Skip to main content

Admin Service

The Go Admin Service provides the administration API used by the Web UI and the Go CLI. It manages users and configuration, checks infrastructure dependencies, and tracks Go API servers, ingestors, and file syncers that report heartbeats. The target Admin Service port is 9381; the target Go API server port is 9380.

Start the Admin Service before the API server, ingestors, and syncers so those processes can report their heartbeats as soon as they start. MySQL, the configured document engine and storage service, the cache, and the message queue must be available to the Admin Service. For the default host-run configuration, see Start supporting services for the dependency list, port settings, and readiness checks.

Start from source

For a fresh checkout, prepare the native dependencies and build the C++ bindings and Go binaries as described in Get the source and build dependencies:

bash build.sh --all

Use bash build.sh --go for subsequent Go-only rebuilds after the C++ bindings have already been built.

Before proceeding, run ./bin/ragflow_server --admin --help to check that the binary can load and parse the Admin arguments. This command prints help and exits; it does not start the Admin Service or test its dependencies. If it exits with status 139 without printing help, see the build troubleshooting notes.

Complete the standalone database migration before starting any server mode. Run the migration once for this startup; do not attach --migrate to --admin, --api, or --ingestor:

./bin/ragflow_server --migrate

Start each process in a separate terminal, in this order. The source-development commands below use RAGFLOW_DEV_MODE=true to bypass the code and database version downgrade check; this setting does not run migrations or change the schema. Do not set it in production:

RAGFLOW_DEV_MODE=true ./bin/ragflow_server --admin
RAGFLOW_DEV_MODE=true ./bin/ragflow_server --api
RAGFLOW_DEV_MODE=true ./bin/ragflow_server --ingestor

If file synchronization is enabled, also start:

RAGFLOW_DEV_MODE=true ./bin/ragflow_server --syncer

To initialize the default superuser when starting Admin, add --init-superuser to the Admin command. Do this only when initial account setup is required.

RAGFLOW_DEV_MODE=true ./bin/ragflow_server --admin --init-superuser

If no superuser exists, this option currently creates admin@ragflow.io with the initial password admin. Change that password immediately after the first login. It does not reset the password of an existing superuser.

To change the Admin listening port, set admin.http_port in the server configuration.

For processes on another host, set admin.host and admin.http_port in their server configuration to the reachable Admin address and port. When changing the Admin port, also update the CLI connection address and the health-check URLs below.

Start with Docker Compose

For the Go deployment, use docker/docker-compose.yml and its .env file. The ragflow-cpu service already passes --enable-adminserver and --init-superuser to the Go entrypoint. The entrypoint runs migrations before starting the server processes; it then starts Admin before the API server and ingestor. Its optional syncer starts earlier, so its heartbeat may appear only after Admin becomes available.

docker compose --env-file docker/.env -f docker/docker-compose.yml --profile cpu up -d

The Go Compose deployment exposes the Admin Service on 9381 and the API server on 9380 by default. Use ADMIN_SVR_HTTP_PORT and SVR_HTTP_PORT to change the corresponding published host ports.

Use the Go Compose entry point documented in Go Docker deployment. Initialize the first superuser with --init-superuser only when initial account setup is required.

Check health and service registration

Use /live to check whether the Admin HTTP process is responding:

curl -f http://127.0.0.1:9381/live

Use /healthz to check the Admin Service and its required dependencies. It returns HTTP 200 when the database, cache, document engine, storage, and message queue are healthy; otherwise it returns HTTP 500 with component status information.

curl -f http://127.0.0.1:9381/healthz

The API server, ingestor, and syncer periodically send heartbeat reports to Admin. Admin keeps their latest reports in its runtime service registry; it does not register itself there. After those processes start, launch the Go CLI and log in as an administrator. If you changed the Admin port or are connecting from another host, add --host <host:port> to the CLI command:

./bin/ragflow-cli --admin
RAGFlow(admin)> LOGIN ADMIN 'admin@ragflow.io';

The CLI prompts for the password.

If this is the first login using the initial admin password, change it before continuing:

RAGFlow(admin)> ALTER USER PASSWORD 'admin@ragflow.io' '<new_password>';

Then inspect the registered services:

RAGFlow(admin)> LIST SERVICES;

Look for api_server, ingestor, and, when enabled, file_syncer entries with status=alive. A previously registered process can remain listed with status=timeout after its heartbeats stop. LIST SERVICES; also includes health checks for infrastructure dependencies. The CLI commands LIST API SERVER; and SHOW API SERVER '<name>'; inspect locally saved API connection settings, not this heartbeat registry.