisearch.masterKeyFile` to be set.
+        '';
+      }
     ];
 
     networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
@@ -192,7 +219,8 @@ in
       after = [
         "tmpfiles.target"
       ]
-      ++ lib.optional cfg.enableLocalDB "mongodb.service";
+      ++ lib.optional cfg.meilisearch.enable "meilisearch.service";
+      wants = lib.optional cfg.meilisearch.enable "meilisearch.service";
       description = "Open-source app for all your AI conversations, fully customizable and compatible with any AI provider";
       environment = cfg.env;
       script = # sh
@@ -249,6 +277,11 @@ in
 
     services.librechat.env.MONGO_URI = lib.mkIf cfg.enableLocalDB "mongodb://localhost:27017";
     services.mongodb.enable = lib.mkIf cfg.enableLocalDB true;
+
+    services.meilisearch.enable = lib.mkIf cfg.meilisearch.enable true;
+    services.librechat.env.SEARCH = lib.mkIf cfg.meilisearch.enable true;
+    services.librechat.env.MEILI_HOST = lib.mkIf cfg.meilisearch.enable "http://${meiliCfg.settings.http_addr}";
+    services.librechat.credentials.MEILI_MASTER_KEY = lib.mkIf cfg.meilisearch.enable meiliCfg.masterKeyFile;
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/tests/librechat.nix

@@ -17,6 +17,7 @@
       credsIvFile = pkgs.writeText "librechat-creds-iv" "7c09a571f65ac793611685cc9ab1dbe7";
       jwtSecret = pkgs.writeText "librechat-jwt-secret" "29c4dc7f7de15306accf5eddb4cb8a70eb233d9fba4301f8f47f14c8c047ac81";
       jwtRefreshSecret = pkgs.writeText "librechat-jwt-refresh-secret" "f2c1685561f2f570b3e7955df267b5c602ee099f14dc5caa0dacc320580ea180";
+      meilisearchMasterKeyFile = pkgs.writeText "meilisearch-master-key" "xHkP3Bzcf98fw7FiSCR82g5ULLGrXc4frK1qkEfN8St/3kJZ";
     in
     {
       services.librechat = {
@@ -32,13 +33,19 @@
           JWT_REFRESH_SECRET = jwtRefreshSecret;
         };
         enableLocalDB = true;
+        meilisearch.enable = true;
       };
+
+      services.meilisearch.masterKeyFile = meilisearchMasterKeyFile;
     };
 
   testScript = ''
     machine.start()
 
     machine.succeed("grep -qF 'ALLOW_REGISTRATION=true' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qF 'SEARCH=true' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qF 'MEILI_HOST=http://localhost:7700' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qG 'MEILI_MASTER_KEY_FILE:/nix/store/.*meilisearch-master-key' /etc/systemd/system/librechat.service")
 
     machine.wait_for_unit("librechat.service")
     machine.wait_for_open_port(3080)