LibreChat with External MongoDB - Software Sushi

1. Launch the instance

Choose t3.large, 8 GiB RAM, with at least 40 GiB encrypted gp3 root storage. Use Ubuntu 24.04 x86_64, require IMDSv2 and attach your own instance profile with Session Manager permissions. Allow outbound connectivity to Systems Manager, your MongoDB endpoint and Amazon Bedrock. No inbound application port is needed.

Open a Session Manager shell after cloud-init and automatic first boot finish. First boot creates the instance encryption/session identity once. The application waits for your database configuration; an unconfigured status is expected at this stage.

sudo cloud-init status --wait
sudo -iu ubuntu

2. Prepare your database and model access

Supply a reachable customer-managed MongoDB deployment, an explicit application database and database credentials with the permissions that application needs. Use TLS with certificate/hostname verification and SCRAM-SHA-256 authentication. Include the application database and the appropriate authentication source in the MongoDB URI. Use your database provider's supported TLS connection string; do not disable certificate verification. No database server or database account is created by this image.

The supplied model is Amazon Bedrock / Amazon Nova Lite, model amazon.nova-lite-v1:0, in us-east-1. Your EC2 instance role must permit bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream for the selected model, and your AWS account must have access to it. The image contains no static AWS credentials.

3. Configure the application and create its first owner

Run the following in the instance shell. The configuration command prompts for the external MongoDB URI without echoing it. The owner command asks for your email, name, username and a password of 16–128 characters. Use a name of 3–80 characters. Keep secrets out of shell arguments, logs, screenshots and support requests. Wait for the service to connect before creating the owner.

sudo sushi-librechat configure
sudo systemctl status librechat.service --no-pager
sudo sushi-librechat create-owner

Public registration and social login are disabled. An existing administrator is preserved; create-owner does not replace that account. If your MongoDB service needs a custom CA, the supported configuration file fields are mongodb_uri and mongodb_ca_file, pointing to your PEM CA certificate. Use a regular mode 0600 JSON file owned by the administrator and pass only its filename with configure --connection-file; never put the URI in command arguments.

4. Open the chat UI from your workstation

Install and configure AWS CLI with the Session Manager plugin and your own authorized AWS profile. In a workstation terminal, run this command and enter your actual EC2 instance ID. Keep that terminal running.

printf "EC2 instance ID: "
IFS= read -r LIBRECHAT_INSTANCE_ID
aws ssm start-session --region us-east-1 --target "$LIBRECHAT_INSTANCE_ID" \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["3080"],"localPortNumber":["3080"]}'

Open http://localhost:3080 in your browser and sign in using the owner account you just created. The service listens only on 127.0.0.1:3080. Keep the forwarded port on localhost. Select Bedrock / Amazon Nova Lite and start a new non-temporary conversation. Sending a prompt makes a real model request and incurs your applicable Bedrock charges.

5. Understand artifact previews

HTML, SVG, Markdown and Office artifact previews show static sanitized markup. React, JSX and TSX artifacts provide source editing, copying and download. Mermaid diagrams use the native renderer. Sandpack/Nodebox interactive JavaScript execution is unavailable. Artifact scripts, remote resources and preview link navigation are also unavailable, so previews may look different from interactive upstream previews. Downloads contain the source or original attachment.

The supplied configuration does not include search, RAG, MCP servers, image-processing workflows, Redis, a MongoDB server, model weights or a provider account.

6. Optionally verify a saved browser conversation

Switch to the ubuntu account in the instance shell. The following prompts for the owner account and writes a new user-owned mode 0600 file without displaying the password. It refuses to overwrite an existing acceptance file; retain an existing correct file. The last command prepares a unique public challenge and exits 3 while waiting for browser action. That is an incomplete verification, not success.

umask 077
python3 -c '
import getpass, json, os
from pathlib import Path
values = {"email": input("Owner email: "), "password": getpass.getpass("Owner password (hidden): ")}
path = Path.home() / ".config/librechat/acceptance.json"
path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
with path.open("x") as stream:
    os.fchmod(stream.fileno(), 0o600)
    json.dump(values, stream)
    stream.write("\n")
'
bash /opt/sushi/docs/demo.sh

Send the printed challenge once from a new, non-temporary browser chat using Bedrock / Amazon Nova Lite. Wait for the completed response, then run:

bash /opt/sushi/docs/demo.sh --verify-pending

The CLI sends no chat requests. It reads the saved user/assistant turn through the authenticated API and checks the challenge, completion, parent message and model. Only a successful readback prints SUSHI_CUSTOMER_DEMO_PASSED. Receipts are saved under ~/librechat-results. A timeout retains the pending challenge; inspect the UI and retry verification before sending anything again.

After a service restart or instance reboot, reread an earlier verified turn without another model request:

/opt/sushi/bin/librechat-acceptance --verify-prior-only

This requires an earlier successful receipt and no pending challenge. It checks saved message hashes and does not turn an earlier incomplete task into success.

7. Back up and recover

Conversation state lives in your external MongoDB database. Uploads, images, application data and logs live in /var/lib/librechat. Back up /etc/librechat, including its original identity.env, together with application state and an application-consistent backup of the external database. Losing the encryption keys can make stored provider credentials unreadable. Restore these components consistently and preserve the existing identity.

sudo systemctl status librechat.service --no-pager
sudo journalctl -u librechat.service -n 100 --no-pager
sudo systemctl restart librechat.service

For connection errors, check the database endpoint, permissions, TLS certificate chain and network path, then rerun sudo sushi-librechat configure as needed. Read logs in your own session and redact credentials/customer data before sharing them. Preserve data while resolving failures. The application runs as the non-login librechat user with read-only program files.

Software price, support and terms

USD 0.03 per running instance-hour for software. EC2, EBS, data transfer, external MongoDB hosting and Bedrock model requests are billed separately.

Software Sushi provides AMI packaging and setup guidance. Contact info@softwaresushi.com for installation questions. Support coverage requires a separate agreement; this offer does not include upstream project support.

We offer a full refund of software charges for the first 48 hours billing starts if the product does not perform as described. To request a refund, email info@softwaresushi.com with your EC2 instance ID and a description of the issue. AWS infrastructure costs (EC2, EBS, data transfer) are not eligible for refund by us.

This is a repackaged open source software product wherein additional charges apply for independent AMI packaging, maintenance and setup documentation. Software Sushi is an independent packager and claims no upstream or AWS endorsement. LibreChat is licensed under MIT. Bundled dependencies retain their own licenses and notices. See the offer for the AWS Marketplace Standard EULA and final commercial terms.

On-instance instructions are at /opt/sushi/docs/README.md and /opt/sushi/docs/DEMO.md. Application/Node license notices and the selected source materials are under /usr/share/doc/librechat and /usr/share/doc/librechat/sources. Upstream source: LibreChat-AI/LibreChat.