abiba-bot/inference-harness
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(nginx): Docker DNS resolver + variable proxy_pass for reliable container DNS

Browse Source
This commit is contained in:
kagentz-bot
2026-06-24 11:41:52 -04:00
parent fd3c2a575a
commit ce703b8328
2 changed files with 42 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx/nginx.conf
+42 -28
View File
@@ -8,9 +8,23 @@ http {
sendfile on; sendfile on;
keepalive_timeout 65; keepalive_timeout 65;
upstream router_api { server router:9000; } # Docker DNS resolver — forces request-time resolution for variable-based proxy_pass.
upstream dashboard_ui { server dashboard:3000; } # Without this, nginx resolves upstream hostnames at config load time,
upstream litellm_backend { server litellm:4000; } # which fails when Docker DNS (127.0.0.11) isn't ready yet on container start.
resolver 127.0.0.11 valid=30s;
# Dynamic upstream resolution via nginx variables.
# Using $var in proxy_pass forces request-time resolution through the resolver.
# Without this, 'host not found in upstream' crashes nginx when Docker DNS is slow.
map $host $router_api_url {
default http://harness-router:9000;
}
map $host $dashboard_ui_url {
default http://harness-dashboard:3000;
}
map $host $litellm_backend_url {
default http://harness-litellm:4000;
}
# Detect Cloudflare Tunnel requests (cloudflared always sets CF-Connecting-IP). # Detect Cloudflare Tunnel requests (cloudflared always sets CF-Connecting-IP).
# Direct LAN browser access to :4000 has no such header -> redirect to canonical https, # Direct LAN browser access to :4000 has no such header -> redirect to canonical https,
@@ -40,7 +54,7 @@ http {
# 2-Layer: /v1/ → router (existing keys work unchanged) # 2-Layer: /v1/ → router (existing keys work unchanged)
location /v1/ { location /v1/ {
proxy_pass http://router_api; proxy_pass $router_api_url;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
@@ -52,7 +66,7 @@ http {
} }
location @router_fallback { location @router_fallback {
proxy_pass http://router_api; proxy_pass $router_api_url;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
@@ -61,7 +75,7 @@ http {
} }
location /admin/ { location /admin/ {
proxy_pass http://router_api; proxy_pass $router_api_url;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
@@ -70,7 +84,7 @@ http {
} }
location /stream { location /stream {
proxy_pass http://router_api/stream; proxy_pass $router_api_url/stream;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
@@ -80,14 +94,14 @@ http {
} }
location /api/ { location /api/ {
proxy_pass http://router_api/; proxy_pass $router_api_url/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
} }
# LiteLLM gateway access (agents with new virtual keys) # LiteLLM gateway access (agents with new virtual keys)
location /litellm/v1/ { location /litellm/v1/ {
proxy_pass http://litellm_backend/v1/; proxy_pass $litellm_backend_url/v1/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
@@ -99,14 +113,14 @@ http {
# LiteLLM UI static assets # LiteLLM UI static assets
location /litellm-asset-prefix/ { location /litellm-asset-prefix/ {
proxy_pass http://litellm_backend/litellm-asset-prefix/; proxy_pass $litellm_backend_url/litellm-asset-prefix/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
} }
# LiteLLM Admin UI via /litellm/ prefix (LAN/internal access on :80) # LiteLLM Admin UI via /litellm/ prefix (LAN/internal access on :80)
location /litellm/ { location /litellm/ {
proxy_pass http://litellm_backend/; proxy_pass $litellm_backend_url/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
@@ -121,7 +135,7 @@ http {
} }
location /dashboard/ { location /dashboard/ {
proxy_pass http://dashboard_ui/; proxy_pass $dashboard_ui_url/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
} }
@@ -132,31 +146,31 @@ http {
} }
location /metrics/ { location /metrics/ {
proxy_pass http://router_api/metrics/; proxy_pass $router_api_url/metrics/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
} }
location /metrics/circuit-breaker { location /metrics/circuit-breaker {
proxy_pass http://router_api/metrics/circuit-breaker; proxy_pass $router_api_url/metrics/circuit-breaker;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
} }
location /router/ { location /router/ {
proxy_pass http://router_api/; proxy_pass $router_api_url/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
} }
location /health/unified { location /health/unified {
proxy_pass http://router_api/health/unified; proxy_pass $router_api_url/health/unified;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
} }
location /health { location /health {
proxy_pass http://router_api/health; proxy_pass $router_api_url/health;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Host $host; proxy_set_header Host $host;
} }
@@ -185,19 +199,19 @@ http {
# LiteLLM Admin UI + WebSocket # LiteLLM Admin UI + WebSocket
location /ui/ { location /ui/ {
proxy_pass http://litellm_backend/ui/; proxy_pass $litellm_backend_url/ui/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
proxy_read_timeout 86400s; proxy_read_timeout 86400s;
proxy_buffering off; proxy_buffering off;
proxy_redirect http://litellm_backend/ https://litellm.sysloggh.net/; proxy_redirect $litellm_backend_url/ https://litellm.sysloggh.net/;
proxy_redirect http://litellm.sysloggh.net:4000/ https://litellm.sysloggh.net/; proxy_redirect http://litellm.sysloggh.net:4000/ https://litellm.sysloggh.net/;
} }
# UI static assets # UI static assets
location /litellm-asset-prefix/ { location /litellm-asset-prefix/ {
proxy_pass http://litellm_backend/litellm-asset-prefix/; proxy_pass $litellm_backend_url/litellm-asset-prefix/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
@@ -205,14 +219,14 @@ http {
# SSO callback # SSO callback
location /sso/ { location /sso/ {
proxy_pass http://litellm_backend/sso/; proxy_pass $litellm_backend_url/sso/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_read_timeout 600s; proxy_read_timeout 600s;
} }
# API # API
location /v1/ { location /v1/ {
proxy_pass http://litellm_backend/v1/; proxy_pass $litellm_backend_url/v1/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Authorization $http_authorization; proxy_set_header Authorization $http_authorization;
proxy_read_timeout 600s; proxy_read_timeout 600s;
@@ -221,35 +235,35 @@ http {
# Key management + admin API # Key management + admin API
location /key/ { location /key/ {
proxy_pass http://litellm_backend/key/; proxy_pass $litellm_backend_url/key/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Authorization $http_authorization; proxy_set_header Authorization $http_authorization;
} }
location /user/ { location /user/ {
proxy_pass http://litellm_backend/user/; proxy_pass $litellm_backend_url/user/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Authorization $http_authorization; proxy_set_header Authorization $http_authorization;
} }
location /model/ { location /model/ {
proxy_pass http://litellm_backend/model/; proxy_pass $litellm_backend_url/model/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Authorization $http_authorization; proxy_set_header Authorization $http_authorization;
} }
location /team/ { location /team/ {
proxy_pass http://litellm_backend/team/; proxy_pass $litellm_backend_url/team/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Authorization $http_authorization; proxy_set_header Authorization $http_authorization;
} }
# Health # Health
location /health { location /health {
proxy_pass http://litellm_backend/health; proxy_pass $litellm_backend_url/health;
proxy_http_version 1.1; proxy_http_version 1.1;
} }
# Root + everything else → LiteLLM (UI index, /configs, /spend, etc.) # Root + everything else → LiteLLM (UI index, /configs, /spend, etc.)
location / { location / {
proxy_pass http://litellm_backend/; proxy_pass $litellm_backend_url/;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
nginx/nginx.conf.bak
-95
View File
@@ -1,95 +0,0 @@
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events { worker_connections 1024; }
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" rt=$request_time';
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log;
sendfile on;
keepalive_timeout 65;
upstream router_api { server router:9000; }
upstream dashboard_ui { server dashboard:3000; }
upstream litellm_backend { server litellm:4000; }
server {
listen 80;
# Security headers
add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-XSS-Protection "1; mode=block" always;
# Disable buffering for SSE streams
proxy_buffering off;
# API — through router
location /v1/ {
proxy_pass http://router_api;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Authorization $http_authorization;
proxy_connect_timeout 10s;
proxy_read_timeout 600s;
proxy_buffering off;
}
# SSE streaming endpoint
location /stream {
proxy_pass http://router_api;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header Connection "";
proxy_buffering off;
chunked_transfer_encoding off;
}
# Dashboard API proxy for SSE
location /api/ {
proxy_pass http://dashboard_ui;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_buffering off;
}
# LiteLLM debug
location /litellm/ {
rewrite ^/litellm/(.*) /$1 break;
proxy_pass http://litellm_backend;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header Authorization $http_authorization;
}
# Dashboard
location / {
proxy_pass http://dashboard_ui;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_buffering off;
}
# Performance analytics
location /metrics/ {
proxy_pass http://router_api;
proxy_http_version 1.1;
proxy_set_header Host $host;
}
location /health {
proxy_pass http://router_api/health;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
}