name | description | languages | products | page_type | urlFragment | |||||
---|---|---|---|---|---|---|---|---|---|---|
Langfuse on Azure |
Deploy Langfuse to Azure Container Apps using the Azure Developer CLI. |
|
|
sample |
langfuse-on-azure |
Use the Azure Developer CLI to deploy Langfuse to Azure Container Apps with PostgreSQL Flexible server.
Langfuse is a platform for LLM observability and evaluation. They provide an open-source SDK and containerized web application to receive the SDK's data. This project deploys the Langfuse web application to Azure Container Apps, and uses PostgreSQL to store the data. It also includes a script to set up Entra-based authentication for the web app. Once you have deployed Langfuse, you can integrate the SDK into your LLM applications according to the Langfuse documentation and start sending data to the web app.
Table of contents:
You have a few options for setting up this project. The easiest way to get started is GitHub Codespaces, since it will setup all the tools for you, but you can also set it up locally if desired.
You can run this repo virtually by using GitHub Codespaces, which will open a web-based VS Code in your browser:
Once the codespace opens (this may take several minutes), open a terminal window.
A related option is VS Code Dev Containers, which will open the project in your local VS Code using the Dev Containers extension:
- Start Docker Desktop (install it if not already installed)
- Open the project:
- In the VS Code window that opens, once the project files show up (this may take several minutes), open a terminal window.
-
Install the required tools:
- Azure Developer CLI
- Python 3.9, 3.10, or 3.11 (Only necessary if you want to enable authentication via script)
-
Clone this repository
-
Create a Python virtual environment and install the required package. We use pipenv and the required packages are defined in the Pipfile and Pipfile.lock in the root directory. If the user prefers using venv, the requirements.txt file is found in the root.
pipenv install pipenv shell
Follow these steps to deploy Langfuse to Azure:
-
Login to your Azure account:
azd auth login
-
Create a new azd environment:
azd env new <env-name>
This will create a new folder in the
.azure
folder, and set it as the active environment for any calls toazd
going forward. -
(Optional) By default, the deployed Azure Container App will use the Langfuse authentication system, meaning anyone with routable network access to the web app can attempt to login to it. To enable Entra-based authentication, set the
AZURE_USE_AUTHENTICATION
environment variable totrue
:azd env set AZURE_USE_AUTHENTICATION true
Then set the
AZURE_AUTH_TENANT_ID
environment variable to your tenant ID:azd env set AZURE_AUTH_TENANT_ID your-tenant-id
To disable username and password as authentication method, set the
AUTH_DISABLE_USERNAME_PASSWORD
environment variable totrue
azd env set AUTH_DISABLE_USERNAME_PASSWORD true
⚠️ IMPORTANT: Azure authentication requires app registration. If theAZURE_USE_AUTHENTICATION
environment variable is set totrue
, the deployment will use theauth_init.sh
andauth_update.sh
hooks to set up the necessary resources for Entra-based authentication, including app registration, and pass the necessary environment variables to the Azure Container App. If script-based app registration is not allowed, deploy the resources withAZURE_USE_AUTHENTICATION
set tofalse
and change it manually after deployment. -
Run this command to provision all the resources:
azd provision
This will create a new resource group, and create the Azure Container App and PostgreSQL Flexible server inside that group. If you enabled authentication, it will use the
auth_init.sh
andauth_update.sh
hooks to set up the necessary resources for Entra-based authentication, and pass the necessary environment variables to the Azure Container App. -
Once the deployment is complete, you will see the URL for the Azure Container App in the output. You can open this URL in your browser to see the Langfuse web app.
If at deployment the default Langfuse username/password authentication was selected, you can change it to Azure authentication manually.
- Manual App registration
- Manually add secrets to the Container App:
- Navigate to the Azure Portal
- Select the deployed Container App
- Navigate to Settings -> Secrets
- Update the
authclientsecret
- Manually add requireed environment variables to the Container App:
- Navigate to Application -> Revisions and Replicas
- Select
Create new revision
- Select the container image and
Edit
- Select the
Environment variables
Tab. - Add (or Edit if already existing)
AUTH_AZURE_AD_TENANT_ID
, Source=Manual entry
, Value=<your-tenant-id>
- Add (or Edit if already existing)
AUTH_AZURE_AD_CLIENT_ID
, Source=Manual entry
, Value=<your-client-id>
- Add (or Edit if already existing)
AUTH_AZURE_AD_CLIENT_SECRET
, Source=Reference a secret
, Value=authclientsecret
The Langfuse deployment can also be partly customized through the usage of environment variables. The user can find the list of environment variables in the official documentation.
⚠️ IMPORTANT: The Langfuse image that is deployed is the Version 2 of the Langfuse software. A later version (V3) has been released in December 2024, however as of now (February 2025) the latest version cannot yet be easily self-hosted in Azure.
⚠️ IMPORTANT: The default deployment is for the Free version of the self-hosted Langfuse. Langfuse allows additional customizations under the Enterprise Edition.