WeKnora

> **Turn documents into living knowledge with RAG, Agents and Auto-Wiki** WeKnora is an open-source LLM-powered knowledge framework by Tencent, supporting multiple data sources, document formats, and major LLMs with enterprise-grade document understanding, semantic retrieval, and autonomous reasoning. ## Architecture This port includes the following services: | Service | Image | Description | |---------|-------|-------------| | frontend | `wechatopenai/weknora-ui:v0.5.2` | Frontend UI (NGINX reverse proxy) | | weknoraapp | `wechatopenai/weknora-app:v0.5.2` | Backend API service | | docreader | `wechatopenai/weknora-docreader:v0.5.2` | Document parsing service (gRPC) | | postgres | `paradedb/paradedb:v0.23.4-pg17` | PostgreSQL 17 + pgvector vector search | | redis | `redis:7-alpine` | Cache & message queue | ## Auto Login This port implements **passwordless auto-login** via a three-phase inject script: 1. **Request phase** — Captures email and password when the user first registers 2. **Response phase** — Persists credentials upon successful registration 3. **Browser phase** — Auto-fills saved email and password on subsequent login page visits > First-time users need to register an account on the login page. After that, subsequent visits will auto-login. ## Deployment Parameters ### General | Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | `ENABLE_GRAPH_RAG` | bool | No | `false` | Enable GraphRAG (Knowledge Graph) features | | `MAX_FILE_SIZE_MB` | int | No | `50` | Maximum upload file size in MB | | `SSRF_WHITELIST` | string | No | `*.heiyu.space` | Comma-separated SSRF whitelist patterns (e.g. `*.example.com, 10.0.0.0/8`) | ### GraphRAG (required when GraphRAG is enabled) | Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | `NEO4J_URI` | string | No | — | Neo4J connection URI (e.g. `bolt://host:7687`) | | `NEO4J_USERNAME` | string | No | — | Neo4J username | | `NEO4J_PASSWORD` | secret | No | — | Neo4J password | ### Langfuse Observability (required when Langfuse is enabled) | Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | `LANGFUSE_ENABLED` | bool | No | `false` | Enable Langfuse tracing | | `LANGFUSE_HOST` | string | No | — | Langfuse server URL (e.g. `https://langfuse.example.com`) | | `LANGFUSE_PUBLIC_KEY` | string | No | — | Langfuse public key | | `LANGFUSE_SECRET_KEY` | secret | No | — | Langfuse secret key | ### Distributed Tracing | Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | `OTEL_EXPORTER_OTLP_ENDPOINT` | string | No | — | Jaeger OTLP endpoint (e.g. `jaeger:4317`) | > **Note**: WeKnora's OpenTelemetry tracing currently only supports gRPC protocol export. If you configured `OTEL_EXPORTER_OTLP_ENDPOINT` but don't see data in Jaeger, make sure the endpoint uses gRPC (default port 4317), not HTTP (port 4318). Langfuse tracing works independently from OTEL — simply enable `LANGFUSE_ENABLED=true`. ## SSRF Whitelist WeKnora has built-in SSRF protection that blocks requests to private/internal IPs. If your LLM service is deployed on an internal network (e.g. resolving to a private IP), add its domain to `SSRF_WHITELIST`: - Supported formats: exact domain (`example.com`), wildcard (`*.example.com`), IP/CIDR (`10.0.0.0/8`) - Multiple rules are comma-separated - Default value `*.heiyu.space` covers common Lazycat platform domains ## Data Persistence | Path | Description | |------|-------------| | `/lzcapp/var/postgres/data` | PostgreSQL data | | `/lzcapp/var/redis/data` | Redis data | | `/lzcapp/var/files` | Uploaded files | | `/lzcapp/var/docreader-tmp` | Document parsing temp files | ## Notes 1. **First startup**: The backend service waits for PostgreSQL and Redis to be ready before starting. Initial database setup may take a while. 2. **GraphRAG**: Ensure Neo4J is properly deployed and accessible before enabling GraphRAG, and fill in `NEO4J_URI`, `NEO4J_USERNAME`, `NEO4J_PASSWORD`. 3. **Langfuse**: Ensure Langfuse is properly deployed and accessible before enabling, and fill in `LANGFUSE_HOST`, `LANGFUSE_PUBLIC_KEY`, `LANGFUSE_SECRET_KEY`. 4. **SSRF whitelist**: Domains of internally deployed LLM services must be added to `SSRF_WHITELIST`, otherwise requests will be blocked by SSRF protection. ## References - Project homepage: https://github.com/Tencent/WeKnora - FAQ: https://github.com/Tencent/WeKnora/blob/main/docs/QA.md - License: MIT License