---
title: "Deploy Langfuse — Self-Hosted LLM Observability"
description: "Self-host Langfuse — LLM traces, evals & prompt management"
category: "AI/ML"
url: https://railway.com/deploy/langfuse-llm-observability
---

# Deploy Langfuse — Self-Hosted LLM Observability

Self-host Langfuse — LLM traces, evals & prompt management

**[Deploy Langfuse — Self-Hosted LLM Observability on Railway](https://railway.com/template/langfuse-llm-observability)**

- **Creator:** SilverBanana
- **Category:** AI/ML

## Template content

### Langfuse Worker https://langfuse.com/icon.svg

- **Image:** langfuse/langfuse-worker:3

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

### Redis https://cdn.sanity.io/images/sy1jschh/production/0ce0bfdcfbdbf69662b1116671f97c2dd788b655-157x157.svg

- **Image:** redis:8.2.1
- **Start command:** `/bin/sh -c "rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH"`

### Langfuse Web https://langfuse.com/icon.svg

- **Image:** langfuse/langfuse:3

### Minio https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/minio-light.svg

- **Image:** minio/minio

### Clickhouse https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/clickhouse.svg

- **Image:** clickhouse/clickhouse-server:24

## Documentation

# Deploy and Host Langfuse on Railway

Langfuse is the open-source LLM observability platform — traces, evaluations, prompt management, and cost tracking for your AI applications, self-hosted so your prompt and trace data never leaves your infrastructure. Instrument any LLM app (OpenAI, Anthropic, LangChain, LlamaIndex, or raw OpenTelemetry) and see every call: inputs, outputs, latency, tokens, and cost, in one dashboard. This template deploys Langfuse v3's full stack — web, worker, PostgreSQL, ClickHouse, Redis, and object storage — correctly wired, so the multi-service setup that stops most self-hosters just works.

---

## What This Template Deploys

| Service | Purpose |
| --- | --- |
| **Langfuse Web** | The dashboard, API, and trace ingestion (port `3000`) |
| **Langfuse Worker** | Background processing of ingested events (same image, worker role) |
| **PostgreSQL** | Transactional data — users, projects, prompts, config |
| **ClickHouse** | The OLAP store for traces, observations, and scores |
| **Redis / Object storage** | Queue and cache; S3/MinIO persists incoming events and exports |

All run on Railway's private network; only the web service is public. This is Langfuse v3's production architecture — the complexity is what makes it fast at millions of traces.

---

## About Hosting

Langfuse v3 is a serious observability stack, and three specifics decide whether it works — all handled here.

**It's a six-service architecture — ClickHouse is the key piece.** Langfuse v3 split trace storage out of PostgreSQL into ClickHouse, a columnar OLAP database that runs aggregations over hundreds of thousands of traces in milliseconds. Postgres holds transactional data, ClickHouse holds the high-volume traces, Redis queues ingestion, and object storage persists raw events. The web and worker run the same image in two roles. Wiring these six together with matched credentials is the entire difficulty of self-hosting Langfuse, and this template does it.

**`ENCRYPTION_KEY` must be exactly 64 hex characters.** Langfuse needs three secrets: `NEXTAUTH_SECRET` and `SALT` (32-byte base64), and `ENCRYPTION_KEY`, which must be *exactly* 64 hex characters (`openssl rand -hex 32`). A wrong length fails startup. This template generates all three, and they must stay stable across redeploys.

**ClickHouse and Postgres must run in UTC — or your data looks wrong.** The subtle trap: a non-UTC timezone makes queries return incorrect or empty results — traces appear to ingest but show wrong data, a silent failure that's maddening to debug. This template sets the databases to UTC.

**Your org, project, and API keys are created on first boot.** The `LANGFUSE_INIT_*` variables auto-create your first organization, project, and a usable API key pair on deploy, so you can send traces immediately. The first account you register becomes the admin. ClickHouse takes the longest to start (~30–60s), so a brief first-boot delay is normal.

One note: Langfuse was acquired by ClickHouse in January 2026, but the core remains MIT-licensed and fully self-hostable, with active maintenance and first-class OpenTelemetry ingestion.

Typical cost: **~$20–30/month** on Railway across the six services, more under heavy trace volume. Langfuse is MIT-licensed and free — versus per-seat or per-event observability SaaS.

---

## How It Compares

| | Langfuse (self-hosted) | LangSmith | Datadog LLM | Helicone |
| --- | --- | --- | --- | --- |
| Cost model | Flat infra | Per seat/usage | Per host | Per request |
| Traces + evals + prompts | All three | All three | Traces | Traces |
| Data ownership | Full — your infra | Vendor | Vendor | Vendor/self |
| Framework support | Broad + OTel | LangChain-first | Broad | Broad |
| Prompt management | Built-in | Yes | No | Limited |
| Self-hostable | Yes (MIT) | No | No | Yes |

LangSmith is polished but LangChain-centric and cloud-only. Datadog's LLM product bills per host and keeps data on their servers. Helicone is proxy-based and lighter. Langfuse's edge is the full trio — tracing, evaluation, and prompt management — with broad framework and OpenTelemetry support, self-hosted under MIT, so sensitive data stays on infrastructure you own.

---

## Deploy in Under 5 Minutes

1. Click **Deploy on Railway** — all six services build and wire together (~5 minutes)
2. Confirm `NEXTAUTH_SECRET`, `SALT`, and the 64-hex-char `ENCRYPTION_KEY` are set
3. Confirm ClickHouse and Postgres are in UTC (handled by the template)
4. Open your Railway domain, register the first account (it becomes admin), and grab your API keys
5. Point your app's Langfuse SDK at your domain with the public/secret keys and start sending traces

Use the `langfuse.openai` wrapper or `@observe` decorator to instrument calls in minutes.

---

## Common Use Cases

- **LLM tracing** — capture every model call's inputs, outputs, latency, tokens, and cost in one place
- **Prompt management** — version, test, and deploy prompts without shipping code changes
- **Evaluations** — attach scores to traces, including LLM-as-a-judge, to measure output quality
- **Debugging agent chains** — inspect the full call tree of a RAG pipeline or multi-step agent
- **Data-sovereign observability** — keep sensitive prompt and trace data on your own infrastructure

---

## Configuration

| Variable | Required | Description |
| --- | --- | --- |
| `NEXTAUTH_SECRET` | Required | 32-byte base64 secret for auth — keep stable |
| `SALT` | Required | 32-byte base64 salt for hashing — keep stable |
| `ENCRYPTION_KEY` | Required | **Exactly 64 hex chars** (`openssl rand -hex 32`) — wrong length fails |
| `DATABASE_URL` | Auto-injected | PostgreSQL connection via Railway reference variable |
| `CLICKHOUSE_URL` / `CLICKHOUSE_MIGRATION_URL` | Auto-injected | ClickHouse HTTP and native connections |
| `REDIS_HOST` / `REDIS_AUTH` | Auto-injected | Redis connection and password |
| `LANGFUSE_INIT_*` | Optional | Auto-create the first org, project, and API keys on boot |

> **`ENCRYPTION_KEY` is exactly 64 hex characters, and keys must stay stable.** Generate it with `openssl rand -hex 32`; a wrong length fails startup. `NEXTAUTH_SECRET`, `SALT`, and `ENCRYPTION_KEY` must not change across redeploys, or existing data becomes unreadable.

> **Databases must run in UTC.** ClickHouse and Postgres in a non-UTC timezone return wrong or empty query results — a silent failure. This template sets UTC so your traces are accurate.
---

## Dependencies for Langfuse Hosting

- Railway account — ~$20–30/month across six services, more under heavy trace volume
- PostgreSQL, ClickHouse, Redis, and object storage (all included and wired)
- Your app instrumented with a Langfuse SDK or OpenTelemetry
- Optional: an LLM API key for evaluation features (LLM-as-a-judge)

### Deployment Dependencies

- [Langfuse GitHub Repository](https://github.com/langfuse/langfuse)
- [Langfuse Self-Hosting Docs](https://langfuse.com/self-hosting)
- [Langfuse SDKs & Integrations](https://langfuse.com/docs/integrations)
- [Railway Private Networking](https://docs.railway.com/guides/private-networking)

### Implementation Details

The template runs Langfuse v3 (`langfuse/langfuse:3`) in two roles — the web container (dashboard, API, ingestion on port `3000`) and a worker for background processing — alongside PostgreSQL for transactional data, ClickHouse for the trace/observation/score store, Redis for queue and cache, and S3-compatible object storage for raw events. All connect over the private network via reference variables, with only the web service public.

Three secrets are generated here: `NEXTAUTH_SECRET` and `SALT` (32-byte base64), and `ENCRYPTION_KEY` (exactly 64 hex characters); all must remain stable across redeploys or encrypted data becomes unreadable. Critically, ClickHouse and PostgreSQL run in UTC, because a non-UTC timezone causes Langfuse queries to return incorrect or empty results — a subtle but severe misconfiguration this template avoids. The `LANGFUSE_INIT_*` variables optionally seed the first org, project, and API keys on boot. Trace ingestion is queued: traces are written to object storage immediately with a reference in Redis, then processed by the worker into ClickHouse, which takes the longest to initialize. Data persists in PostgreSQL and ClickHouse, both of which should be backed up.

---

## Frequently Asked Questions

**Why must ClickHouse and Postgres be in UTC?** A non-UTC timezone makes Langfuse queries return incorrect or empty results — traces appear to ingest but show wrong data. It's a silent failure, so this template sets UTC to keep your data accurate.

**What format does `ENCRYPTION_KEY` need?** Exactly 64 hex characters (a 256-bit key from `openssl rand -hex 32`). A wrong length fails startup. It, `NEXTAUTH_SECRET`, and `SALT` must stay stable across redeploys.

**How do I start sending traces?** Register the first account (it becomes admin), grab your API keys (or use the auto-created ones), and point a Langfuse SDK or OpenTelemetry at your domain. The `langfuse.openai` wrapper and `@observe` decorator instrument calls quickly.

**Does my data persist?** Yes — PostgreSQL and ClickHouse hold your config and traces, and object storage holds raw events, all surviving redeploys. Back up Postgres and ClickHouse regularly.

---

## Why Deploy Langfuse on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Langfuse on Railway you get the full LLM observability stack with the hard parts solved — six services wired, the 64-hex `ENCRYPTION_KEY` and secrets set, the databases in UTC, and automatic HTTPS. Traces, evals, and prompt management for your AI apps, MIT-licensed and self-hosted on infrastructure you own.

## Similar templates

- [Chat Chat](https://railway.com/deploy/-WWW5r) — Chat Chat, your own unified chat and search to AI platform.
- [stella](https://railway.com/deploy/stella) — Self-host stella with web, API, Postgres, Redis, and object storage.
- [Hermes Agent | OpenClaw Alternative with Dashboard](https://railway.com/deploy/hermes-agent-or-openclaw-alternative-wit) — Self-Hosted Hermes AI Agent for Telegram, Discord & Slack

Open this page in a browser: https://railway.com/deploy/langfuse-llm-observability