---
title: "Deploy LibreChat — Multi-Provider AI Chat with RAG"
description: "Self-hosted ChatGPT UI — GPT, Claude, Gemini, RAG, multi-user"
category: "AI/ML"
url: https://railway.com/deploy/librechat-multi-provider-rag
---

# Deploy LibreChat — Multi-Provider AI Chat with RAG

Self-hosted ChatGPT UI — GPT, Claude, Gemini, RAG, multi-user

**[Deploy LibreChat — Multi-Provider AI Chat with RAG on Railway](https://railway.com/template/librechat-multi-provider-rag)**

- **Creator:** SilverBanana
- **Category:** AI/ML

## Template content

### pg_vector

- **Image:** pgvector/pgvector:pg18

### MongoDB https://devicons.railway.app/i/mongodb.svg

- **Image:** mongo:8.0
- **Start command:** `docker-entrypoint.sh mongod --ipv6 --bind_ip ::,0.0.0.0 --setParameter diagnosticDataCollectionEnabled=false`

### RAG

- **Image:** danny-avila/librechat-rag-api-dev-lite

### LibreChat https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/librechat.svg

- **Image:** danny-avila/librechat-dev:latest

### Meilisearch https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/meilisearch.svg

- **Image:** getmeili/meilisearch:v1.11.3

## Documentation

# Deploy and Host LibreChat on Railway

LibreChat is the leading open-source, multi-provider AI chat platform — a self-hosted ChatGPT-style interface that connects OpenAI, Anthropic, Google, and dozens of other providers in one place. Switch between GPT, Claude, and Gemini mid-conversation, run RAG over your own documents, search your full chat history, and give a whole team access without sharing raw API keys. This template deploys the full stack: LibreChat, MongoDB, Meilisearch, PGVector, and the RAG API.

---

## What This Template Deploys

| Service | Purpose |
| --- | --- |
| **LibreChat** | Chat UI, admin, and API on port `3080` |
| **MongoDB** | Chat history, users, presets, and configuration |
| **Meilisearch** | Full-text search across all conversations |
| **PGVector** | Vector store backing the RAG document pipeline |
| **RAG API** | Document embedding and retrieval service |

All services run on Railway's private network. MongoDB, PGVector, and Meilisearch are never publicly exposed, and secrets are generated at deploy time.

---

## About Hosting LibreChat

LibreChat is a five-service application, and two configuration details cause most failed deployments — both worth getting right before anything else.

**`CREDS_KEY` and `CREDS_IV` are exact lengths, not just "random strings."** LibreChat encrypts every stored provider API key with them, and the encryption is length-specific: `CREDS_KEY` must be **32 bytes** (`openssl rand -hex 32`) and `CREDS_IV` must be **16 bytes** (`openssl rand -hex 16`). Get the IV length wrong and LibreChat cannot decrypt saved keys — every provider connection breaks with an opaque error. This template generates both at the correct lengths.

**`MEILI_MASTER_KEY` must match across two services.** The LibreChat service and the Meilisearch service must share the exact same master key, and Meilisearch refuses to start if it is under 16 bytes. A mismatch means search silently fails while everything else works. This template wires the same key to both.

The RAG API and PGVector add real memory overhead. Budget **2 GB RAM minimum** for the full stack; a lighter deployment can drop RAG if document Q&A isn't needed.

Typical cost: **~$10–20/month** on Railway for all five services, plus your model providers' usage. Connect cloud LLMs and no GPU is needed.

---

## How It Compares

| | LibreChat (self-hosted) | ChatGPT Team | Open WebUI | Poe |
| --- | --- | --- | --- | --- |
| Cost model | Flat ~$10–20/mo infra | Per user/month | Self-hosted | Per month |
| Providers | GPT, Claude, Gemini + more | OpenAI only | Cloud + Ollama | Multiple |
| Data ownership | Full | Vendor | Full | Vendor |
| RAG over your docs | Built-in | Limited | Built-in | No |
| Multi-user + auth | OAuth2, LDAP | Yes | Yes | No |
| Self-hostable | Yes | No | Yes | No |

ChatGPT Team is simpler but OpenAI-only and per-seat. Open WebUI leans toward local Ollama models. LibreChat is strongest for cloud providers, multi-user teams, and enterprise auth — many providers behind one login, on infrastructure you own.

---

## Deploy in Under 5 Minutes

1. Click **Deploy on Railway** — all five services build automatically (~4 minutes)
2. Confirm `CREDS_KEY` (32-byte) and `CREDS_IV` (16-byte) are set, and that `MEILI_MASTER_KEY` matches on both LibreChat and Meilisearch
3. Set `DOMAIN_CLIENT` and `DOMAIN_SERVER` to your Railway public domain
4. Add a provider key (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GOOGLE_KEY`) or leave as `user_provided` to let users bring their own
5. Open your domain, register the first account, and start chatting

The first registered account becomes the admin. Disable `ALLOW_REGISTRATION` afterward to close public signup.

---

## Common Use Cases

- **Team AI hub** — give engineering or research teams a private ChatGPT-style interface with shared access to GPT, Claude, and Gemini without handing out raw API keys
- **Document Q&A** — upload PDFs and query them through the RAG pipeline with any connected model
- **Model comparison** — benchmark responses across OpenAI, Anthropic, and Google side by side in one interface
- **Privacy-first AI** — run conversations on infrastructure you control, with nothing sent to third-party chat services
- **Multi-provider fallback** — switch providers mid-conversation when one is rate-limited or a different model fits the task
- **Enterprise-auth deployments** — OAuth2 and LDAP login for organisations that need managed access

---

## Configuration

| Variable | Required | Description |
| --- | --- | --- |
| `MONGO_URI` | Auto-injected | MongoDB connection via `${{MongoDB.MONGO_URL}}` reference |
| `CREDS_KEY` | Required | **32-byte** key — `openssl rand -hex 32`. Encrypts stored provider keys |
| `CREDS_IV` | Required | **16-byte** IV — `openssl rand -hex 16`. Wrong length breaks key decryption |
| `JWT_SECRET` / `JWT_REFRESH_SECRET` | Required | Session + refresh signing keys — `openssl rand -hex 32` each |
| `DOMAIN_CLIENT` / `DOMAIN_SERVER` | Required | Your Railway public domain (client and server) |
| `SEARCH` | Pre-set | `true` — enables Meilisearch conversation search |
| `MEILI_HOST` | Auto-injected | Meilisearch host via `RAILWAY_PRIVATE_DOMAIN` |
| `MEILI_MASTER_KEY` | Required | Must be identical on LibreChat and Meilisearch, 16+ bytes |
| `RAG_API_URL` | Auto-injected | RAG API service address via reference variable |
| `OPENAI_API_KEY` / `ANTHROPIC_API_KEY` / `GOOGLE_KEY` | Optional | Set a shared key, or `user_provided` for per-user keys |
| `ALLOW_REGISTRATION` | Optional | Set `false` after creating the admin to close signup |

> **`CREDS_IV` must be exactly 16 bytes.** LibreChat's credential encryption is length-specific. A wrong-length IV means stored provider keys can't be decrypted — an opaque failure. Generate it with `openssl rand -hex 16`.

> **`MEILI_MASTER_KEY` must match across both services.** LibreChat and Meilisearch must share the same key, and it must be at least 16 bytes or Meilisearch won't start. A mismatch makes search silently fail.

---

## Dependencies for LibreChat Hosting

- Railway account — expect ~$10–20/month across the five services
- At least one model provider API key, or let users provide their own
- 2 GB RAM minimum for the full RAG-enabled stack
- Optional: OAuth2 or LDAP provider for enterprise authentication

### Deployment Dependencies

- [LibreChat GitHub Repository](https://github.com/danny-avila/LibreChat)
- [LibreChat Documentation](https://www.librechat.ai/docs)
- [LibreChat Railway Guide](https://www.librechat.ai/docs/deployment/railway)
- [Railway Variables Documentation](https://docs.railway.com/guides/variables)

### Implementation Details

The template runs `ghcr.io/danny-avila/librechat-dev` on port `3080` alongside MongoDB, Meilisearch, a PGVector-enabled PostgreSQL, and the LibreChat RAG API — the same five-service topology as LibreChat's own Docker Compose. All backing services communicate over Railway's private network and are never publicly exposed.

`CREDS_KEY` and `CREDS_IV` are generated at their required lengths (32 and 16 bytes) because LibreChat's credential encryption fails silently if they're wrong, and `MEILI_MASTER_KEY` is wired identically to both LibreChat and Meilisearch so full-text search initialises correctly. `MEILI_HOST` and `RAG_API_URL` resolve through Railway reference variables to the private service addresses.

Chat history and users live in MongoDB; document embeddings live in PGVector via the RAG API. Both hold your data and should be backed up. Provider keys can be set as `user_provided`, so each user supplies their own key rather than sharing one — useful for teams that want per-user billing and access.

---

## Frequently Asked Questions

**Why does `CREDS_IV` have to be a specific length?** LibreChat encrypts stored provider keys with AES, which requires a 16-byte IV. A wrong-length value breaks decryption of every saved key with an unclear error. Generate it with `openssl rand -hex 16`; the template does this for you.

**Search isn't working — why?** Almost always a `MEILI_MASTER_KEY` mismatch between the LibreChat and Meilisearch services, or a key under 16 bytes. Both services must share the exact same key. Everything else can work while search silently fails.

**Which providers are supported?** OpenAI, Anthropic, Google, and many others including OpenRouter, Azure, and local endpoints. Switch between them mid-conversation from the model selector.

**Can each user bring their own API key?** Yes. Set the provider variables to `user_provided` and each user enters their own key, which is encrypted per-user in MongoDB. Useful for per-user billing.

**Do I need a GPU?** No, not for cloud models. LibreChat orchestrates requests to your providers, so it runs on CPU. A GPU only matters for local inference on a separate host.

**How much RAM does it need?** 2 GB minimum for the full stack, because the RAG API and PGVector add overhead. Drop the RAG services if you don't need document Q&A and it runs lighter.

**How do I make it multi-user?** Registration is on by default — the first account is admin. Add users via signup, or configure OAuth2/LDAP for managed access, then set `ALLOW_REGISTRATION=false` to close public signup.

---

## Why Deploy LibreChat on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying LibreChat on Railway you get a full multi-provider AI workspace with the tricky parts already solved — five services pre-wired over a private network, credential keys generated at the right lengths, Meilisearch keyed correctly, RAG ready, and automatic HTTPS. Many providers behind one login, your conversations and documents on infrastructure you own.

## Similar templates

- [Chat Chat](https://railway.com/deploy/-WWW5r) — Chat Chat, your own unified chat and search to AI platform.
- [stella](https://railway.com/deploy/stella) — Self-host stella with web, API, Postgres, Redis, and object storage.
- [Hermes Agent | OpenClaw Alternative with Dashboard](https://railway.com/deploy/hermes-agent-or-openclaw-alternative-wit) — Self-Hosted Hermes AI Agent for Telegram, Discord & Slack

Open this page in a browser: https://railway.com/deploy/librechat-multi-provider-rag