# anyllm-proxy configuration reference
# Copy to .env and fill in the values you need:
#   cp .env.example .env
#
# Lines without a leading # are active defaults.
# Lines with # are optional or backend-specific — uncomment to use.

# ── Core / Server ─────────────────────────────────────────────────────────────
LISTEN_PORT=3000
# PROXY_CONFIG=/path/to/config.yaml      # Simple YAML, LiteLLM YAML, or TOML
REQUEST_TIMEOUT_SECS=900                  # 0 = disabled
# IP_ALLOWLIST=192.168.1.0/24,10.0.0.0/8 # Comma-separated CIDRs; bare IPs accepted
# TRUST_PROXY_HEADERS=true               # Use X-Forwarded-For for client IP (requires IP_ALLOWLIST)
# WEBHOOK_URLS=https://example.com/hook  # Comma-separated; fire-and-forget POST on request completion

# ── Auth / Access Control ─────────────────────────────────────────────────────
# Set exactly one of the following (or configure OIDC below).
# Without any, the proxy rejects all requests.
#
# PROXY_API_KEYS=sk-key1,sk-key2         # Comma-separated static keys
# LITELLM_MASTER_KEY=sk-...              # LiteLLM alias for PROXY_API_KEYS
# PROXY_OPEN_RELAY=false                 # true = accept any non-empty key (DEV ONLY — insecure)

# ── Backend Selection ─────────────────────────────────────────────────────────
BACKEND=openai                           # openai | azure | vertex | gemini | anthropic | bedrock

# Model mapping — Anthropic model names are mapped to backend model names.
# Defaults depend on BACKEND (gpt-4o / gpt-4o-mini for OpenAI; gemini-2.5-pro / gemini-2.5-flash for Vertex/Gemini).
# BIG_MODEL=gpt-4o                       # Handles claude-sonnet and claude-opus requests
# SMALL_MODEL=gpt-4o-mini               # Handles claude-haiku requests

# ── Backend: OpenAI ───────────────────────────────────────────────────────────
OPENAI_API_KEY=sk-...
# OPENAI_BASE_URL=https://api.openai.com  # Override for local LLMs, vLLM, Ollama, etc.
# OPENAI_API_FORMAT=chat                  # chat (default, Chat Completions) | responses (Responses API)

# ── Backend: Azure OpenAI ─────────────────────────────────────────────────────
# BACKEND=azure
# AZURE_OPENAI_API_KEY=...               # alias: AZURE_API_KEY
# AZURE_OPENAI_ENDPOINT=https://myresource.openai.azure.com  # alias: AZURE_API_BASE
# AZURE_OPENAI_DEPLOYMENT=gpt4o
# AZURE_OPENAI_API_VERSION=2024-10-21    # alias: AZURE_API_VERSION

# ── Backend: Google Vertex AI ─────────────────────────────────────────────────
# BACKEND=vertex
# VERTEX_PROJECT=my-gcp-project
# VERTEX_REGION=us-central1
# VERTEX_API_KEY=...                     # or use GOOGLE_ACCESS_TOKEN (one required)
# GOOGLE_ACCESS_TOKEN=...                # OAuth bearer token (alternative to VERTEX_API_KEY)

# ── Backend: Google Gemini ────────────────────────────────────────────────────
# BACKEND=gemini
# GEMINI_API_KEY=...
# GEMINI_BASE_URL=https://generativelanguage.googleapis.com/v1beta

# ── Backend: AWS Bedrock ──────────────────────────────────────────────────────
# BACKEND=bedrock
# AWS_REGION=us-east-1                   # alias: AWS_REGION_NAME
# AWS_ACCESS_KEY_ID=...
# AWS_SECRET_ACCESS_KEY=...
# AWS_SESSION_TOKEN=...                  # Optional; for STS temporary credentials

# ── Backend: Anthropic Passthrough ────────────────────────────────────────────
# No translation — forwards Anthropic requests as-is to the upstream Anthropic API.
# BACKEND=anthropic
# ANTHROPIC_API_KEY=sk-ant-...

# ── TLS / mTLS ────────────────────────────────────────────────────────────────
# TLS_CLIENT_CERT_P12=/path/to/client.p12   # PKCS#12 client cert for mTLS to backend
# TLS_CLIENT_CERT_PASSWORD=...              # Required if TLS_CLIENT_CERT_P12 is set
# TLS_CA_CERT=/path/to/ca.pem              # PEM CA for verifying the backend server cert

# ── Admin UI ──────────────────────────────────────────────────────────────────
# Requires --webui or --admin CLI flag (or WEBUI=1 via Docker entrypoint).
# ADMIN_PORT=3001
# ADMIN_BIND=127.0.0.1                   # Set to 0.0.0.0 in Docker (host port binding limits exposure)
# ADMIN_DB_PATH=admin.db                 # SQLite path; recommended: /data/admin.db in Docker
# ADMIN_TOKEN=                           # Set explicitly (min 32 chars recommended).
#                                        # Generate: openssl rand -hex 32
#                                        # If unset: auto-generated on each restart, written to ADMIN_TOKEN_PATH.
#                                        # Docker detached mode: docker compose exec proxy cat /data/.admin_token
# ADMIN_TOKEN_PATH=.admin_token          # Recommended: /data/.admin_token in Docker
# DISABLE_ADMIN=false                    # 1/true to force-disable even when --webui flag is passed
# WEBUI=1                                # Docker entrypoint shorthand for --webui (not read by proxy directly)

# ── Logging / Debug ───────────────────────────────────────────────────────────
RUST_LOG=info                            # error | warn | info | debug | trace
# LOG_BODIES=false                       # Log full request/response bodies at debug level
# REDACT_SECRETS=false                   # Redact detected secrets before forwarding JSON/text requests
# ANYLLM_DEGRADATION_WARNINGS=false      # Set x-anyllm-degradation header when features are silently dropped

# ── Rate Limiting (Redis) ─────────────────────────────────────────────────────
# Requires binary built with: --features redis
# REDIS_URL=redis://localhost:6379       # Docker compose: redis://redis:6379
# RATE_LIMIT_FAIL_POLICY=open            # open = allow on Redis failure | closed/deny = reject 503

# ── OIDC / JWT Auth ───────────────────────────────────────────────────────────
# When set, Bearer tokens are validated against the OIDC discovery endpoint.
# OIDC_ISSUER_URL=https://accounts.google.com
# OIDC_AUDIENCE=anyllm-proxy             # Defaults to issuer URL if unset (with a warning)

# ── Observability: Langfuse ───────────────────────────────────────────────────
# When both keys are set, all requests are traced to Langfuse automatically.
# LANGFUSE_PUBLIC_KEY=pk-lf-...
# LANGFUSE_SECRET_KEY=sk-lf-...
# LANGFUSE_HOST=https://cloud.langfuse.com  # Override for self-hosted instances

# ── Observability: OpenTelemetry ──────────────────────────────────────────────
# Requires binary built with: --features otel
# OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
# OTEL_SERVICE_NAME=anyllm-proxy
# OTEL_TRACES_SAMPLER=parentbased_always_on

# ── Semantic Cache (Qdrant) ───────────────────────────────────────────────────
# Requires binary built with: --features qdrant
# QDRANT_URL=http://localhost:6333
# QDRANT_COLLECTION=anyllm_cache         # Default collection name

# ── Model Pricing ─────────────────────────────────────────────────────────────
# MODEL_PRICING_FILE=/path/to/pricing.json
# JSON array of: {model_pattern, input_cost_per_token, output_cost_per_token, provider}
# Falls back to embedded pricing if the file is unreadable.