Add LightRAG SSL-context patch and redacted server configuration

config/lightrag.env.example

@@ -0,0 +1,77 @@
+# LightRAG server configuration used in the thesis (active settings only).
+# Copy to lightrag/.env and fill in the secrets marked <set-me>.
+
+HOST=0.0.0.0
+PORT=9621
+WEBUI_TITLE='My Graph KB'
+WEBUI_DESCRIPTION="Simple and Fast Graph Based RAG System"
+WORKING_DIR=./rag_storage_qwen36
+OLLAMA_EMULATING_MODEL_TAG=latest
+RERANK_BINDING=null
+ENABLE_LLM_CACHE_FOR_EXTRACT=true
+SUMMARY_LANGUAGE=Slovak
+ENTITY_TYPES='["Drug", "ActiveSubstance", "DrugClass", "Indication", "Condition", "Contraindication", "Interaction", "PatientGroup"]'
+CHUNK_SIZE=600
+CHUNK_OVERLAP_SIZE=50
+MAX_ASYNC=16
+MAX_PARALLEL_INSERT=6
+LLM_TIMEOUT=300
+LLM_BINDING=openai
+LLM_BINDING_HOST=https://ui.tukekemt.xyz/api
+LLM_BINDING_API_KEY=<set-me>
+LLM_MODEL=qwen36-27
+OPENAI_LLM_EXTRA_BODY='{"chat_template_kwargs": {"enable_thinking": false}}'
+OPENAI_LLM_MAX_TOKENS=16000
+OLLAMA_LLM_NUM_CTX=32768
+EMBEDDING_BINDING=openai
+EMBEDDING_BINDING_HOST=http://localhost:8010
+EMBEDDING_BINDING_API_KEY=<set-me>
+EMBEDDING_MODEL=local-embed
+EMBEDDING_DIM=384
+EMBEDDING_TOKEN_LIMIT=4096
+EMBEDDING_SEND_DIM=false
+OLLAMA_EMBEDDING_NUM_CTX=8192
+POSTGRES_HOST=localhost
+POSTGRES_PORT=5432
+POSTGRES_USER=your_username
+POSTGRES_PASSWORD=<set-me>
+POSTGRES_DATABASE=rag
+POSTGRES_MAX_CONNECTIONS=12
+POSTGRES_ENABLE_VECTOR=true
+POSTGRES_VECTOR_INDEX_TYPE=HNSW
+POSTGRES_HNSW_M=16
+POSTGRES_HNSW_EF=200
+POSTGRES_IVFFLAT_LISTS=100
+POSTGRES_VCHORDRQ_BUILD_OPTIONS=
+POSTGRES_VCHORDRQ_PROBES=
+POSTGRES_VCHORDRQ_EPSILON=1.9
+NEO4J_URI=neo4j+s://xxxxxxxx.databases.neo4j.io
+NEO4J_USERNAME=neo4j
+NEO4J_PASSWORD=<set-me>
+NEO4J_DATABASE=neo4j
+NEO4J_MAX_CONNECTION_POOL_SIZE=100
+NEO4J_CONNECTION_TIMEOUT=30
+NEO4J_CONNECTION_ACQUISITION_TIMEOUT=30
+NEO4J_MAX_TRANSACTION_RETRY_TIME=30
+NEO4J_MAX_CONNECTION_LIFETIME=300
+NEO4J_LIVENESS_CHECK_TIMEOUT=30
+NEO4J_KEEP_ALIVE=true
+MONGO_URI=mongodb://localhost:27017/
+MONGO_DATABASE=LightRAG
+OPENSEARCH_HOSTS=localhost:9200
+OPENSEARCH_USER=admin
+OPENSEARCH_PASSWORD=<set-me>
+OPENSEARCH_USE_SSL=true
+OPENSEARCH_VERIFY_CERTS=false
+MILVUS_URI=http://localhost:19530
+MILVUS_DB_NAME=lightrag
+QDRANT_URL=http://localhost:6333
+REDIS_URI=redis://localhost:6379
+REDIS_SOCKET_TIMEOUT=30
+REDIS_CONNECT_TIMEOUT=10
+REDIS_MAX_CONNECTIONS=100
+REDIS_RETRY_ATTEMPTS=3
+MEMGRAPH_URI=bolt://localhost:7687
+MEMGRAPH_USERNAME=
+MEMGRAPH_PASSWORD=<set-me>
+MEMGRAPH_DATABASE=memgraph

patches/lightrag-shared-ssl-context.patch

@@ -0,0 +1,47 @@
+# Patch for HKUDS/LightRAG at commit 027376b6 (apply inside the lightrag/ checkout: git apply ../patches/lightrag-shared-ssl-context.patch)
+# Reuses one SSL context for all OpenAI-compatible clients; without it LightRAG spent ~95% CPU re-creating SSL contexts on Windows.
+diff --git a/lightrag/llm/openai.py b/lightrag/llm/openai.py
+index a4c06737..806133cd 100644
+--- a/lightrag/llm/openai.py
++++ b/lightrag/llm/openai.py
+@@ -15,6 +15,7 @@ from openai import (
+     APIConnectionError,
+     RateLimitError,
+     APITimeoutError,
++    DefaultAsyncHttpxClient,
+ )
+ from tenacity import (
+     retry,
+@@ -181,9 +182,32 @@ def create_openai_async_client(
+         if timeout is not None:
+             merged_configs["timeout"] = timeout
+ 
++        # A new client is created for every LLM/embedding call. Building a fresh
++        # SSL context each time (loading the CA bundle) is CPU-heavy and blocks the
++        # event loop, so reuse one shared context for all clients.
++        if "http_client" not in merged_configs:
++            merged_configs["http_client"] = DefaultAsyncHttpxClient(
++                verify=_shared_ssl_context()
++            )
++
+         return AsyncOpenAI(**merged_configs)
+ 
+ 
++_SSL_CONTEXT = None
++
++
++def _shared_ssl_context():
++    global _SSL_CONTEXT
++    if _SSL_CONTEXT is None:
++        import ssl
++
++        import certifi
++
++        cafile = os.environ.get("SSL_CERT_FILE") or certifi.where()
++        _SSL_CONTEXT = ssl.create_default_context(cafile=cafile)
++    return _SSL_CONTEXT
++
++
+ @retry(
+     stop=stop_after_attempt(3),
+     wait=wait_exponential(multiplier=1, min=4, max=10),