@r8s/librechat 0.2.0

package/__tests__/librechat.test.ts

@@ -0,0 +1,545 @@
+import { describe, it, expect } from 'vitest'
+import { render, jsx } from '@r8s/core'
+import { OperatorContext, SecretContext, RoutingContext } from '@r8s/core/defaults'
+import { runGuardrails, noPlaintextSecrets, validateResource } from '@r8s/core'
+import { operators } from '@r8s/crds'
+import type { r8sElement } from '@r8s/core'
+
+// LibreChat recipe tests:
+//   1. Operator declarations (deduped via OperatorContext)
+//   2. Rendering: defaults, Meilisearch, all props, gateway/ingress adaptation
+//   3. MongoDB wiring: MONGO_URI expansion + secretKeyRef credentials
+//   4. Env wiring: reverse proxy, redis, search, session credentials,
+//      upstream env names, no duplicate env names
+//   5. Security: no plaintext credentials in rendered output
+import { LibreChat } from '../src/index'
+
+const openbao = { backend: 'openbao', mount: 'kv', path: 'test' }
+
+const mongodb = {
+  host: 'mongo.data.svc.cluster.local',
+  port: 27017,
+  passwordSecret: 'chat-mongodb-credentials',
+}
+
+const sso = {
+  issuer: 'https://keycloak.example.com/realms/platform',
+  clientId: 'librechat',
+  clientSecretRef: { secret: 'librechat-sso', key: 'clientSecret' },
+}
+
+/** Render LibreChat inside a Platform-like secrets backend (OpenBao). */
+function renderLibreChat(props: Record<string, unknown>): ReturnType<typeof render> {
+  return render(
+    jsx(SecretContext.Provider, {
+      value: openbao as never,
+      children: jsx(LibreChat, props as never),
+    })
+  )
+}
+
+/** Wrap LibreChat in an OperatorContext (no secrets backend). */
+function elementWithContext(ops: any[], props: Record<string, unknown>): r8sElement {
+  return jsx(OperatorContext.Provider, {
+    value: ops,
+    children: jsx(LibreChat, props as never),
+  })
+}
+
+/**
+ * k8s rejects duplicate env names in one container — assert every env
+ * list we render is unique (this bit us with `$(VAR)` self-echoes of
+ * secretKeyRef-backed vars).
+ */
+function assertUniqueEnvNames(env: Array<{ name: string }>): void {
+  const names = env.map((e) => e.name)
+  const dupes = names.filter((n, i) => names.indexOf(n) !== i)
+  expect(dupes).toEqual([])
+  expect(new Set(names).size).toBe(names.length)
+}
+
+describe('operator declarations', () => {
+  it('declares the redis operator when cache is enabled', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    expect(result.operators.some((op) => op.name === 'redis-operator')).toBe(true)
+  })
+
+  it('skips the redis operator when cache is disabled', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb, cache: false })
+    expect(result.operators.some((op) => op.name === 'redis-operator')).toBe(false)
+  })
+
+  it('never declares cnpg (MongoDB is provisioned externally)', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    expect(result.operators.some((op) => op.name === 'cnpg')).toBe(false)
+  })
+
+  it('deduplicates operators provided via context', () => {
+    const result = render(
+      elementWithContext([operators['redis-operator']()], {
+        host: 'chat.example.com',
+        mongodb,
+        secretsName: 'existing-secrets',
+      })
+    )
+    const names = result.operators.map((op) => op.name)
+    expect(names.filter((n) => n === 'redis-operator')).toHaveLength(1)
+  })
+
+  it('allows version overrides through context operators', () => {
+    const result = render(
+      elementWithContext([operators['redis-operator']('1.0.0')], {
+        host: 'chat.example.com',
+        mongodb,
+        secretsName: 'existing-secrets',
+      })
+    )
+    const redis = result.operators.filter((op) => op.name === 'redis-operator')
+    expect(redis).toHaveLength(1)
+    expect(redis[0].version).toBe('1.0.0')
+  })
+})
+
+describe('rendering defaults', () => {
+  it('renders app deployment, service, ingress and redis', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    const kinds = result.resources.map((r) => r.kind)
+    expect(kinds).toContain('Deployment')
+    expect(kinds).toContain('Service')
+    expect(kinds).toContain('Ingress')
+    expect(kinds).toContain('RedisReplication')
+    expect(kinds).not.toContain('RedisCluster')
+    expect(kinds).toContain('OpenBaoStaticSecret')
+  })
+
+  it('renders a Meilisearch deployment with health probes and resources when search is enabled', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb, search: true })
+    const deployments = result.resources.filter((r) => r.kind === 'Deployment')
+    const services = result.resources.filter((r) => r.kind === 'Service')
+    expect(deployments.map((d: any) => d.metadata.name)).toContain('librechat-meilisearch')
+    expect(services.map((s: any) => s.metadata.name)).toContain('librechat-meilisearch')
+    const meili = deployments.find((d: any) => d.metadata.name === 'librechat-meilisearch') as any
+    expect(meili.spec.template.spec.containers[0].image).toBe('getmeili/meilisearch:v1.6')
+    const meiliContainer = meili.spec.template.spec.containers[0]
+    expect(meiliContainer.livenessProbe.httpGet).toEqual({ path: '/health', port: 7700 })
+    expect(meiliContainer.readinessProbe.httpGet).toEqual({ path: '/health', port: 7700 })
+    expect(meiliContainer.resources).toEqual({
+      requests: { memory: '256Mi', cpu: '100m' },
+      limits: { memory: '1Gi', cpu: '500m' },
+    })
+    assertUniqueEnvNames(meiliContainer.env)
+  })
+
+  it('renders no Meilisearch resources and no SEARCH flag when search is disabled', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    const names = result.resources
+      .filter((r) => r.kind === 'Deployment' || r.kind === 'Service')
+      .map((r: any) => r.metadata.name)
+    expect(names).not.toContain('librechat-meilisearch')
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    expect(env.find((e: any) => e.name === 'SEARCH')).toBeUndefined()
+  })
+
+  it('quotes the redis master service and enables USE_REDIS', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    const redis = result.resources.find((r) => r.kind === 'RedisReplication') as any
+    expect(redis.metadata.name).toBe('librechat-redis')
+    expect(redis.spec.clusterSize).toBe(3)
+    expect(redis.spec.kubernetesConfig.image).toBe('redis:7.2-alpine')
+
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    expect(env.find((e: any) => e.name === 'USE_REDIS').value).toBe('true')
+    expect(env.find((e: any) => e.name === 'REDIS_URI').value).toBe('redis://librechat-redis:6379')
+  })
+
+  it('renders gateway resources when platform uses gateway routing', () => {
+    const result = render(
+      jsx(RoutingContext.Provider, {
+        value: { mode: 'gateway', gatewayClassName: 'eg' },
+        children: jsx(SecretContext.Provider, {
+          value: openbao as never,
+          children: jsx(LibreChat, { host: 'chat.example.com', mongodb }),
+        }),
+      })
+    )
+    const kinds = result.resources.map((r) => r.kind)
+    expect(kinds).toContain('HTTPRoute')
+  })
+
+  it('renders a valid Ingress when platform uses ingress routing', () => {
+    const result = render(
+      jsx(RoutingContext.Provider, {
+        value: { mode: 'ingress' },
+        children: jsx(SecretContext.Provider, {
+          value: openbao as never,
+          children: jsx(LibreChat, { host: 'chat.example.com', mongodb }),
+        }),
+      })
+    )
+    const ingress = result.resources.find((r) => r.kind === 'Ingress') as any
+    expect(ingress).toBeDefined()
+    expect(ingress.spec.rules[0].host).toBe('chat.example.com')
+  })
+
+  it('sets websocket-friendly proxy annotations on the Ingress', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    const ingress = result.resources.find((r) => r.kind === 'Ingress') as any
+    expect(ingress.metadata.annotations).toMatchObject({
+      'nginx.ingress.kubernetes.io/proxy-read-timeout': '300',
+      'nginx.ingress.kubernetes.io/proxy-send-timeout': '300',
+      'nginx.ingress.kubernetes.io/proxy-buffering': 'off',
+    })
+  })
+
+  it('passes resource validation', () => {
+    const result = renderLibreChat({
+      host: 'chat.example.com',
+      mongodb,
+      search: true,
+      sso,
+    })
+    for (const resource of result.resources) {
+      expect(validateResource(resource)).toEqual([])
+    }
+  })
+})
+
+describe('rendering with all props', () => {
+  it('accepts the full prop surface', () => {
+    const result = renderLibreChat({
+      name: 'chat',
+      namespace: 'chat',
+      version: '0.7.8',
+      host: 'chat.example.com',
+      port: 3080,
+      replicas: 3,
+      mongodb: { ...mongodb, username: 'chat' },
+      cache: true,
+      search: true,
+      sso,
+      backend: 'https://api.berget.ai/v1',
+      resources: {
+        requests: { memory: '1Gi', cpu: '500m' },
+        limits: { memory: '4Gi', cpu: '2000m' },
+      },
+      tls: { secretName: 'chat-tls', clusterIssuer: 'letsencrypt-prod' },
+    })
+
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'chat'
+    ) as any
+    expect(app).toBeDefined()
+    expect(app.spec.replicas).toBe(3)
+    expect(app.spec.template.spec.containers[0].image).toBe('ghcr.io/danny-avila/librechat:0.7.8')
+    expect(app.spec.template.spec.containers[0].resources.limits.memory).toBe('4Gi')
+    expect(app.spec.template.spec.containers[0].ports[0].containerPort).toBe(3080)
+    assertUniqueEnvNames(app.spec.template.spec.containers[0].env)
+  })
+})
+
+describe('mongodb wiring', () => {
+  it('builds MONGO_URI with $(VAR) expansion and the database named after the resource', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    const mongoUri = env.find((e: any) => e.name === 'MONGO_URI')
+    expect(mongoUri.value).toBe(
+      'mongodb://$(MONGO_USERNAME):$(MONGO_PASSWORD)@mongo.data.svc.cluster.local:27017/librechat'
+    )
+  })
+
+  it('appends authSource when the mongodb connection declares one', () => {
+    const result = renderLibreChat({
+      host: 'chat.example.com',
+      mongodb: { ...mongodb, authSource: 'admin' },
+    })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    expect(env.find((e: any) => e.name === 'MONGO_URI').value).toBe(
+      'mongodb://$(MONGO_USERNAME):$(MONGO_PASSWORD)@mongo.data.svc.cluster.local:27017/librechat?authSource=admin'
+    )
+  })
+
+  it('delivers MONGO_USERNAME / MONGO_PASSWORD via secretKeyRef from the password secret', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    const username = env.find((e: any) => e.name === 'MONGO_USERNAME')
+    const password = env.find((e: any) => e.name === 'MONGO_PASSWORD')
+    expect(username.valueFrom.secretKeyRef).toEqual({
+      name: 'chat-mongodb-credentials',
+      key: 'username',
+    })
+    expect(password.valueFrom.secretKeyRef).toEqual({
+      name: 'chat-mongodb-credentials',
+      key: 'password',
+    })
+    expect(username.value).toBeUndefined()
+    expect(password.value).toBeUndefined()
+  })
+
+  it('inlines an explicitly provided username (identifier, not secret)', () => {
+    const result = renderLibreChat({
+      host: 'chat.example.com',
+      mongodb: { ...mongodb, username: 'chat' },
+    })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    const username = env.find((e: any) => e.name === 'MONGO_USERNAME')
+    const password = env.find((e: any) => e.name === 'MONGO_PASSWORD')
+    expect(username.value).toBe('chat')
+    expect(username.valueFrom).toBeUndefined()
+    expect(password.valueFrom.secretKeyRef.key).toBe('password')
+  })
+
+  it('shares MEILI_MASTER_KEY with the main app via the secrets bundle when search is on', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb, search: true })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    expect(env.find((e: any) => e.name === 'SEARCH').value).toBe('true')
+    expect(env.find((e: any) => e.name === 'MEILI_HOST').value).toBe(
+      'http://librechat-meilisearch:7700'
+    )
+    const meiliKey = env.find((e: any) => e.name === 'MEILI_MASTER_KEY')
+    expect(meiliKey.valueFrom.secretKeyRef.name).toBe('librechat-secrets')
+    expect(meiliKey.valueFrom.secretKeyRef.key).toBe('meiliMasterKey')
+    expect(meiliKey.value).toBeUndefined()
+    assertUniqueEnvNames(env)
+
+    const meiliDeployment = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat-meilisearch'
+    ) as any
+    const meiliEnv = meiliDeployment.spec.template.spec.containers[0].env
+    const meiliMasterKey = meiliEnv.find((e: any) => e.name === 'MEILI_MASTER_KEY')
+    expect(meiliMasterKey.valueFrom.secretKeyRef.name).toBe('librechat-secrets')
+    expect(meiliMasterKey.value).toBeUndefined()
+  })
+})
+
+describe('session credentials', () => {
+  it('wires JWT + CREDS multi-user credentials via secretKeyRef from the secrets bundle', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    const jwtSecret = env.find((e: any) => e.name === 'JWT_SECRET')
+    const jwtRefresh = env.find((e: any) => e.name === 'JWT_REFRESH_SECRET')
+    const credsKey = env.find((e: any) => e.name === 'CREDS_KEY')
+    const credsIv = env.find((e: any) => e.name === 'CREDS_IV')
+    expect(jwtSecret).toMatchObject({
+      valueFrom: { secretKeyRef: { name: 'librechat-secrets', key: 'jwtSecret' } },
+    })
+    expect(jwtRefresh).toMatchObject({
+      valueFrom: { secretKeyRef: { name: 'librechat-secrets', key: 'jwtRefreshSecret' } },
+    })
+    expect(credsKey).toMatchObject({
+      valueFrom: { secretKeyRef: { name: 'librechat-secrets', key: 'credsKey' } },
+    })
+    expect(credsIv).toMatchObject({
+      valueFrom: { secretKeyRef: { name: 'librechat-secrets', key: 'credsIv' } },
+    })
+    for (const e of [jwtSecret, jwtRefresh, credsKey, credsIv]) {
+      expect(e.value).toBeUndefined()
+    }
+    // REFRESH_TOKEN_EXPIRY is a plain TTL — delivered via configMapKeyRef
+    const refreshTokenExpiry = env.find((e: any) => e.name === 'REFRESH_TOKEN_EXPIRY')
+    expect(refreshTokenExpiry.valueFrom.configMapKeyRef).toEqual({
+      name: 'librechat-config',
+      key: 'REFRESH_TOKEN_EXPIRY',
+    })
+    expect(refreshTokenExpiry.value).toBeUndefined()
+    const configMap = result.resources.find(
+      (r: any) => r.kind === 'ConfigMap' && r.metadata.name === 'librechat-config'
+    ) as any
+    expect(configMap.data).toEqual({ REFRESH_TOKEN_EXPIRY: '604800' })
+    assertUniqueEnvNames(env)
+  })
+
+  it('resolves session credential keys against an explicit secretsName', () => {
+    const result = renderLibreChat({
+      host: 'chat.example.com',
+      mongodb,
+      secretsName: 'existing-secrets',
+    })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    for (const envName of ['JWT_SECRET', 'JWT_REFRESH_SECRET', 'CREDS_KEY', 'CREDS_IV']) {
+      expect(env.find((e: any) => e.name === envName).valueFrom.secretKeyRef.name).toBe(
+        'existing-secrets'
+      )
+    }
+  })
+})
+
+describe('secrets handling', () => {
+  it('provisions the app secrets bundle through a secrets backend', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    const bao = result.resources.find((r) => r.kind === 'OpenBaoStaticSecret') as any
+    expect(bao).toBeDefined()
+    expect(bao.spec.destination.name).toBe('librechat-secrets')
+    expect(bao.spec.path).toBe('test/librechat/secrets')
+  })
+
+  it('provisions the app secrets bundle through Vault', () => {
+    const result = render(
+      jsx(SecretContext.Provider, {
+        value: { backend: 'vault', mount: 'kv', path: 'apps' },
+        children: jsx(LibreChat, { host: 'chat.example.com', mongodb }),
+      })
+    )
+    const vault = result.resources.find((r) => r.kind === 'VaultStaticSecret') as any
+    expect(vault).toBeDefined()
+    expect(vault.spec.destination.name).toBe('librechat-secrets')
+    expect(vault.spec.path).toBe('apps/librechat/secrets')
+  })
+
+  it('accepts an existing secretsName without a backend', () => {
+    expect(() =>
+      render(
+        jsx(LibreChat, {
+          host: 'chat.example.com',
+          mongodb,
+          secretsName: 'existing-secrets',
+        })
+      )
+    ).not.toThrow()
+    const result = render(
+      jsx(LibreChat, {
+        host: 'chat.example.com',
+        mongodb,
+        secretsName: 'existing-secrets',
+      })
+    )
+    expect(
+      result.resources.find(
+        (r) => r.kind === 'OpenBaoStaticSecret' || r.kind === 'VaultStaticSecret'
+      )
+    ).toBeUndefined()
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    expect(env.find((e: any) => e.name === 'SECRET_KEY').valueFrom.secretKeyRef.name).toBe(
+      'existing-secrets'
+    )
+  })
+
+  it('throws when no secrets backend and no secretsName', () => {
+    expect(() => render(jsx(LibreChat, { host: 'chat.example.com', mongodb }))).toThrow(
+      /application secrets/
+    )
+  })
+
+  it('wires app credentials via secretKeyRef (never plaintext env)', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    const secretKey = env.find((e: any) => e.name === 'SECRET_KEY')
+    const modelApiKey = env.find((e: any) => e.name === 'OPENAI_API_KEY')
+    expect(secretKey.valueFrom.secretKeyRef.name).toBe('librechat-secrets')
+    expect(secretKey.valueFrom.secretKeyRef.key).toBe('secretKey')
+    expect(modelApiKey.valueFrom.secretKeyRef.name).toBe('librechat-secrets')
+    expect(modelApiKey.valueFrom.secretKeyRef.key).toBe('modelApiKey')
+    expect(secretKey.value).toBeUndefined()
+    expect(modelApiKey.value).toBeUndefined()
+  })
+
+  it('renders no plaintext credentials anywhere', () => {
+    const result = renderLibreChat({
+      host: 'chat.example.com',
+      mongodb,
+      search: true,
+      sso,
+    })
+    const { passed, errors } = runGuardrails(result.resources as any[], [noPlaintextSecrets])
+    if (!passed) {
+      console.error('Plaintext credential violations:', errors)
+    }
+    expect(passed).toBe(true)
+  })
+})
+
+describe('sso wiring', () => {
+  it('sets OPENID env vars and wires the client secret via secretKeyRef', () => {
+    const result = renderLibreChat({ host: 'chat.example.com', mongodb, sso })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    const names = env.map((e: any) => e.name)
+    assertUniqueEnvNames(env)
+    expect(env.find((e: any) => e.name === 'ALLOW_SOCIAL_LOGIN').value).toBe('true')
+    expect(env.find((e: any) => e.name === 'DOMAIN_SERVER').value).toBe('https://chat.example.com')
+    expect(env.find((e: any) => e.name === 'DOMAIN_CLIENT').value).toBe('https://chat.example.com')
+    expect(env.find((e: any) => e.name === 'OPENID_ISSUER').value).toBe(sso.issuer)
+    expect(env.find((e: any) => e.name === 'OPENID_CLIENT_ID').value).toBe(sso.clientId)
+    expect(env.find((e: any) => e.name === 'OPENID_SCOPES').value).toBe('openid profile email')
+    expect(env.find((e: any) => e.name === 'OPENID_CALLBACK_URL').value).toBe(
+      'https://chat.example.com/oauth/openid/callback'
+    )
+    const clientSecret = env.find((e: any) => e.name === 'OPENID_CLIENT_SECRET')
+    expect(clientSecret.valueFrom.secretKeyRef).toEqual({
+      name: 'librechat-sso',
+      key: 'clientSecret',
+    })
+    expect(clientSecret.value).toBeUndefined()
+    // no $(VAR) self-echo of the secretKeyRef-backed var
+    expect(names).not.toContain('OPENID_SCOPE')
+  })
+})
+
+describe('openai backend wiring', () => {
+  it('routes model calls through OPENAI_REVERSE_PROXY (no OPENAI_API_BASE_URL)', () => {
+    const result = renderLibreChat({
+      host: 'chat.example.com',
+      mongodb,
+      secretsName: 'existing-secrets',
+    })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    const names = env.map((e: any) => e.name)
+    expect(env.find((e: any) => e.name === 'OPENAI_REVERSE_PROXY').value).toBe(
+      'https://api.berget.ai/v1/chat/completions'
+    )
+    expect(names).not.toContain('OPENAI_API_BASE_URL')
+  })
+
+  it('honors a backend override with the chat/completions suffix', () => {
+    const result = renderLibreChat({
+      host: 'chat.example.com',
+      mongodb,
+      backend: 'https://api.example.com/v1',
+      secretsName: 'existing-secrets',
+    })
+    const app = result.resources.find(
+      (r: any) => r.kind === 'Deployment' && r.metadata.name === 'librechat'
+    ) as any
+    const env = app.spec.template.spec.containers[0].env
+    expect(env.find((e: any) => e.name === 'OPENAI_REVERSE_PROXY').value).toBe(
+      'https://api.example.com/v1/chat/completions'
+    )
+  })
+})

package/examples/basic.tsx

@@ -0,0 +1,17 @@
+import { Platform } from '@r8s/recipes'
+import { LibreChat } from '@r8s/librechat'
+
+export default (
+  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+    <LibreChat
+      name="chat"
+      host="chat.example.com"
+      mongodb={{ host: 'mongo.data.svc.cluster.local', passwordSecret: 'chat-mongodb-credentials' }}
+      sso={{
+        issuer: 'https://keycloak.example.com/realms/platform',
+        clientId: 'librechat',
+        clientSecretRef: { secret: 'librechat-sso', key: 'clientSecret' },
+      }}
+    />
+  </Platform>
+)

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@r8s/librechat",
+  "version": "0.2.0",
+  "description": "LibreChat multi-model AI chat — MongoDB (provisioned externally), Redis sessions, optional Meilisearch, OIDC SSO",
+  "license": "MIT",
+  "author": "Berget AI AB",
+  "homepage": "https://r8s.berget.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/berget-ai/r8s.git",
+    "directory": "packages/librechat"
+  },
+  "bugs": "https://github.com/berget-ai/r8s/issues",
+  "keywords": [
+    "librechat",
+    "chat",
+    "llm",
+    "rag"
+  ],
+  "r8s": {
+    "category": "AI & Chat"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc --build",
+    "test": "vitest run",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
+  },
+  "category": "AI & Assistants",
+  "dependencies": {
+    "@r8s/core": "^0.2.0",
+    "@r8s/crds": "^0.2.0",
+    "@r8s/k8s-types": "^0.2.0",
+    "@r8s/recipes": "^0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  }
+}

package/src/index.tsx

@@ -0,0 +1,384 @@
+import { jsx, Fragment, useContext, declareOperator } from '@r8s/core'
+import { OperatorContext, SecretContext } from '@r8s/core/defaults'
+import { operators } from '@r8s/crds'
+import { WebService, Endpoint } from '@r8s/recipes'
+import { RedisReplicationComponent } from '@r8s/crds/redis'
+import type { SecretRef } from '@r8s/recipes'
+import type { ConfigMap, EnvVar } from '@r8s/k8s-types'
+
+export interface MongoConnection {
+  /** MongoDB host (cluster-internal service or external host) */
+  host: string
+  /** MongoDB port (defaults to 27017) */
+  port?: number
+  /**
+   * Database username. Inlined as a plain env var — usernames are
+   * identifiers, not secrets (same convention as the n8n/outline DB
+   * recipes). When omitted, the username is read from the password
+   * secret (key: `username`).
+   */
+  username?: string
+  /**
+   * Name of an existing Secret holding the MongoDB credentials.
+   * Keys: `username`, `password`.
+   */
+  passwordSecret: string
+  /**
+   * authSource query parameter appended to MONGO_URI when set
+   * (e.g. 'admin' for databases authenticating against the admin db).
+   */
+  authSource?: string
+}
+
+export interface LibreChatProps {
+  /** Resource name (defaults to 'librechat') */
+  name?: string
+  /** Kubernetes namespace (defaults to 'default') */
+  namespace?: string
+  /** Container image tag (defaults to 'latest' — pin a version in production) */
+  version?: string
+  /** Public hostname for the chat UI (required) */
+  host: string
+  /** Port the app listens on in-container (defaults to 3080) */
+  port?: number
+  /** Number of replicas (defaults to 1) */
+  replicas?: number
+  /**
+   * External MongoDB connection (REQUIRED). LibreChat stores users,
+   * conversations and messages in MongoDB — this component does NOT
+   * provision it. Run MongoDB separately (replica-set StatefulSet,
+   * operator or managed service) and point this prop at it.
+   */
+  mongodb: MongoConnection
+  /** Provision a redis replication group for session caching (default: true) */
+  cache?: boolean
+  /**
+   * Add a Meilisearch sidecar service for full-text / RAG search
+   * (default: false). MEILI_MASTER_KEY is shared from the app secrets
+   * bundle (key: meiliMasterKey). Sets SEARCH=true on the app so it
+   * actually queries the meilisearch instance.
+   */
+  search?: boolean
+  /**
+   * OIDC SSO client — register LibreChat as a client in Keycloak (the
+   * Auth recipe) and reference the client secret through the backend.
+   * Uses the upstream OPENID_* env names; ALLOW_SOCIAL_LOGIN plus
+   * DOMAIN_SERVER/DOMAIN_CLIENT are set from `host`.
+   */
+  sso?: {
+    issuer: string
+    clientId: string
+    clientSecretRef: SecretRef
+    scopes?: string
+  }
+  /** OpenAI-compatible API base URL for model calls (defaults to https://api.berget.ai/v1) */
+  backend?: string
+  /**
+   * Name of an existing Secret holding `secretKey`, `modelApiKey`,
+   * the multi-user session credentials `jwtSecret`, `jwtRefreshSecret`,
+   * `credsKey`, `credsIv` — and `meiliMasterKey` when `search` is enabled.
+   *
+   * Hex sizing: jwtSecret / jwtRefreshSecret / credsKey are 64 hex chars
+   * (32 bytes); credsIv is 32 hex chars (16 bytes — AES-IV).
+   *
+   * Required unless a secrets backend (openbao/vault) is configured on
+   * the surrounding Platform — the backend then provisions them.
+   * Plaintext secrets are not supported.
+   */
+  secretsName?: string
+  /** Requested resources */
+  resources?: {
+    requests?: { cpu?: string; memory?: string }
+    limits?: { cpu?: string; memory?: string }
+  }
+  /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
+  tls?: {
+    secretName: string
+    clusterIssuer: string
+  }
+}
+
+const OPERATOR_REDIS = 'redis-operator'
+
+/**
+ * LibreChat — multi-model AI chat UI with external MongoDB, Redis
+ * sessions, optional Meilisearch and OIDC SSO.
+ *
+ * @title LibreChat
+ * @category AI & Chat
+ *
+ * Composes:
+ * - LibreChat Deployment + Service + Endpoint (MongoDB is provisioned
+ *   externally — pass its coordinates via the required `mongodb` prop)
+ * - Redis replication group for session caching (default on, service
+ *   ${name}-redis; USE_REDIS=true points sessions at it)
+ * - Optional Meilisearch Deployment + Service for message/RAG search
+ *   (SEARCH=true wires the app to it)
+ * - SECRET_KEY / OPENAI_API_KEY / JWT + CREDS session credentials /
+ *   MEILI_MASTER_KEY provisioned through the Platform secrets backend
+ *   (openbao / vault), or referenced from an existing Secret
+ * - OIDC SSO against the Keycloak `Auth` recipe
+ *
+ * Wrap the component in `<Platform secrets={{ backend: 'openbao' }}>` and
+ * the app secrets bundle (keys: secretKey, modelApiKey, jwtSecret,
+ * jwtRefreshSecret, credsKey, credsIv, meiliMasterKey) is provisioned
+ * for you. Without a backend you must point `secretsName` at a
+ * pre-created Secret. MongoDB itself is NOT provisioned here — run it
+ * separately and connect via `mongodb`.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { LibreChat } from '@r8s/librechat'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>
+ *     <LibreChat
+ *       name="chat"
+ *       host="chat.example.com"
+ *       mongodb={{ host: 'mongo.data.svc.cluster.local', passwordSecret: 'chat-mongodb-credentials' }}
+ *       sso={{
+ *         issuer: 'https://keycloak.example.com/realms/platform',
+ *         clientId: 'librechat',
+ *         clientSecretRef: { secret: 'librechat-sso', key: 'clientSecret' },
+ *       }}
+ *     />
+ *   </Platform>
+ * )
+ */
+export function LibreChat(props: LibreChatProps) {
+  const {
+    name = 'librechat',
+    namespace = 'default',
+    version = 'latest',
+    host,
+    port = 3080,
+    replicas = 1,
+    mongodb,
+    cache = true,
+    search = false,
+    sso,
+    backend = 'https://api.berget.ai/v1',
+    secretsName,
+    resources = {
+      requests: { memory: '512Mi', cpu: '250m' },
+      limits: { memory: '2Gi', cpu: '1000m' },
+    },
+    tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' },
+  } = props
+
+  const sharedOperators = useContext(OperatorContext)
+  const secretProvider = useContext(SecretContext)
+  const resources_: ReturnType<typeof jsx>[] = []
+
+  const appSecretsName = secretsName ?? `${name}-secrets`
+
+  // --- Secret provisioning ---------------------------------------------------
+  // SECRET_KEY signs sessions, modelApiKey pays for inference, the JWT +
+  // CREDS keys carry multi-user login state and meiliMasterKey guards the
+  // search index — none of them may be rendered as plaintext. With a
+  // secrets backend the bundle (keys: secretKey, modelApiKey, jwtSecret,
+  // jwtRefreshSecret, credsKey, credsIv, meiliMasterKey) is provisioned
+  // through the backend; otherwise reference a pre-created Secret.
+  if (!secretsName) {
+    if (
+      !secretProvider ||
+      (secretProvider.backend !== 'vault' && secretProvider.backend !== 'openbao')
+    ) {
+      throw new Error(
+        `LibreChat "${name}" requires application secrets (SECRET_KEY, modelApiKey).\n` +
+          `\n` +
+          `These must not be rendered as plaintext.\n` +
+          `\n` +
+          `Fix: configure a secrets backend on the Platform:\n` +
+          `  <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'apps' }}>\n` +
+          `    <LibreChat name="${name}" host="${host}" />\n` +
+          `  </Platform>\n` +
+          `\n` +
+          `Or reference a pre-created Secret (keys: secretKey, modelApiKey, jwtSecret, jwtRefreshSecret, credsKey, credsIv` +
+          `${search ? ', meiliMasterKey' : ''}):\n` +
+          `  <LibreChat name="${name}" host="${host}" secretsName="${name}-secrets" />`
+      )
+    }
+
+    const spec = {
+      ...(secretProvider.backend === 'vault'
+        ? { vaultAuthRef: secretProvider.authRef }
+        : { openbaoAuthRef: secretProvider.authRef }),
+      mount: secretProvider.mount,
+      type: 'kv-v2' as const,
+      path: `${secretProvider.path ?? name}/${name}/secrets`,
+      destination: { create: true, name: appSecretsName },
+    }
+    resources_.push(
+      secretProvider.backend === 'vault'
+        ? jsx('VaultStaticSecret', {
+            apiVersion: 'secrets.hashicorp.com/v1beta1',
+            kind: 'VaultStaticSecret',
+            metadata: { name: `${name}-secrets`, namespace },
+            spec,
+          })
+        : jsx('OpenBaoStaticSecret', {
+            apiVersion: 'secrets.openbao.org/v1beta1',
+            kind: 'OpenBaoStaticSecret',
+            metadata: { name: `${name}-secrets`, namespace },
+            spec,
+          })
+    )
+  }
+
+  // --- Operators --------------------------------------------------------------
+  if (cache && !sharedOperators.some((op) => op.name === OPERATOR_REDIS)) {
+    resources_.push(declareOperator(operators[OPERATOR_REDIS]()))
+  }
+
+  // Redis — session cache (OT-Container-Kit operator). A replication group
+  // so the single ${name}-redis master service fronts a 3-node set.
+  if (cache) {
+    resources_.push(
+      RedisReplicationComponent({
+        metadata: { name: `${name}-redis`, namespace },
+        spec: {
+          clusterSize: 3,
+          kubernetesConfig: { image: 'redis:7.2-alpine' },
+        },
+      })
+    )
+  }
+
+  // --- Env wiring ----------------------------------------------------------------
+  // Every credential is referenced via secretKeyRef — no plaintext and no
+  // redundant $(VAR) self-echoes in the manifest. The WebService declares
+  // secret-backed vars before plain env vars, so dependent expansion on
+  // MONGO_URI resolves.
+  const mongoPort = mongodb.port ?? 27017
+
+  const env: Record<string, string> = {
+    HOST: '0.0.0.0',
+    PORT: String(port),
+    // Deterministic parts inlined; credentials arrive via MONGO_USERNAME /
+    // MONGO_PASSWORD declared earlier through secretKeyRef
+    MONGO_URI:
+      `mongodb://$(MONGO_USERNAME):$(MONGO_PASSWORD)@${mongodb.host}:${mongoPort}/${name}` +
+      (mongodb.authSource ? `?authSource=${mongodb.authSource}` : ''),
+    // LibreChat speaks to OpenAI-compatible backends through its reverse
+    // proxy (there is no OPENAI_API_BASE_URL env upstream)
+    OPENAI_REVERSE_PROXY: `${backend}/chat/completions`,
+    ...(cache ? { USE_REDIS: 'true', REDIS_URI: `redis://${name}-redis:6379` } : {}),
+    ...(search
+      ? {
+          SEARCH: 'true',
+          MEILI_HOST: `http://${name}-meilisearch:7700`,
+          MEILI_NO_SYNC: 'false',
+        }
+      : {}),
+    ...(sso
+      ? {
+          ALLOW_SOCIAL_LOGIN: 'true',
+          DOMAIN_SERVER: `https://${host}`,
+          DOMAIN_CLIENT: `https://${host}`,
+          OPENID_ISSUER: sso.issuer,
+          OPENID_CLIENT_ID: sso.clientId,
+          OPENID_SCOPES: sso.scopes ?? 'openid profile email',
+          OPENID_CALLBACK_URL: `https://${host}/oauth/openid/callback`,
+        }
+      : {}),
+  }
+
+  // The username is an identifier, not a secret — when the caller supplies
+  // it explicitly it is inlined as plain env; otherwise it is read from the
+  // MongoDB credentials secret (key: username) like the password.
+  if (mongodb.username) {
+    env.MONGO_USERNAME = mongodb.username
+  }
+
+  // Credentials delivered via secretKeyRef (runtime injection). JWT_SECRET /
+  // JWT_REFRESH_SECRET / CREDS_KEY / CREDS_IV back multi-user sessions:
+  // per-user message encryption and refresh-token issuance need shared
+  // random values across replicas. Hex sizing: jwtSecret, jwtRefreshSecret
+  // and credsKey are 64 hex chars (32 bytes); credsIv is 32 hex chars
+  // (16 bytes).
+  const secrets: Record<string, SecretRef | string> = {
+    ...(mongodb.username
+      ? {}
+      : { MONGO_USERNAME: { secret: mongodb.passwordSecret, key: 'username' } }),
+    MONGO_PASSWORD: { secret: mongodb.passwordSecret, key: 'password' },
+    SECRET_KEY: { secret: appSecretsName, key: 'secretKey' },
+    OPENAI_API_KEY: { secret: appSecretsName, key: 'modelApiKey' },
+    JWT_SECRET: { secret: appSecretsName, key: 'jwtSecret' },
+    JWT_REFRESH_SECRET: { secret: appSecretsName, key: 'jwtRefreshSecret' },
+    CREDS_KEY: { secret: appSecretsName, key: 'credsKey' },
+    CREDS_IV: { secret: appSecretsName, key: 'credsIv' },
+    ...(search ? { MEILI_MASTER_KEY: { secret: appSecretsName, key: 'meiliMasterKey' } } : {}),
+    ...(sso ? { OPENID_CLIENT_SECRET: sso.clientSecretRef } : {}),
+  }
+
+  // --- Runtime config (non-secret) -------------------------------------------
+  // REFRESH_TOKEN_EXPIRY is a plain TTL (7 days), not a credential — it is
+  // rendered as a ConfigMap and injected via configMapKeyRef, keeping
+  // plaintext env wiring (and the no-plaintext-secrets guardrail) clean.
+  const configMapName = `${name}-config`
+  const configMap: ConfigMap = {
+    apiVersion: 'v1',
+    kind: 'ConfigMap',
+    metadata: { name: configMapName, namespace },
+    data: { REFRESH_TOKEN_EXPIRY: '604800' },
+  }
+  resources_.push(jsx('ConfigMap', configMap))
+
+  // --- App + optional Meilisearch + endpoint --------------------------------------
+  resources_.push(
+    <WebService
+      name={name}
+      namespace={namespace}
+      image={`ghcr.io/danny-avila/librechat:${version}`}
+      port={port}
+      replicas={replicas}
+      resources={resources}
+      env={env}
+      secrets={secrets}
+      rawEnv={[
+        {
+          name: 'REFRESH_TOKEN_EXPIRY',
+          valueFrom: { configMapKeyRef: { name: configMapName, key: 'REFRESH_TOKEN_EXPIRY' } },
+        } as EnvVar,
+      ]}
+    />
+  )
+
+  if (search) {
+    resources_.push(
+      <WebService
+        name={`${name}-meilisearch`}
+        namespace={namespace}
+        image="getmeili/meilisearch:v1.6"
+        port={7700}
+        replicas={1}
+        env={{ MEILI_NO_ANALYTICS: 'true', MEILI_ENV: 'production' }}
+        secrets={{ MEILI_MASTER_KEY: { secret: appSecretsName, key: 'meiliMasterKey' } }}
+        probes={{ liveness: { path: '/health' }, readiness: { path: '/health' } }}
+        resources={{
+          requests: { memory: '256Mi', cpu: '100m' },
+          limits: { memory: '1Gi', cpu: '500m' },
+        }}
+      />
+    )
+  }
+
+  resources_.push(
+    <Endpoint
+      name={`${name}-endpoint`}
+      namespace={namespace}
+      host={host}
+      serviceName={name}
+      servicePort={port}
+      tls={tls}
+      annotations={{
+        'nginx.ingress.kubernetes.io/proxy-read-timeout': '300',
+        'nginx.ingress.kubernetes.io/proxy-send-timeout': '300',
+        'nginx.ingress.kubernetes.io/proxy-buffering': 'off',
+      }}
+    />
+  )
+
+  return jsx(Fragment, { children: resources_ })
+}

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "composite": true
+  },
+  "include": ["src/**/*"],
+  "references": [
+    { "path": "../core" },
+    { "path": "../k8s-types" },
+    { "path": "../crds" },
+    { "path": "../recipes" }
+  ]
+}