auto-fix: harness-dashboard restarted — container was down, now healthy

2026-06-28 01:36:00 +00:00
parent 0ca3b65ad4
commit ac13ecaaf7
18 changed files with 4500 additions and 0 deletions
@@ -0,0 +1,262 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    sendfile on;
+    keepalive_timeout 65;
+
+    upstream router_api { server router:9000; }
+    upstream dashboard_ui { server dashboard:3000; }
+    upstream litellm_backend { server litellm:4000; }
+
+    # Detect Cloudflare Tunnel requests (cloudflared always sets CF-Connecting-IP).
+    # Direct LAN browser access to :4000 has no such header -> redirect to canonical https,
+    # preventing the cross-origin localStorage footgun that traps the UI at the login page.
+    map $http_cf_connecting_ip $is_cloudflared {
+        default 1;          # any non-empty value = request came through Cloudflare
+        ""     0;          # empty = direct access
+    }
+
+    # ════════════════════════════════════════════════════════════════
+    # Server :80 — existing harness entrypoint
+    #   dashboard (/), router API (/v1/, /admin/, /stream, /api/, /metrics),
+    #   router fallback, LiteLLM UI via /litellm/ prefix, health
+    # ════════════════════════════════════════════════════════════════
+    server {
+        listen 80;
+
+        # Authentik OIDC subrequest
+        location /authentik/auth {
+            internal;
+            proxy_pass https://auth.sysloggh.net/outpost.goauthentik.io/auth/nginx;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+            proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        # 2-Layer: /v1/ → router (existing keys work unchanged)
+        location /v1/ {
+            proxy_pass http://router_api;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header Authorization $http_authorization;
+            proxy_connect_timeout 10s;
+            proxy_read_timeout 600s;
+            proxy_buffering off;
+            error_page 502 503 = @router_fallback;
+        }
+
+        location @router_fallback {
+            proxy_pass http://router_api;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header Authorization $http_authorization;
+            proxy_read_timeout 600s;
+        }
+
+        location /admin/ {
+            proxy_pass http://router_api;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header Authorization $http_authorization;
+            proxy_read_timeout 600s;
+        }
+
+        location /stream {
+            proxy_pass http://router_api/stream;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_buffering off;
+        }
+
+        location /api/ {
+            proxy_pass http://router_api/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+
+        # LiteLLM gateway access (agents with new virtual keys)
+        location /litellm/v1/ {
+            proxy_pass http://litellm_backend/v1/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header Authorization $http_authorization;
+            proxy_connect_timeout 10s;
+            proxy_read_timeout 600s;
+            proxy_buffering off;
+        }
+
+        # LiteLLM UI static assets
+        location /litellm-asset-prefix/ {
+            proxy_pass http://litellm_backend/litellm-asset-prefix/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+
+        # LiteLLM Admin UI via /litellm/ prefix (LAN/internal access on :80)
+        location /litellm/ {
+            proxy_pass http://litellm_backend/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_read_timeout 86400s;
+            proxy_buffering off;
+            proxy_redirect http://$host/ /litellm/;
+            proxy_redirect https://$host/ /litellm/;
+        }
+
+        location /dashboard/ {
+            proxy_pass http://dashboard_ui/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+
+        location / {
+            root /opt/inference-harness/dashboard;
+            try_files $uri $uri/ /index.html;
+        }
+
+        location /metrics/ {
+            proxy_pass http://router_api/metrics/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+
+        location /metrics/circuit-breaker {
+            proxy_pass http://router_api/metrics/circuit-breaker;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+
+        location /router/ {
+            proxy_pass http://router_api/;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+
+        location /health/unified {
+            proxy_pass http://router_api/health/unified;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+
+        location /health {
+            proxy_pass http://router_api/health;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+    }
+
+    # ════════════════════════════════════════════════════════════════
+    # Server :4000 — external LiteLLM entrypoint (cloudflared target)
+    #   Fixes the /ui redirect: forces correct Host + scheme so LiteLLM
+    #   builds external URLs instead of leaking 192.168.68.116:4000.
+    #   LiteLLM itself is now bound to 127.0.0.1 only (see compose).
+    # ════════════════════════════════════════════════════════════════
+    server {
+        listen 4000;
+
+        # Canonical external identity — overrides whatever Host cloudflared sends
+        proxy_set_header Host litellm.sysloggh.net;
+        proxy_set_header X-Forwarded-Host litellm.sysloggh.net;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Port 443;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+
+        # /ui → /ui/ — absolute redirect (cloudflared rewrites Host to origin IP,
+        # so a relative return would be absolutized to http://192.168.68.116:4000/).
+        location = /ui { return 301 https://litellm.sysloggh.net/ui/; }
+
+        # LiteLLM Admin UI + WebSocket
+        location /ui/ {
+            proxy_pass http://litellm_backend/ui/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_read_timeout 86400s;
+            proxy_buffering off;
+            proxy_redirect http://litellm_backend/ https://litellm.sysloggh.net/;
+            proxy_redirect http://litellm.sysloggh.net:4000/ https://litellm.sysloggh.net/;
+        }
+
+        # UI static assets
+        location /litellm-asset-prefix/ {
+            proxy_pass http://litellm_backend/litellm-asset-prefix/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+        }
+
+        # SSO callback
+        location /sso/ {
+            proxy_pass http://litellm_backend/sso/;
+            proxy_http_version 1.1;
+            proxy_read_timeout 600s;
+        }
+
+        # API
+        location /v1/ {
+            proxy_pass http://litellm_backend/v1/;
+            proxy_http_version 1.1;
+            proxy_set_header Authorization $http_authorization;
+            proxy_read_timeout 600s;
+            proxy_buffering off;
+        }
+
+        # Key management + admin API
+        location /key/ {
+            proxy_pass http://litellm_backend/key/;
+            proxy_http_version 1.1;
+            proxy_set_header Authorization $http_authorization;
+        }
+        location /user/ {
+            proxy_pass http://litellm_backend/user/;
+            proxy_http_version 1.1;
+            proxy_set_header Authorization $http_authorization;
+        }
+        location /model/ {
+            proxy_pass http://litellm_backend/model/;
+            proxy_http_version 1.1;
+            proxy_set_header Authorization $http_authorization;
+        }
+        location /team/ {
+            proxy_pass http://litellm_backend/team/;
+            proxy_http_version 1.1;
+            proxy_set_header Authorization $http_authorization;
+        }
+
+        # Health
+        location /health {
+            proxy_pass http://litellm_backend/health;
+            proxy_http_version 1.1;
+        }
+
+        # Root + everything else → LiteLLM (UI index, /configs, /spend, etc.)
+        location / {
+            proxy_pass http://litellm_backend/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_read_timeout 86400s;
+            proxy_buffering off;
+            proxy_redirect http://192.168.68.116:4000/ https://litellm.sysloggh.net/;
+            proxy_redirect https://192.168.68.116:4000/ https://litellm.sysloggh.net/;
+        }
+    }
+}