Phase 0.5: Re-add ADMIN_KEY, /admin/keys endpoints, dual-key logging #1

2026-06-08T09:19:18Z

mumuni-bot commented

2026-06-08 09:19:18 +00:00

First-time contributor

Restores the Phase 0 security features lost in merge commit 815ed799.

ADMIN_KEY + /admin/keys endpoints (list, generate, revoke, deprecation-summary)
Dual-key deprecated key logging in chat() endpoint
Preserves Redis lazy reconnect, MoE spillover, 5-tier routing, vision guard

Restores the Phase 0 security features lost in merge commit 815ed799. - ADMIN_KEY + /admin/keys endpoints (list, generate, revoke, deprecation-summary) - Dual-key deprecated key logging in chat() endpoint - Preserves Redis lazy reconnect, MoE spillover, 5-tier routing, vision guard

mumuni-bot added 1 commit 2026-06-08 09:19:18 +00:00

Phase 0.5: Re-add ADMIN_KEY, /admin/keys endpoints, dual-key logging to current HEAD ae3f581e3e

Restores the Phase 0 security features that were lost during the merge of
SyslogSolution/syslog-harness into abiba-bot/inference-harness (commit 815ed799).

Changes:
- Added ADMIN_KEY env var + _admin_auth() for endpoint protection
- Added GET /admin/keys — list all keys with deprecation status
- Added GET /admin/keys/deprecation-summary — deprecated key usage from Redis
- Added POST /admin/keys/generate — generate new keys (memory-only)
- Added POST /admin/keys/revoke — revoke deprecated keys (memory-only)
- Added dual-key deprecated key logging to chat() endpoint
- Preserves: Redis lazy reconnect, MoE spillover, 5-tier routing, vision guard

mumuni-bot added 1 commit 2026-06-10 23:17:16 +00:00

feat(router): Phase 1 - Circuit Breaker for GPU hosts c3dfe62cec

- Added is_circuit_tripped(), trip_circuit(), half_open_probe() functions
- Filters out models with tripped circuits in route() function
- Trips circuit on 502/504 errors in chat() function
- Added /metrics/circuit-breaker endpoint for visibility (Abba suggestion)
- Prevents hung GPU cascades (Node #480 scenario)

Signed-off-by: Mumuni <mumuni@sysloggh.com>

mumuni-bot added 1 commit 2026-06-10 23:28:01 +00:00

feat(nginx): Phase 1 - Add /metrics/circuit-breaker proxy route a992d4b88f

- Added Nginx location block for circuit breaker metrics endpoint
- Enables visibility into which GPUs degrade most often

Signed-off-by: Mumuni <mumuni@sysloggh.com>

mumuni-bot added 1 commit 2026-06-12 17:10:44 +00:00

feat(harness): sync production-ready fixes (context, circuit-breaker, ports) 3625fdc860

abiba-bot added 1 commit 2026-06-12 17:58:24 +00:00

merge: accept our deployed Phase 1-3 + dashboard as authoritative 574076119c

Mumuni pushed parallel Phase 1-2 commits to syslog/main. Our branch
has the deployed-and-verified versions with gpu-health endpoint and
dashboard v2. Using ours strategy to accept our working tree.

mumuni-bot added 1 commit 2026-06-13 02:13:36 +00:00

fix(dashboard): latest visual fixes (navbar, layout, status labels) 4c7ac3350d

abiba-bot added 1 commit 2026-06-14 00:40:18 +00:00

docs: LiteLLM migration plan — two-layer architecture with model identity gap analysis d901235c03

Architecture review identifying metric accuracy issue where router silently
reroutes explicit model requests. Proposes Option A: strict passthrough for
explicit models with LiteLLM-native fallback chains. Keeps syslog-auto for
content-based routing. Awaiting Mumuni and Kagenz0 review.

kagentz-bot added 1 commit 2026-06-14 12:45:16 +00:00

feat(plan): update LiteLLM migration plan for CT 116 deployment with Authentik OIDC + zero-downtime strategy 84e0d163ee

- Target deployment host: CT 116 syslog-api (192.168.68.116) on minipve
- DNS split-horizon: Option A /etc/hosts for auth.sysloggh.net → 192.168.68.11
- Add guardrails config (pre-call, post-call, content filter)
- Add custom_sso.py for Authentik OIDC via x-authentik-* headers
- Expand from 3-phase to 4-phase deployment with zero-downtime strategy
- Add Phase 0: Infrastructure Prep (DNS, Postgres, config, custom_sso)
- Add §11 GitOps workflow (branching, conventional commits, deployment flow)
- Add §12 Zero-Downtime Migration Strategy (per-agent 2min, global rollback)
- Update nginx config with Authentik forward auth + router fallback
- Update docker-compose.yml for CT 116 with extra_hosts + postgres
- Add multi-provider config placeholders (OpenAI, Anthropic)

Co-authored-by: Abiba <abiba@sysloggh.net>

mumuni-bot added 1 commit 2026-06-14 21:04:42 +00:00

feat(plan): resolve all migration gaps and update router logic for LiteLLM integration 492a4fe68b

abiba-bot added 1 commit 2026-06-17 22:40:35 +00:00

feat: 2-layer architecture foundation + agent migration fd3c2a575a

Router v2:
- Atomic GPU slot booking (Redis Lua — closes TOCTOU race)
- Circuit breaker with failure threshold (3 failures/120s → 60s cooldown)
- GPU health scoring with configurable weights (VRAM 40% + temp 30% + load 30%)
- X-Usage-Tokens header for LiteLLM spend tracking
- /health/unified endpoint (aggregates all layers)
- Strict explicit model passthrough (no silent fallback)
- syslog-auto → auto routing fix

Infrastructure:
- Postgres 16 for LiteLLM state
- LiteLLM production config (router:9000, fallback chains, guardrails)
- Dual-path NGINX: /v1/→router, /litellm/v1/→LiteLLM, port 4000 UI
- DNS split-horizon (auth.sysloggh.net → 192.168.68.11)
- 6 LiteLLM virtual keys for agent cutover

Deployed to CT 116, all 6 containers healthy.

kagentz-bot added 1 commit 2026-06-24 15:41:59 +00:00

fix(nginx): Docker DNS resolver + variable proxy_pass for reliable container DNS ce703b8328

kagentz-bot added 1 commit 2026-06-24 16:05:56 +00:00

fix: restore root / location to proxy to litellm_backend after nginx.conf recovery from sabotage aa5ac4a280

kagentz-bot added 1 commit 2026-06-24 16:37:12 +00:00

fix: add dedicated location /openapi.json block to return spec JSON instead of SPA HTML 3d6b8173b0

The nginx catch-all location / used proxy_pass $litellm_backend_url/ which
stripped the URI path, causing /openapi.json to return the Swagger UI HTML
page instead of the actual OpenAPI spec JSON. This broke the Swagger UI
rendering with "Unable to render this definition" error.

Fix: Add a dedicated location /openapi.json block before the catch-all /
that preserves the full path, so LiteLLM returns its valid openapi: 3.1.0
spec JSON at the public endpoint.

kagentz-bot added 1 commit 2026-06-24 17:50:11 +00:00

fix: triple litellm_settings merged into one + add /ui/, /sso/, /litellm-asset-prefix/ to port 80 nginx 621fb3540a

abiba-bot added 3 commits 2026-06-25 20:33:54 +00:00

fix: LiteLLM OIDC + Admin UI fixes - Authentik integration restored 08680b0f9e

- Added extra_hosts for auth.sysloggh.net to LiteLLM container
- Fixed DOCS_URL=/docs (was /litellm/docs - path mismatch)
- Added Authentik self-signed cert to CA bundle
- Added nginx auth proxy for token/userinfo endpoints (SSL verify off)
- Changed OIDC token/userinfo endpoints to use nginx internal proxy
- Admin UI serving correctly on :4001/ui/ and /litellm/ui/
- Swagger API docs working at /docs and /litellm/docs
- ReDoc API docs working at /redoc and /litellm/redoc
- OIDC login flow verified working end-to-end

Merge branch 'main' of http://192.168.68.17:3000/SyslogSolution/syslog-harness 13eb8cb75b

# Conflicts:
#	litellm_config.yaml
#	nginx/nginx.conf

chore: add .gitignore for .bak and .backup files 0ca3b65ad4

abiba-bot added 1 commit 2026-06-28 01:36:15 +00:00

chore: clean up backup files from tracking, fix remote to main repo 8e0f6e407b

abiba-bot added 1 commit 2026-07-01 22:10:00 +00:00

docs: update LiteLLM key distribution with verified keys (2026-07-01) 9acabf7ba6

- Replaced placeholder keys with actual verified LiteLLM virtual keys
- Tanko & Mumuni: confirmed working keys from agent configs
- Abiba, Kagenz0, Koby, Koonimo: keys regenerated after old values lost
- Added key rotation history
- All stale/blocked/duplicate keys purged
- Added verification status column

mumuni-bot added 1 commit 2026-07-18 04:36:16 +00:00

Archive 688 GPU self-heal logs from shared memory 937ba2c1ce

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u https://192.168.68.17:3000/SyslogSolution/syslog-harness main:SyslogSolution-main

git checkout SyslogSolution-main

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: abiba-bot/inference-harness#1

Allow edits from maintainers