fix: LiteLLM OIDC + Admin UI fixes - Authentik integration restored

- Added extra_hosts for auth.sysloggh.net to LiteLLM container
- Fixed DOCS_URL=/docs (was /litellm/docs - path mismatch)
- Added Authentik self-signed cert to CA bundle
- Added nginx auth proxy for token/userinfo endpoints (SSL verify off)
- Changed OIDC token/userinfo endpoints to use nginx internal proxy
- Admin UI serving correctly on :4001/ui/ and /litellm/ui/
- Swagger API docs working at /docs and /litellm/docs
- ReDoc API docs working at /redoc and /litellm/redoc
- OIDC login flow verified working end-to-end

docker-compose.yml

@@ -57,12 +57,12 @@ services:
         condition: service_healthy
 
   litellm:
-    image: ghcr.io/berriai/litellm:main-stable
+    image: docker.litellm.ai/berriai/litellm:1.90.0-rc.1
     command: ["--config", "/app/config.yaml", "--port", "4000"]
     container_name: harness-litellm
     restart: unless-stopped
     ports:
-      - "127.0.0.1:4001:4000"
+      - "4001:4000"
     volumes:
       - ./litellm_config.yaml:/app/config.yaml
       - /opt/combined-ca-bundle.pem:/etc/ssl/certs/ca-certificates.crt:ro
@@ -77,17 +77,19 @@ services:
       - UI_PASSWORD=syslog-admin-2026
       - OPENAI_API_KEY=not-used
       - PROXY_BASE_URL=https://litellm.sysloggh.net
+      - DOCS_URL=/docs
       - ANTHROPIC_API_KEY=not-used
       - GENERIC_CLIENT_ID=FHd7bs9dP5gHad2Ki23iUL5kQvFa0GRaj3nlLnNU
       - GENERIC_CLIENT_SECRET=aDkXQx82duqpxc98xxqp0quzzUf1mawsnOTqj7sx1acaS7rWSt02N5ksBCi92n8ZilRavigoYME6fLakP20Ixc9H2pxnSZFiOqQLb7BPi8UtsvfxmzXklD0HJIdbKFxe
       - GENERIC_AUTHORIZATION_ENDPOINT=https://auth.sysloggh.net/application/o/authorize/
-      - GENERIC_TOKEN_ENDPOINT=https://auth.sysloggh.net/application/o/token/
-      - GENERIC_USERINFO_ENDPOINT=https://auth.sysloggh.net/application/o/userinfo/
+      - GENERIC_TOKEN_ENDPOINT=http://harness-nginx/application/o/token/
+      - GENERIC_USERINFO_ENDPOINT=http://harness-nginx/application/o/userinfo/
       - GENERIC_SCOPE=openid email profile
       - GENERIC_ROLE_MAPPINGS_DEFAULT_ROLE=proxy_admin
       - SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
     extra_hosts:
       - "host.docker.internal:host-gateway"
+      - "auth.sysloggh.net:192.168.68.11"
     healthcheck:
       test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/health/liveliness')"]
       interval: 15s