Skip to content

Commit

Permalink
More deployment guide updates
Browse files Browse the repository at this point in the history
  • Loading branch information
itaismith committed Oct 9, 2024
1 parent 36e4686 commit e817754
Show file tree
Hide file tree
Showing 16 changed files with 279 additions and 54 deletions.
10 changes: 9 additions & 1 deletion docs/docs.trychroma.com/pages/deployment/_sidenav.js
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,14 @@ export const items = [
// ]
// },
{
title: 'Local Development',
title: "Chroma Server",
links: [
{ href: '/deployment/client-server-mode', children: "Client/Server Mode"},
{ href: '/deployment/thin-client', children: "Python Thin-Client"},
]
},
{
title: 'Containers',
links: [
{ href: '/deployment/docker', children: 'Docker' },
]
Expand All @@ -25,6 +32,7 @@ export const items = [
{
title: 'Administration',
links: [
{ href: '/deployment/performance', children: "🚀 Performance"},
// { href: '/deployment/logging', children: 'Logging' },
{ href: '/deployment/observability', children: '👀 Observability' },
{ href: '/deployment/migration', children: '✈️ Migration' },
Expand Down
16 changes: 9 additions & 7 deletions docs/docs.trychroma.com/pages/deployment/auth.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,22 +37,24 @@ chroma run --path <DB path>

We also have dedicated auth guides for various deployments:
* [Docker](/deployment/docker#authentication-with-docker)
* More coming soon!
* [AWS](/deployment/aws#authentication-with-AWS)
* GCP - Coming Soon!
* Azure - Coming Soon!

### Basic Authentication
### Encrypted User:Password Authentication

#### Server Set-Up

##### Generate Server-Side Credentials

{% note type="note" title="Security Practices" %}
A good security practice is to store the password securely. In the example below we use [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) (currently the only supported hash in Chroma server side auth) to hash the plaintext password.
A good security practice is to store the password securely. In the example below we use [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) (currently the only supported hash in Chroma server side auth) to hash the plaintext password. If you'd like to see support for additional hash functions, feel free to [contribute](../contributing) new ones!
{% /note %}

To generate the password hash, run the following command:
To generate the password hash, run the following command (you may need to install `httpasswd`):

```bash
docker run --rm --entrypoint htpasswd httpd:2 -Bbn admin admin > server.htpasswd
htpasswd -Bbn admin admin > server.htpasswd
```

This creates the bcrypt password hash for the password `admin`, for the `admin` user, and puts it into `server.htpasswd` in your current working directory. It will look like `admin:<password hash>`.
Expand All @@ -77,7 +79,7 @@ chroma run --path <DB path>
{% tabs group="code-lang" hideTabs=true %}
{% tab label="Python" %}

We will use Chroma's `Setting` object to define the authentication method on the client.
We will use Chroma's `Settings` object to define the authentication method on the client.

```python
import chromadb
Expand Down Expand Up @@ -160,7 +162,7 @@ export CHROMA_SERVER_AUTHZ_PROVIDER="chromadb.auth.simple_rbac_authz.SimpleRBACA
{% tabs group="code-lang" hideTabs=true %}
{% tab label="Python" %}

We will use Chroma's `Setting` object to define the authentication method on the client.
We will use Chroma's `Settings` object to define the authentication method on the client.

```python
import chromadb
Expand Down
19 changes: 8 additions & 11 deletions docs/docs.trychroma.com/pages/deployment/aws.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,17 +13,14 @@ title: "☁️ AWS Deployment"
{% /tabs %}

{% note type="tip" title="Hosted Chroma" %}
We want to offer hosted Chroma, and we need your help.

Fill out the survey to jump the wait-list. Coming Q1 2025.
Chroma Cloud, our fully managed hosted service, is in early access. Fill out the survey to jump the waitlist and get the best retrieval experience. Full access coming Q1 2025.

[📝 30 second survey](https://airtable.com/shrOAiDUtS2ILy5vZ)

{% /note %}

{% note type="tip" title="" %}
If you are using Chroma in production, join our [#chroma-production](https://discord.com/channels/1073293645303795742/1292554909694300211) channel on Discord!

If you are using Chroma in production, please fill out [this form](https://airtable.com/appD00DoyqUEokUVb/pag3Le1bfpU2RYEqb/form), and we will add you to a dedicated Slack workspace for supporting production users. We would love to help you think through the design of your system, or if you would be a good fit for our upcoming distributed cloud service. You can also join the [#production-chroma](https://discord.com/channels/1073293645303795742/1292554909694300211) channel on Discord to join our community!
This is the best place to
1. Get support with building with Chroma in prod.
2. Stay up-to-date with exciting new features.
Expand All @@ -40,18 +37,18 @@ provided a very simple AWS CloudFormation template to experiment with
deploying Chroma to EC2 on AWS.

{% note type="warning" title="" %}
Chroma and its underlying database need at least 2gb of RAM,
Chroma and its underlying database [need at least 2GB of RAM](./performance#results-summary),
which means it won't fit on the 1gb instances provided as part of the
AWS Free Tier. This template uses a `t3.small` EC2 instance, which
costs about two cents an hour, or $15 for a full month. If you follow these
AWS Free Tier. This template uses a [`t3.small`](https://aws.amazon.com/ec2/instance-types/t3/#Product%20Details) EC2 instance, which
costs about two cents an hour, or $15 for a full month, and gives you 2GiB of memory. If you follow these
instructions, AWS will bill you accordingly.
{% /note %}

{% note type="warning" title="" %}
This basic stack doesn't support any kind of authentication;
anyone who knows your server IP will be able to add and query for
embeddings. In this guide we show you how to secure your endpoint using [Chroma's
native authentication support](http://localhost:3000/deployment/aws#authentication-with-aws:~:text=Authentication%20with%20AWS-,%23,-By%20default%2C%20the). Alternatively, you can put it behind
native authentication support](./aws#authentication-with-aws). Alternatively, you can put it behind
[AWS API Gateway](https://aws.amazon.com/api-gateway/) or add your own
authenticating proxy.
{% /note %}
Expand Down Expand Up @@ -141,7 +138,7 @@ aws cloudformation create-stack --stack-name my-chroma-stack --template-url http

Once your EC2 instance is up and running with Chroma, all
you need to do is configure your `HttpClient` to use the server's IP address and port
`8000`.
`8000`. Since you are running a Chroma server on AWS, our [thin-client package](./thin-client.md) may be enough for your application.

{% tabs group="code-lang" hideTabs=true %}
{% tab label="Python" %}
Expand Down Expand Up @@ -227,7 +224,7 @@ export CHROMA_CLIENT_AUTH_CREDENTIALS="test-token"
{% tabs group="code-lang" hideTabs=true %}
{% tab label="Python" %}

We will use Chroma's `Setting` object to define the authentication method on the client.
We will use Chroma's `Settings` object to define the authentication method on the client.

```python
import os
Expand Down
67 changes: 67 additions & 0 deletions docs/docs.trychroma.com/pages/deployment/client-server-mode.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
---
title: "Running Chroma in Client-Server Mode"
---

{% tabs group="code-lang" hideContent=true %}

{% tab label="Python" %}
{% /tab %}

{% tab label="Javascript" %}
{% /tab %}

{% /tabs %}

Chroma can also be configured to run in client/server mode. In this mode, the Chroma client connects to a Chroma server running in a separate process.

This means that you can deploy single-node Chroma to a [Docker container](./docker), or a machine hosted by a cloud provider like [AWS](./aws), GCP, Azure, and others. Then, you can access your Chroma server from your application using our `HttpClient`.

You can quickly experiment with Chroma in client/server mode locally by using our CLI:

```shell
chroma run --path /db_path
```

Then use the Chroma `HttpClient` to connect to the server:

{% tabs group="code-lang" hideTabs=true %}
{% tab label="Python" %}

```python
import chromadb
chroma_client = chromadb.HttpClient(host='localhost', port=8000)
```

Chroma also provides an `AsyncHttpClient`. The behaviors and method signatures are identical to the synchronous client, but all methods that would block are now async:

```python
import asyncio
import chromadb

async def main():
client = await chromadb.AsyncHttpClient()
collection = await client.create_collection(name="my_collection")
await collection.add(
documents=["hello world"],
ids=["id1"]
)

asyncio.run(main())
```

If you intend to deploy your Chroma server, you may want to consider our [thin-client package](./thin-client) for client-side interactions.

{% /tab %}

{% tabs group="code-lang" hideTabs=true %}
{% tab label="Javascript" %}

```javascript
// CJS
const { ChromaClient } = require("chromadb");
// ESM
import { ChromaClient } from "chromadb";
const client = new ChromaClient();
```

{% /tab %}
34 changes: 15 additions & 19 deletions docs/docs.trychroma.com/pages/deployment/docker.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,11 @@ title: Docker

## Run Chroma in a Docker Container

You can run a Chroma server in a Docker container.
You can run a Chroma server in a Docker container, and access it using the `HttpClient`.

If you are using Chroma in production, please fill out [this form](https://airtable.com/appD00DoyqUEokUVb/pag3Le1bfpU2RYEqb/form), and we will add you to a dedicated Slack workspace for supporting production users. We would love to help you think through the design of your system, or if you would be a good fit for our upcoming distributed cloud service. You can also join the [#production-chroma](https://discord.com/channels/1073293645303795742/1292554909694300211) channel on Discord to join our community!

If you are using a client in a separate container from the one running your Chroma server, you may only need the [thin-client package](./thin-client)

You can get the Chroma Docker image from [Docker Hub](https://hub.docker.com/r/chromadb/chroma), or from the [Chroma GitHub Container Registry](https://github.com/chroma-core/chroma/pkgs/container/chroma)

Expand Down Expand Up @@ -63,20 +67,14 @@ By default, the Docker image will run with no authentication. In client/server m

You can learn more about authentication with Chroma in the [Auth Guide](/deployment/auth).

Start by creating a `.chroma_env` file. We will store in it various environment variables Chroma will need to enable authentication, and pass it to your container using the `--env-file` flag:

```sh
docker run --env-file ./.chroma_env -p 8000:8000 chromadb/chroma
```

### Basic Authentication
### Encrypted User:Password Authentication

#### Server Set-Up

##### Generate Server-Side Credentials

{% note type="note" title="Security Practices" %}
A good security practice is to store the password securely. In the example below we use [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) (currently the only supported hash in Chroma server side auth) to hash the plaintext password.
A good security practice is to store the password securely. In the example below we use [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) (currently the only supported hash in Chroma server side auth) to hash the plaintext password. If you'd like to see support for additional hash functions, feel free to [contribute](../contributing) new ones!
{% /note %}

To generate the password hash, run the following command:
Expand All @@ -89,25 +87,25 @@ This creates the bcrypt password hash for the password `admin`, for the `admin`

##### Running the Server

Set the following environment variables in `.chroma_env`:
Create a `.chroma_env` file, and set in it the following environment variables:

```text
CHROMA_SERVER_AUTHN_CREDENTIALS=<contents of server.htpasswd>
CHROMA_SERVER_AUTHN_PROVIDER=chromadb.auth.basic_authn.BasicAuthenticationServerProvider
```

And run the Chroma container:
Then, run the Chroma container, and pass it your `.chroma_env` using the `--env-file` flag:

```bash
docker run --env-file ./.chroma_env -p 8000:8000 chromadb/chroma
```

#### Client Set-Up

Add the `CHROMA_CLIENT_AUTH_CREDENTIALS` environment variable to your `.chroma_en`, and set it to the user:password combination (`admin:admin` in this example):
In your client environment, set the `CHROMA_CLIENT_AUTH_CREDENTIALS` variable to the user:password combination (`admin:admin` in this example):

```text
CHROMA_CLIENT_AUTH_CREDENTIALS=admin:admin
```shell
export CHROMA_CLIENT_AUTH_CREDENTIALS="admin:admin"
```

{% tabs group="code-lang" hideTabs=true %}
Expand All @@ -119,7 +117,7 @@ Install `python-dotenv`. This will allow us to read the environment variables fr
pip install python-dotenv
```

We will use Chroma's `Setting` object to define the authentication method on the client.
We will use Chroma's `Settings` object to define the authentication method on the client.

```python
import os
Expand Down Expand Up @@ -161,8 +159,6 @@ chromaClient.heartbeat()
{% /tab %}
{% /tabs %}

Try changing the user-password combination to be incorrect. The Chroma server will respond with a 403.

### Static API Token Authentication

#### Server Set-Up
Expand All @@ -178,7 +174,7 @@ CHROMA_SERVER_AUTHN_CREDENTIALS=test-token
CHROMA_SERVER_AUTHN_PROVIDER=chromadb.auth.token_authn.TokenAuthenticationServerProvider
```

To use `X-Chroma-Token: test-token` type of authentication header you can set the `CHROMA_AUTH_TOKEN_TRANSPORT_HEADER` environment variable:
If instead of the default `Authorization: Bearer <token>` header, you want to use a custom one like `X-Chroma-Token: test-token`, you can set the `CHROMA_AUTH_TOKEN_TRANSPORT_HEADER` environment variable:

```text
CHROMA_SERVER_AUTHN_CREDENTIALS=test-token
Expand Down Expand Up @@ -218,7 +214,7 @@ Install `python-dotenv`. This will allow us to read the environment variables fr
pip install python-dotenv
```

We will use Chroma's `Setting` object to define the authentication method on the client.
We will use Chroma's `Settings` object to define the authentication method on the client.

```python
import os
Expand Down
26 changes: 13 additions & 13 deletions docs/docs.trychroma.com/pages/deployment/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,24 +4,24 @@ title: ☁️ Deployment

***

### Local Environment
You can run Chroma single-node in [client/server mode](/deployment/client-server-mode), and easily deploy it. In this section, we also show you how to make sure your Chroma server is secure and reliable, and how to understand its performance at scale.

Chroma is easy to set up in local development environments. Use these guides to run Chroma locally for testing or development, ensuring your system is ready for production deployment.
If you are using Chroma in production, please fill out [this form](https://airtable.com/appD00DoyqUEokUVb/pag3Le1bfpU2RYEqb/form), and we will add you to a dedicated Slack workspace for supporting production users. We would love to help you think through the design of your system, or if you would be a good fit for our upcoming distributed cloud service. You can also join the [#production-chroma](https://discord.com/channels/1073293645303795742/1292554909694300211) channel on Discord to join our community!

### Containers
* 🐳 [Docker](/deployment/docker)
* 🚧 *More Coming Soon*

### Cloud Providers

Chroma single-node is easy to deploy to a variety of cloud providers. Please use these guides to get started.

{% special_table %}
{% /special_table %}

| Provider |
|--------------|
| [AWS](/deployment/aws) |
| 🚧 *More Coming Soon* |
| |
|------------------------|
| [AWS](/deployment/aws) |
| GCP - Coming Soon! |
| Azure - Coming Soon! |

***

Expand All @@ -32,9 +32,9 @@ Running a server in production requires a few additional steps to ensure the ser
{% special_table %}
{% /special_table %}

| |
|--------------|
| |
|-----------------------------------------------|
| [🚀 Performance](/deployment/performance) |
| [👀 Observability](/deployment/observability) |
| [✈️ Migration](/deployment/migration) |
| [🔒 Auth](/deployment/auth) |
| 🚧 *More Coming Soon* |
| [✈️ Migration](/deployment/migration) |
| [🔒 Auth](/deployment/auth) |
Loading

0 comments on commit e817754

Please sign in to comment.