352 lines
13 KiB
Plaintext
352 lines
13 KiB
Plaintext
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
sendfile on;
|
|
keepalive_timeout 65;
|
|
|
|
# Docker DNS resolver — forces request-time resolution for variable-based proxy_pass.
|
|
# Without this, nginx resolves upstream hostnames at config load time,
|
|
# which fails when Docker DNS (127.0.0.11) isn't ready yet on container start.
|
|
resolver 127.0.0.11 valid=30s;
|
|
|
|
# Dynamic upstream resolution via nginx variables.
|
|
# Using $var in proxy_pass forces request-time resolution through the resolver.
|
|
# Without this, 'host not found in upstream' crashes nginx when Docker DNS is slow.
|
|
map $host $router_api_url {
|
|
default http://harness-router:9000;
|
|
}
|
|
map $host $dashboard_ui_url {
|
|
default http://harness-dashboard:3000;
|
|
}
|
|
map $host $litellm_backend_url {
|
|
default http://harness-litellm:4000;
|
|
}
|
|
|
|
# Detect Cloudflare Tunnel requests (cloudflared always sets CF-Connecting-IP).
|
|
# Direct LAN browser access to :4000 has no such header -> redirect to canonical https,
|
|
# preventing the cross-origin localStorage footgun that traps the UI at the login page.
|
|
map $http_cf_connecting_ip $is_cloudflared {
|
|
default 1; # any non-empty value = request came through Cloudflare
|
|
"" 0; # empty = direct access
|
|
}
|
|
|
|
# ════════════════════════════════════════════════════════════════
|
|
# Server :80 — existing harness entrypoint
|
|
# dashboard (/), router API (/v1/, /admin/, /stream, /api/, /metrics),
|
|
# router fallback, LiteLLM UI via /litellm/ prefix, health
|
|
# ════════════════════════════════════════════════════════════════
|
|
server {
|
|
listen 80;
|
|
|
|
# Authentik OIDC subrequest
|
|
location /authentik/auth {
|
|
internal;
|
|
proxy_pass https://auth.sysloggh.net/outpost.goauthentik.io/auth/nginx;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
}
|
|
|
|
# 2-Layer: /v1/ → router (existing keys work unchanged)
|
|
location /v1/ {
|
|
proxy_pass $router_api_url;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_connect_timeout 10s;
|
|
proxy_read_timeout 600s;
|
|
proxy_buffering off;
|
|
error_page 502 503 = @router_fallback;
|
|
}
|
|
|
|
location @router_fallback {
|
|
proxy_pass $router_api_url;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_read_timeout 600s;
|
|
}
|
|
|
|
location /admin/ {
|
|
proxy_pass $router_api_url;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_read_timeout 600s;
|
|
}
|
|
|
|
location /stream {
|
|
proxy_pass $router_api_url/stream;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location /api/ {
|
|
proxy_pass $router_api_url/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# LiteLLM gateway access (agents with new virtual keys)
|
|
location /litellm/v1/ {
|
|
proxy_pass $litellm_backend_url/v1/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_connect_timeout 10s;
|
|
proxy_read_timeout 600s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# LiteLLM UI static assets
|
|
location /litellm-asset-prefix/ {
|
|
proxy_pass $litellm_backend_url/litellm-asset-prefix/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# LiteLLM Admin UI at /ui/ (public access via Traefik → port 80)
|
|
# LiteLLM Admin UI at /ui/ (must be before catch-all /)
|
|
location /ui/ {
|
|
proxy_pass $litellm_backend_url/ui/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 86400s;
|
|
proxy_buffering off;
|
|
error_page 301 302 = @ui_redirect;
|
|
}
|
|
|
|
location @ui_redirect {
|
|
proxy_pass $litellm_backend_url;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location /ui/ {
|
|
proxy_pass $litellm_backend_url/ui/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 86400s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# SSO callback
|
|
location /sso/ {
|
|
proxy_pass $litellm_backend_url/sso/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_read_timeout 600s;
|
|
}
|
|
|
|
# LiteLLM UI static assets on port 80
|
|
location /litellm-asset-prefix/ {
|
|
proxy_pass $litellm_backend_url/litellm-asset-prefix/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
}
|
|
|
|
# LiteLLM Admin UI via /litellm/ prefix (LAN/internal access on :80)
|
|
location /litellm/ {
|
|
proxy_pass $litellm_backend_url/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 86400s;
|
|
proxy_buffering off;
|
|
proxy_redirect http://$host/ /litellm/;
|
|
proxy_redirect https://$host/ /litellm/;
|
|
}
|
|
|
|
location /dashboard/ {
|
|
proxy_pass $dashboard_ui_url/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# Dedicated /openapi.json block — must come before catch-all /
|
|
# LiteLLM serves valid openapi: 3.1.0 JSON at this path internally,
|
|
# but the catch-all location / strips the URI path. This block
|
|
# preserves the full path so the spec JSON is returned instead of
|
|
# the Swagger UI SPA HTML.
|
|
location /openapi.json {
|
|
proxy_pass $litellm_backend_url/openapi.json;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_connect_timeout 10s;
|
|
proxy_read_timeout 600s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location / {
|
|
proxy_pass $litellm_backend_url/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_connect_timeout 10s;
|
|
proxy_read_timeout 600s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location /metrics/ {
|
|
proxy_pass $router_api_url/metrics/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
location /metrics/circuit-breaker {
|
|
proxy_pass $router_api_url/metrics/circuit-breaker;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
location /router/ {
|
|
proxy_pass $router_api_url/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
location /health/unified {
|
|
proxy_pass $router_api_url/health/unified;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
location /health {
|
|
proxy_pass $router_api_url/health;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
}
|
|
}
|
|
|
|
# ════════════════════════════════════════════════════════════════
|
|
# Server :4000 — external LiteLLM entrypoint (cloudflared target)
|
|
# Fixes the /ui redirect: forces correct Host + scheme so LiteLLM
|
|
# builds external URLs instead of leaking 192.168.68.116:4000.
|
|
# LiteLLM itself is now bound to 127.0.0.1 only (see compose).
|
|
# ════════════════════════════════════════════════════════════════
|
|
server {
|
|
listen 4000;
|
|
|
|
# Canonical external identity — overrides whatever Host cloudflared sends
|
|
proxy_set_header Host litellm.sysloggh.net;
|
|
proxy_set_header X-Forwarded-Host litellm.sysloggh.net;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
|
|
# /ui → /ui/ — absolute redirect (cloudflared rewrites Host to origin IP,
|
|
# so a relative return would be absolutized to http://192.168.68.116:4000/).
|
|
location = /ui { return 301 https://litellm.sysloggh.net/ui/; }
|
|
|
|
# LiteLLM Admin UI + WebSocket
|
|
location /ui/ {
|
|
proxy_pass $litellm_backend_url/ui/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 86400s;
|
|
proxy_buffering off;
|
|
proxy_redirect $litellm_backend_url/ https://litellm.sysloggh.net/;
|
|
proxy_redirect http://litellm.sysloggh.net:4000/ https://litellm.sysloggh.net/;
|
|
}
|
|
|
|
# UI static assets
|
|
location /litellm-asset-prefix/ {
|
|
proxy_pass $litellm_backend_url/litellm-asset-prefix/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
}
|
|
|
|
# SSO callback
|
|
location /sso/ {
|
|
proxy_pass $litellm_backend_url/sso/;
|
|
proxy_http_version 1.1;
|
|
proxy_read_timeout 600s;
|
|
}
|
|
|
|
# API
|
|
location /v1/ {
|
|
proxy_pass $litellm_backend_url/v1/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_read_timeout 600s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# Key management + admin API
|
|
location /key/ {
|
|
proxy_pass $litellm_backend_url/key/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Authorization $http_authorization;
|
|
}
|
|
location /user/ {
|
|
proxy_pass $litellm_backend_url/user/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Authorization $http_authorization;
|
|
}
|
|
location /model/ {
|
|
proxy_pass $litellm_backend_url/model/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Authorization $http_authorization;
|
|
}
|
|
location /team/ {
|
|
proxy_pass $litellm_backend_url/team/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Authorization $http_authorization;
|
|
}
|
|
|
|
# Health
|
|
location /health {
|
|
proxy_pass $litellm_backend_url/health;
|
|
proxy_http_version 1.1;
|
|
}
|
|
|
|
# Root + everything else → LiteLLM (UI index, /configs, /spend, etc.)
|
|
location / {
|
|
proxy_pass $litellm_backend_url/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 86400s;
|
|
proxy_buffering off;
|
|
proxy_redirect http://192.168.68.116:4000/ https://litellm.sysloggh.net/;
|
|
proxy_redirect https://192.168.68.116:4000/ https://litellm.sysloggh.net/;
|
|
}
|
|
}
|
|
}
|