You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
51 lines
2.3 KiB
51 lines
2.3 KiB
# vLLM (llmsnap) ingress — Traefik dynamic configuration.
|
|
# Deployed by the "traefik" cookbook hook to /etc/quadlets/traefik/conf.d/vllm.yaml.
|
|
#
|
|
# This replaces the original HAProxy front-end. It keeps the same security model:
|
|
#
|
|
# 1. TLS termination with an automatic Let's Encrypt certificate.
|
|
# 2. API-key authentication (Authorization: Bearer <key>), enforced by the
|
|
# "api-key-and-token-middleware" community plugin. A missing/invalid key is
|
|
# rejected with HTTP 403.
|
|
# 3. A strict path allowlist: only the OpenAI inference surface (/v1/*) is
|
|
# exposed. Everything else — llmsnap's /upstream/* passthrough (hence vLLM's
|
|
# /sleep, /wake_up, /collective_rpc in VLLM_SERVER_DEV_MODE) and the whole
|
|
# management/UI surface — is NOT routed and therefore returns 404.
|
|
#
|
|
# Prerequisites in the traefik cookbook:
|
|
# - the "traefik-api-token-middleware" plugin declared in traefik.yaml
|
|
# (experimental.plugins) — provided by the traefik cookbook example config.
|
|
http:
|
|
middlewares:
|
|
# Bearer-token authentication. Extracts the token from "Authorization: Bearer
|
|
# <token>" and checks it against the allowlist below. On success the header is
|
|
# stripped before forwarding, so the key never reaches llmsnap/vLLM.
|
|
vllm-api-token:
|
|
plugin:
|
|
traefik-api-token-middleware:
|
|
bearerHeader: true
|
|
bearerHeaderName: "Authorization"
|
|
# Disable the X-API-TOKEN header form: OpenAI clients only send Bearer.
|
|
authenticationHeader: false
|
|
authenticationErrorMsg: "Access Denied"
|
|
removeHeadersOnSuccess: true
|
|
# Allowed API keys. Generate one with: echo "sk-$(openssl rand -hex 32)"
|
|
# List the RAW token here (without the "Bearer " prefix).
|
|
tokens:
|
|
- "secret123"
|
|
routers:
|
|
vllm:
|
|
# Adjust the Host to your public FQDN. Only /v1/* is routed (path allowlist).
|
|
rule: "Host(`vllm`) && PathPrefix(`/v1/`)"
|
|
entryPoints:
|
|
- http
|
|
middlewares:
|
|
- vllm-api-token
|
|
service: "vllm"
|
|
services:
|
|
vllm:
|
|
loadBalancer:
|
|
servers:
|
|
# llmsnap listens on the host loopback only; Traefik (Network=host)
|
|
# reaches it directly. llmsnap then proxies to the awake vLLM model.
|
|
- url: "http://127.0.0.1:8000"
|
|
|