How to Deploy Langflow - Open-Source Visual Framework for Building AI Applications

Langflow is an open-source, low-code visual framework for building artificial intelligence (AI) agents, workflows, and retrieval-augmented generation (RAG) applications. Developers use its visual builder to assemble large language model (LLM) pipelines from prebuilt components and test them in an interactive Playground. Finished flows run as API endpoints or Model Context Protocol (MCP) servers without extra boilerplate code.

This article explains how to self-host a production-ready Langflow instance on a Linux server with Docker Compose. It covers PostgreSQL persistence, Traefik reverse proxying with automatic HTTPS certificates, authentication for the visual editor, and validation of the deployment through a RAG chatbot that answers questions from an uploaded document.

Prerequisites

Before you begin, ensure that you:

• Have access to a Linux-based server with at least 2 CPU cores and 4 GB of RAM as a non-root user with sudo privileges.
• Install Docker and Docker Compose.
• Configure a domain A record pointing to the server's public IP address. For example, langflow.example.com.
• Have an API key from a supported LLM provider. This deployment uses OpenAI models for embeddings and chat responses.

Set Up the Project Directory and Environment

Langflow reads its runtime configuration from environment variables, so a dedicated project directory with a .env file keeps credentials out of the Compose manifest.

1. Create the project directory and switch into it.

   CONSOLE

   Copy

   $ mkdir ~/langflow && cd ~/langflow

   Explain Code

   Powered by Vultr AgentBeta

2. Generate a Langflow secret key and write it to the environment file.

   CONSOLE

   Copy

   $ python3 -c "from secrets import token_urlsafe; print(f'LANGFLOW_SECRET_KEY={token_urlsafe(32)}')" >> .env

   Explain Code

   Powered by Vultr AgentBeta

   Langflow encrypts stored credentials with this Fernet key. Without an explicit key, Langflow generates a random one at startup and encrypted values become unreadable after a restart.

3. Verify that the file contains the key without displaying its value.

   CONSOLE

   Copy

   $ grep -c "LANGFLOW_SECRET_KEY" .env

   Explain Code

   Powered by Vultr AgentBeta

   Output:

   1

4. Open the .env file with a text editor such as nano.

   CONSOLE

   Copy

   $ nano .env

   Explain Code

   Powered by Vultr AgentBeta

5. Add the following variables below the existing LANGFLOW_SECRET_KEY line. Replace every placeholder with your own values.

   INI

   Copy

   # Domain and certificate settings
   LANGFLOW_HOSTNAME=langflow.example.com
   LETSENCRYPT_EMAIL=admin@example.com
   
   # PostgreSQL credentials
   POSTGRES_USER=langflow
   POSTGRES_PASSWORD=DATABASE_PASSWORD
   POSTGRES_DB=langflow
   
   # Langflow storage paths
   LANGFLOW_CONFIG_DIR=/app/langflow
   LANGFLOW_KNOWLEDGE_BASES_DIR=/app/langflow/knowledge_bases
   
   # Authentication settings
   LANGFLOW_AUTO_LOGIN=False
   LANGFLOW_SUPERUSER=administrator
   LANGFLOW_SUPERUSER_PASSWORD=ADMIN_PASSWORD
   LANGFLOW_NEW_USER_IS_ACTIVE=False
   LANGFLOW_ENABLE_SUPERUSER_CLI=False
   
   # LLM provider credentials
   OPENAI_API_KEY=OPENAI_API_KEY

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file. Each group of variables controls a distinct part of the deployment:

   • LANGFLOW_HOSTNAME and LETSENCRYPT_EMAIL supply the domain for the Traefik routing rule and the contact address for certificate expiry notices.
   • The POSTGRES_* variables initialize the database container on first boot, and the Compose manifest reuses them in the Langflow connection string. Use only letters and numbers in the password, because symbols require %-encoding and $ conflicts with Compose interpolation.
   • LANGFLOW_CONFIG_DIR and LANGFLOW_KNOWLEDGE_BASES_DIR place application data and knowledge base vectors on the same volume-mapped path. Without the second variable, Langflow writes knowledge bases outside that volume and a container replacement deletes your vector data.
   • LANGFLOW_AUTO_LOGIN=False disables anonymous access, LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD define the administrator account that Langflow creates at startup, LANGFLOW_NEW_USER_IS_ACTIVE=False keeps new accounts inactive until the administrator approves them, and LANGFLOW_ENABLE_SUPERUSER_CLI=False blocks superuser creation from the command line.
   • OPENAI_API_KEY supplies the LLM provider credential, which Langflow stores as an encrypted global variable.

6. Restrict the environment file so that only its owner can read or modify it.

   CONSOLE

   Copy

   $ chmod 600 .env

   Explain Code

   Powered by Vultr AgentBeta

Deploy with Docker Compose

The stack runs three services. Traefik terminates HTTPS, Langflow serves the application on internal port 7860, and PostgreSQL stores flows, users, and settings. Langflow joins the proxy network with Traefik and the internal network with PostgreSQL, so the database stays unreachable from outside.

1. Create the docker-compose.yml file in the project directory.

   CONSOLE

   Copy

   $ nano docker-compose.yml

   Explain Code

   Powered by Vultr AgentBeta

2. Add the following service definitions to the file.

   YAML

   Copy

   services:
     traefik:
       image: traefik:v3.7
       restart: unless-stopped
       command:
         - --providers.docker=true
         - --providers.docker.exposedbydefault=false
         - --providers.docker.network=proxy
         - --entryPoints.web.address=:80
         - --entryPoints.websecure.address=:443
         - --entryPoints.websecure.http.tls=true
         - --entryPoints.web.http.redirections.entryPoint.to=websecure
         - --entryPoints.web.http.redirections.entryPoint.scheme=https
         - --certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}
         - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
         - --certificatesresolvers.le.acme.httpchallenge.entrypoint=web
       ports:
         - "80:80"
         - "443:443"
       volumes:
         - /var/run/docker.sock:/var/run/docker.sock:ro
         - ./letsencrypt:/letsencrypt
       networks:
         - proxy
   
     langflow:
       image: langflowai/langflow:1.11.3
       restart: unless-stopped
       depends_on:
         postgres:
           condition: service_healthy
       environment:
         - LANGFLOW_DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
         - LANGFLOW_CONFIG_DIR=${LANGFLOW_CONFIG_DIR}
         - LANGFLOW_KNOWLEDGE_BASES_DIR=${LANGFLOW_KNOWLEDGE_BASES_DIR}
         - LANGFLOW_AUTO_LOGIN=${LANGFLOW_AUTO_LOGIN}
         - LANGFLOW_SUPERUSER=${LANGFLOW_SUPERUSER}
         - LANGFLOW_SUPERUSER_PASSWORD=${LANGFLOW_SUPERUSER_PASSWORD}
         - LANGFLOW_SECRET_KEY=${LANGFLOW_SECRET_KEY}
         - LANGFLOW_NEW_USER_IS_ACTIVE=${LANGFLOW_NEW_USER_IS_ACTIVE}
         - LANGFLOW_ENABLE_SUPERUSER_CLI=${LANGFLOW_ENABLE_SUPERUSER_CLI}
         - OPENAI_API_KEY=${OPENAI_API_KEY}
       volumes:
         - langflow-data:/app/langflow
       networks:
         - proxy
         - internal
       labels:
         - traefik.enable=true
         - traefik.http.routers.langflow.rule=Host(`${LANGFLOW_HOSTNAME}`)
         - traefik.http.routers.langflow.entrypoints=websecure
         - traefik.http.routers.langflow.tls.certresolver=le
         - traefik.http.services.langflow.loadbalancer.server.port=7860
   
     postgres:
       image: postgres:16-trixie
       restart: unless-stopped
       environment:
         - POSTGRES_USER=${POSTGRES_USER}
         - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
         - POSTGRES_DB=${POSTGRES_DB}
       healthcheck:
         test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
         interval: 5s
         timeout: 5s
         retries: 10
       volumes:
         - langflow-postgres:/var/lib/postgresql/data
       networks:
         - internal
   networks:
     proxy:
       name: proxy
     internal:
   
   volumes:
     langflow-data:
     langflow-postgres:

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file. The three services fit together as follows:

   • The traefik service publishes ports 80 and 443, discovers only explicitly labeled containers through the read-only Docker socket, and registers a certificate resolver named le that completes the Automatic Certificate Management Environment (ACME) challenge on port 80 and redirects plain HTTP requests to HTTPS.
   • The langflow service pins the langflowai/langflow:1.11.3 image, the release that matches every interface step in this article. The Traefik labels route your domain to port 7860 inside the container, and the langflow-data volume persists LANGFLOW_CONFIG_DIR across restarts.
   • The postgres service pins the postgres:16-trixie image, which fixes the PostgreSQL version and the Debian base and prevents glibc collation mismatch warnings. It joins only the internal network, and its pg_isready health check gates the Langflow start.

3. Start the stack in detached mode.

   CONSOLE

   Copy

   $ docker compose up -d

   Explain Code

   Powered by Vultr AgentBeta

   Docker Compose pulls the three images, creates the networks and volumes, and starts Langflow after the PostgreSQL health check passes.

4. Verify that all containers are running.

   CONSOLE

   Copy

   $ docker compose ps

   Explain Code

   Powered by Vultr AgentBeta

   The output displays three running containers, with Traefik listening on ports 80 and 443 and PostgreSQL reporting a healthy status.

5. Check the Langflow logs to verify that the application started.

   CONSOLE

   Copy

   $ docker compose logs -f langflow

   Explain Code

   Powered by Vultr AgentBeta

   The first start takes a few minutes because Langflow runs its database migrations against PostgreSQL. The log stream ends with a startup banner when the application is ready.

   Output:

   Open Langflow → http://localhost:7860

   Press Ctrl + C to stop following the logs. The localhost address applies inside the container only, and Traefik forwards your domain traffic to the same listener.

Access and Configure Langflow

The stack now runs behind HTTPS, so the remaining configuration happens in the browser. Sign in with the administrator account and verify that Langflow registered the OpenAI credential.

1. Open a web browser and visit your Langflow domain, such as https://langflow.example.com.

   Traefik requests a Let's Encrypt certificate after the stack starts. If the browser shows a certificate warning, wait a minute, and then reload the page. Because automatic login is off, Langflow redirects you to the /login page.

2. Log in with the values that you set for LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD. The Langflow Projects page opens.

   

3. Verify the model provider. Click your profile icon in the header, select Settings, and then click Model Providers. The OpenAI provider appears as configured because Langflow detects the OPENAI_API_KEY variable at startup. Enable the models that you plan to use under Language Models and Embedding Models.

4. Verify the stored credential. In Settings, click Global Variables. A variable named OPENAI_API_KEY appears with the Credential type, which masks its value in the visual editor.

Build a RAG Chatbot to Validate the Deployment

A RAG chatbot answers questions from your own documents instead of relying only on the model's training data. Langflow ships a Vector Store RAG template that pairs a retrieval flow with a knowledge base, which chunks a document, embeds it, and stores the vectors locally. A grounded answer in the Playground proves that ingestion, retrieval, and generation all work on the deployed stack.

Create a Knowledge Base from a Sample Document

The knowledge base handles document ingestion, so it needs an update only when the source content changes.

1. On the Projects page, click Knowledge below the list of projects.

2. Click Add Knowledge.

3. In the Create Knowledge Base pane, enter a name such as langflow_demo, select an OpenAI embedding model, and keep Chroma Local as the DB Provider. The Chroma Local provider stores the vectors on the server, so the knowledge base requires no external database account.

4. Click Add Files. Select a document from your local machine, such as a product manual or a policy document.

5. Keep the default values for Chunk Size, Chunk Overlap, and Separator, and then click Next Step.

6. Review the sample chunk in the Review & Build pane, and then click Create. Langflow splits the document into chunks, converts each chunk into a vector, and indexes the results.

7. Wait until the knowledge base Status changes to Ready, which means that the ingestion pipeline completed without errors.

   

Create the Flow from the Vector Store RAG Template

The template arrives pre-connected, so setup comes down to two picks: the knowledge base and the chat model.

1. On the Projects page, click New Flow, and then select the Vector Store RAG template.

2. Review how the components connect. Chat Input sends each question to Knowledge as the Search Query and to Prompt as the {question} variable. Knowledge returns matching chunks, Parser extracts their text, and Prompt inserts that text as {context}. Agent generates the answer, and Chat Output returns it.

3. In the Knowledge component, keep Retrieve as the Mode, and select your langflow_demo knowledge base in the Knowledge field. Retrieval reuses the embedding model from ingestion, so query vectors and stored vectors stay comparable.

4. In the Agent component, select an OpenAI chat model in the Language Model field. The template preloads Agent Instructions with a retrieval-focused system prompt.

5. Review the Prompt component. Adjust the wording if you want a different tone, but keep the {context} and {question} placeholders intact.

   

Test the Chatbot in the Playground

The Playground provides a chat interface wired to the flow for validating the end-to-end pipeline.

1. Click Playground. A chat panel opens.

2. Type a question that only your uploaded document can answer, and then press Enter.

3. Read the response. The flow runs a semantic search against the knowledge base, pulls the most similar chunks, and instructs the language model to answer from that context.

4. Ask a follow-up question about a different part of the document to verify that retrieval covers the full file rather than a single chunk.

   

Conclusion

You have deployed Langflow on a Linux server with Docker Compose, with Traefik for TLS termination, and with PostgreSQL storing your flows, users, and settings. Superuser authentication protects the visual editor, an encrypted global variable holds the LLM provider credential, and a working Vector Store RAG chatbot answers questions from your uploaded document. For more configuration options, visit the Langflow documentation.