chore: update user IDs in Dockerfiles and deployment configurations; enhance document management support in README

Author: a-klos

.github/workflows/semantic-release.yml

@@ -101,7 +101,7 @@ jobs:
             build-args: "dev=0"
           - name: mcp-server
             dockerfile: services/mcp-server/Dockerfile
-            image: rag-mcp
+            image: mcp-server
             build-args: "dev=0"
           - name: frontend
             dockerfile: services/frontend/apps/chat-app/Dockerfile

README.md

@@ -7,7 +7,7 @@ Welcome to the STACKIT RAG Template! This is a basic example of how to use the R
 
 ## Features 🚀
 
-**Document Management**: Supports PDFs, DOCX, PPTX, XML, and Confluence documents.
+**Document Management**: Supports PDFs, DOCX, PPTX, XML, EPUB documents and websource via confluence as well as sitemaps.
 
 **AI Integration**: Multiple LLM and embedder providers for flexibility.
 

infrastructure/rag/templates/admin-backend/deployment.yaml

@@ -13,7 +13,7 @@ spec:
         app: {{ .Values.adminBackend.name }}
     spec:
       securityContext:
-        runAsUser: 65532
+        runAsUser: 10001
         runAsNonRoot: true
       volumes:
         - name: config-volume

infrastructure/rag/templates/backend/deployment.yaml

@@ -13,7 +13,7 @@ spec:
         app: {{ .Values.backend.name }}
     spec:
       securityContext:
-        runAsUser: 65532
+        runAsUser: 10001
         runAsNonRoot: true
       volumes:
         - name: config-volume

infrastructure/rag/templates/extractor/deployment.yaml

@@ -13,7 +13,7 @@ spec:
         app: {{ .Values.extractor.name }}
     spec:
       securityContext:
-        runAsUser: 65532
+        runAsUser: 10001
         runAsNonRoot: true
       volumes:
         - name: config-volume

infrastructure/rag/values.yaml

@@ -1,3 +1,8 @@
+global:
+  security:
+    # -- Allow insecure images to use bitnami legacy repository. Can be set to false if secure images are being used (Paid).
+    allowInsecureImages: true
+
 features:
   ollama:
     enabled: false
@@ -445,44 +450,39 @@ shared:
 
 
 langfuse:
-  # Core Langfuse Configuration
-  langfuse:
-    # Used to hash API keys
-    salt:
-      value: "changeme"
-
-    # Authentication settings
-    features:
-      telemetryEnabled: true
-      signUpDisabled: false
-
-    # Image configuration
+  minio:
     image:
-      tag: "3.88.1"
-      pullPolicy: Always
-
-    # Web deployment configuration
-    web:
+      repository: bitnamilegacy/minio
+    deploy: false
+  valkey:
+    image:
+      repository: bitnamilegacy/valkey
+    deploy: false #<--- keydb is used instead of valkey
+  image:
+    repository: ghcr.io/langfuse/langfuse
+    pullPolicy: Always
+    tag: "3.27.2"
+  postgresql:
+    image:
+      repository: bitnamilegacy/postgresql
+    deploy: true
+    auth:
+      username: postgres
+      password: postgres
+      database: langfuse
+  clickhouse:
+    image:
+      repository: bitnamilegacy/clickhouse
+    zookeeper:
       image:
-        repository: langfuse/langfuse
-        tag: "3.88.1"
-        pullPolicy: Always
+        repository: bitnamilegacy/zookeeper
 
-    # Worker deployment configuration
-    worker:
-      image:
-        repository: langfuse/langfuse-worker
-        tag: "3.88.1"
-        pullPolicy: Always
-      port: 3030
 
-    # NextAuth configuration
+  langfuse:
     nextauth:
       url: http://localhost:3000
-      secret:
-        value: "changeme"
-
-    # Additional environment variables (only for init values)
+      secret: changeme
+    salt: changeme
     additionalEnv:
     - name: LANGFUSE_INIT_ORG_ID
       value: ""
@@ -498,8 +498,33 @@ langfuse:
       value: ""
     - name: LANGFUSE_INIT_USER_PASSWORD
       value: ""
-
-    # Additional init containers
+    # REDIS
+    - name: "REDIS_CONNECTION_STRING"
+      value: "redis://rag-keydb:6379"
+    # CLICKHOUSE
+    - name: "CLICKHOUSE_MIGRATION_URL"
+      value: "clickhouse://rag-clickhouse:9000"
+    - name: "CLICKHOUSE_URL"
+      value: "http://rag-clickhouse:8123"
+    - name: "CLICKHOUSE_USER"
+      value: "default"
+    - name: "CLICKHOUSE_PASSWORD"
+      value: "changeme"
+    # S3 / MinIO
+    - name: "LANGFUSE_S3_EVENT_UPLOAD_ENABLED"
+      value: "true"
+    - name: "LANGFUSE_S3_EVENT_UPLOAD_BUCKET"
+      value: "langfuse"
+    - name: "LANGFUSE_S3_EVENT_UPLOAD_REGION"
+      value: "auto"
+    - name: "LANGFUSE_S3_EVENT_UPLOAD_ACCESS_KEY_ID"
+      value: "admin"
+    - name: "LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY"
+      value: "adminpassword"
+    - name: "LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT"
+      value: "http://rag-minio:9000"
+    - name: "LANGFUSE_S3_EVENT_UPLOAD_FORCE_PATH_STYLE"
+      value: "true"
     extraInitContainers:
     - name: wait-for-postgres
       image: busybox
@@ -514,78 +539,9 @@ langfuse:
       # Define a reasonable timeout in case PostgreSQL fails to come up
       timeoutSeconds: 300
 
-  # PostgreSQL Configuration (use external PostgreSQL)
-  postgresql:
-    deploy: true
-    host: "rag-postgresql"
-    port: 5432
-    auth:
-      username: postgres
-      password: postgres
-      database: langfuse
-
-  # Redis Configuration (external KeyDB)
-  redis:
-    deploy: false
-    host: "rag-keydb"
-    port: 6379
-    auth:
-      username: "default"
-      password: ""
-
-  # ClickHouse Configuration (external ClickHouse)
-  clickhouse:
-    deploy: true
-    host: "rag-clickhouse"
-    httpPort: 8123
-    nativePort: 9000
-    auth:
-      username: "default"
-      password: "changeme"
-    migration:
-      url: "clickhouse://rag-clickhouse:9000"
-      ssl: false
-      autoMigrate: true
-    resources:
-      limits:
-        cpu: "2"
-        memory: "8Gi"
-      requests:
-        cpu: "2"
-        memory: "4Gi"
-
-    zookeeper:
-      resources:
-        limits:
-          cpu: "2"
-          memory: "2Gi"
-        requests:
-          cpu: "1"
-          memory: "1Gi"
-
-  # S3/MinIO Configuration (external MinIO)
-  minio:
-    deploy: false
-    bucket: "langfuse"
-    region: "auto"
-    endpoint: "http://rag-minio:9000"
-    forcePathStyle: true
-    accessKeyId:
-      value: "admin"
-    secretAccessKey:
-      value: "adminpassword"
-    eventUpload:
-      enabled: true
-      bucket: "langfuse"
-      region: "auto"
-      endpoint: "http://rag-minio:9000"
-      forcePathStyle: true
-      accessKeyId:
-        value: "admin"
-      secretAccessKey:
-        value: "adminpassword"
-
 minio:
+  image:
+    repository: bitnamilegacy/minio
   auth:
     ## @param auth.rootUser MinIO&reg; root username
     ##
@@ -602,6 +558,10 @@ minio:
     enabled: false
   mode: standalone
 
+
+
+
+
 ollama:
   image:
     tag: 0.5.1
@@ -617,8 +577,3 @@ ollama:
 qdrant:
   image:
     tag: v1.14.1
-
-keydb:
-  multiMaster: "no"
-  activeReplicas: "no"
-  nodes: 1

libs/admin-api-lib/src/admin_api_lib/dependency_container.py

@@ -147,10 +147,15 @@ class DependencyContainer(DeclarativeContainer):
     summary_enhancer = List(
         Singleton(PageSummaryEnhancer, traced_summarizer, chunker_settings),
     )
-    information_enhancer = Singleton(
+    untraced_information_enhancer = Singleton(
         GeneralEnhancer,
         summary_enhancer,
     )
+    information_enhancer = Singleton(
+        LangfuseTracedRunnable,
+        inner_chain=untraced_information_enhancer,
+        settings=langfuse_settings,
+    )
 
     document_deleter = Singleton(
         DefaultDocumentDeleter, rag_api=rag_api, file_service=file_service, key_value_store=key_value_store

libs/extractor-api-lib/src/extractor_api_lib/impl/extractors/confluence_extractor.py

@@ -1,5 +1,6 @@
 """Module for the DefaultConfluenceExtractor class."""
 
+import logging
 from langchain_community.document_loaders import ConfluenceLoader
 
 from extractor_api_lib.impl.types.extractor_types import ExtractorTypes
@@ -10,6 +11,8 @@
     ConfluenceLangchainDocument2InformationPiece,
 )
 
+logger = logging.getLogger(__name__)
+
 
 class ConfluenceExtractor(InformationExtractor):
     """Implementation of the InformationExtractor interface for confluence."""
@@ -54,12 +57,13 @@ async def aextract_content(
         confluence_loader_parameters = {
             x.key: int(x.value) if x.value.isdigit() else x.value for x in extraction_parameters.kwargs
         }
-        if (
-            not confluence_loader_parameters.get("max_pages")
-            or confluence_loader_parameters.get("max_pages") == "undefined"
+        if not confluence_loader_parameters.get("max_pages") or isinstance(
+            confluence_loader_parameters.get("max_pages"), str
         ):
+            logging.warning(
+                "max_pages parameter is not set or invalid discarding it. ConfluenceLoader will use default value."
+            )
             confluence_loader_parameters.pop("max_pages")
-
         # Drop the document_name parameter as it is not used by the ConfluenceLoader
         if "document_name" in confluence_loader_parameters:
             confluence_loader_parameters.pop("document_name", None)

services/admin-backend/Dockerfile

@@ -29,7 +29,7 @@ RUN poetry config virtualenvs.create false && \
 FROM --platform=linux/amd64 python:3.13-bookworm
 ARG dev=0
 
-RUN adduser --disabled-password --gecos "" --uid 65532 nonroot
+RUN adduser --disabled-password --gecos "" --uid 10001 nonroot
 
 ENV POETRY_VIRTUALENVS_PATH=/app/services/admin-backend/.venv
 COPY --from=build --chown=nonroot:nonroot ${POETRY_VIRTUALENVS_PATH} ${POETRY_VIRTUALENVS_PATH}

services/document-extractor/Dockerfile

@@ -33,7 +33,7 @@ RUN poetry config virtualenvs.create false &&\
 FROM --platform=linux/amd64 python:3.13-bookworm
 ARG dev=0
 
-RUN adduser --disabled-password --gecos "" --uid 65532 nonroot
+RUN adduser --disabled-password --gecos "" --uid 10001 nonroot
 
 ENV POETRY_VIRTUALENVS_PATH=/app/services/document-extractor/.venv
 COPY --from=build  --chown=nonroot:nonroot ${POETRY_VIRTUALENVS_PATH} ${POETRY_VIRTUALENVS_PATH}