config

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 24, 2026 License: AGPL-3.0 Imports: 5 Imported by: 0

Documentation

Overview

Package config loads and validates the gateway's single YAML config file.

Index

Constants

View Source 
const (
	ModalityText            = "text"
	ModalityImageGen        = "image_gen"
	ModalityVideoGen        = "video_gen"
	ModalityAudioSpeech     = "audio_speech"
	ModalityAudioTranscribe = "audio_transcribe"
	ModalityRealtime        = "realtime"
)

Modalities a provider may advertise. Kept as strings so hooks/proxy can share the same vocabulary without importing each other for constants only.

View Source 
const (
	KindOpenAI       = "openai"
	KindOpenAICompat = "openai_compat"
	KindAnthropic    = "anthropic"
	KindGoogle       = "google"
)

Provider kinds. A kind selects the egress adapter; a provider is a named, configured instance of a kind (many providers can share the openai_compat kind).

View Source 
const (
	OAuthGrantClientCredentials = "client_credentials"
	OAuthGrantRefreshToken      = "refresh_token"
)

OAuth grant type constants.

View Source 
const (
	AuthAPIKey         = "api_key"         // default: x-goog-api-key / Bearer / x-api-key from client or api_key_env
	AuthADC            = "adc"             // Google ADC / injected or auto SA TokenSource → Bearer
	AuthServiceAccount = "service_account" // same as adc for token application; auto SA from file when set
	AuthOAuth2         = "oauth2"          // YAML oauth block → built-in client_credentials / refresh_token TokenSource
	AuthClientBearer   = "client_bearer"   // always forward client Bearer; never replace with api_key_env
	AuthBearer         = "bearer"          // force Bearer (OpenAI-style) even for google-shaped hosts
)

Auth modes for a provider. Empty / "api_key" is the historical default.

View Source 
const DefaultAutoBreakpointMinChars = 2048

DefaultAutoBreakpointMinChars is used when auto_breakpoints.min_chars is 0.

View Source 
const DefaultMaxBodyBytes int64 = 32 << 20 // 32 MiB

DefaultMaxBodyBytes is the request/response body cap when max_body_bytes is unset.

Variables

This section is empty.

Functions

func VertexBaseURL 

func VertexBaseURL(project, location string) string

VertexBaseURL builds a publisher models base URL for Vertex AI dual-path deployments (#136). 

https://{location}-aiplatform.googleapis.com/v1/projects/{project}/locations/{location}/publishers/google

Operators set this as provider.base_url (append nothing — Path() adds /models/…). Global endpoint: pass location "global" → https://aiplatform.googleapis.com/v1/...

Types

type AutoBreakpoints 

type AutoBreakpoints struct {
	// Enabled must be true; default false.
	Enabled bool `yaml:"enabled"`
	// MinChars is the minimum total character length for a target before a
	// breakpoint is added. 0 / unset → DefaultAutoBreakpointMinChars (2048).
	MinChars int `yaml:"min_chars"`
	// Targets lists surfaces to mark: "system", "tools". Empty when enabled
	// → both. Unknown names are rejected at validate time.
	Targets []string `yaml:"targets"`
}

AutoBreakpoints config for opt-in Anthropic cache_control injection.

func (AutoBreakpoints) AutoBreakpointMinChars 

func (a AutoBreakpoints) AutoBreakpointMinChars() int

AutoBreakpointMinChars returns the effective min_chars (default 2048).

func (AutoBreakpoints) AutoBreakpointTargets 

func (a AutoBreakpoints) AutoBreakpointTargets() []string

AutoBreakpointTargets returns normalized targets; empty config → system+tools when enabled is considered by the caller.

type Caching 

type Caching struct {
	// AutoBreakpoints optionally inserts Anthropic cache_control on translate
	// paths that rebuild toward Anthropic (OpenAI/Google → Anthropic). Never
	// applies on passthrough. Default disabled.
	AutoBreakpoints AutoBreakpoints `yaml:"auto_breakpoints"`
}

Caching is optional prompt-caching behavior (default all-off).

type Capabilities 

type Capabilities struct {
	Text            bool `yaml:"text"`
	ImageGen        bool `yaml:"image_gen"`
	VideoGen        bool `yaml:"video_gen"`
	AudioSpeech     bool `yaml:"audio_speech"`
	AudioTranscribe bool `yaml:"audio_transcribe"`
	Realtime        bool `yaml:"realtime"`
}

Capabilities declares which modalities a provider can serve. When Provider.Capabilities is nil, DefaultCapabilities(kind) applies.

func DefaultCapabilities 

func DefaultCapabilities(kind string) Capabilities

DefaultCapabilities returns built-in defaults for a provider kind. 

openai      — all modalities
google      — text + media + realtime (Live)
anthropic   — text only (no native image/video/audio/realtime APIs)
openai_compat — text only (media/realtime must be opted in)

type Config 

type Config struct {
	Listen    string              `yaml:"listen"`
	Providers map[string]Provider `yaml:"providers"`
	Defaults  Defaults            `yaml:"defaults"`
	Aliases   map[string]string   `yaml:"aliases"` // public alias -> "provider/upstream-model"
	Hooks     Hooks               `yaml:"hooks"`
	Realtime  Realtime            `yaml:"realtime"`
	EdgeAuth  EdgeAuth            `yaml:"edge_auth"`
	// TLS enables HTTPS (ListenAndServeTLS) when both cert and key paths are set.
	// For local Claude Code, generate certs with examples/scripts/gen-localhost-tls.sh.
	TLS *TLSConfig `yaml:"tls"`
	// MaxBodyBytes caps request and response bodies (bytes). 0 / unset → DefaultMaxBodyBytes (32 MiB).
	MaxBodyBytes int64 `yaml:"max_body_bytes"`
	// ObserveDroppedFields, when true, sets response header x-gateway-dropped-fields
	// (comma-separated field names only, never payloads) on cross-dialect translate
	// paths where known vendor fields are not mapped. Default false (#152).
	ObserveDroppedFields bool `yaml:"observe_dropped_fields"`
	// HealthChecks configures optional upstream provider probes (#94/#153).
	// Distinct from GET /healthz (process liveness only).
	HealthChecks HealthChecks `yaml:"health_checks"`
	// Caching holds optional prompt-caching helpers. Default off (never invent
	// cache breakpoints without operator opt-in).
	Caching Caching `yaml:"caching"`
}

func Load 

func Load(path string) (*Config, error)

func Parse 

func Parse(raw []byte) (*Config, error)

func (*Config) BodyLimit 

func (c *Config) BodyLimit() int64

BodyLimit returns the effective request/response body size cap in bytes.

func (*Config) EdgeKeys 

func (c *Config) EdgeKeys() []string

EdgeKeys returns the configured edge-auth secrets (inline + keys_env), trimmed, non-empty, de-duplicated by first occurrence.

func (*Config) TLSEnabled 

func (c *Config) TLSEnabled() bool

TLSEnabled reports whether both cert and key are configured.

type Defaults 

type Defaults struct {
	OpenAIDialect    string `yaml:"openai_dialect"`    // provider for bare model ids on /v1/chat/completions
	AnthropicDialect string `yaml:"anthropic_dialect"` // provider for bare model ids on /v1/messages
	GoogleDialect    string `yaml:"google_dialect"`    // provider for bare model ids on Gemini generateContent
}

type EdgeAuth 

type EdgeAuth struct {
	Enabled bool     `yaml:"enabled"`
	Keys    []string `yaml:"keys"`     // optional inline keys
	KeysEnv string   `yaml:"keys_env"` // env var with comma-separated keys
}

EdgeAuth is optional gateway-edge authentication. When enabled, every route except GET /healthz requires a matching key in Authorization: Bearer … or x-api-key. Distinct from provider api_key_env (upstream credentials).

Prefer keys_env in production; keys may be listed inline for local tests. keys_env value is comma-separated (whitespace trimmed). Empty entries ignored.

type HealthChecks 

type HealthChecks struct {
	// Enabled must be true for the route to probe upstreams (default false).
	Enabled bool `yaml:"enabled"`
	// Timeout per-provider probe; 0 → 2s.
	Timeout time.Duration `yaml:"timeout"`
}

HealthChecks gates GET /v1/health/providers (default disabled).

func (HealthChecks) HealthTimeout 

func (h HealthChecks) HealthTimeout() time.Duration

HealthTimeout returns the per-provider probe timeout (default 2s).

type Hooks 

type Hooks struct {
	JSONL   *JSONLHook   `yaml:"jsonl"`
	Webhook *WebhookHook `yaml:"webhook"`
}

type JSONLHook 

type JSONLHook struct {
	Output string `yaml:"output"` // "stdout", "stderr", or a file path
}

type OAuthConfig 

type OAuthConfig struct {
	TokenURL        string            `yaml:"token_url"`
	ClientID        string            `yaml:"client_id"` // prefer client_id_env
	ClientIDEnv     string            `yaml:"client_id_env"`
	ClientSecret    string            `yaml:"client_secret"` // prefer client_secret_env
	ClientSecretEnv string            `yaml:"client_secret_env"`
	RefreshToken    string            `yaml:"refresh_token"` // prefer refresh_token_env
	RefreshTokenEnv string            `yaml:"refresh_token_env"`
	Scopes          []string          `yaml:"scopes"`
	Audience        string            `yaml:"audience"` // optional form field "audience"
	Extra           map[string]string `yaml:"extra"`    // extra form fields (no secrets in logs)
	// Grant overrides auto detection: "client_credentials" | "refresh_token".
	Grant string `yaml:"grant"`
	// Credentials is a subauth store provider id: chatgpt | claude | grok.
	// When set, the gateway loads/refreshes tokens from the local auth store
	// (see `llm-gateway auth login`). token_url is not required in this mode.
	Credentials string `yaml:"credentials"`
}

OAuthConfig is the YAML oauth: block for auth: oauth2 (#104). Secrets should come from env vars (*_env); inline fields are allowed for tests.

Grant selection (when grant is empty):

  • refresh_token if refresh_token / refresh_token_env is set
  • else client_credentials

Subscription OAuth (ChatGPT / Claude / SuperGrok): set credentials to a subauth provider id (chatgpt|claude|grok). Tokens come from `llm-gateway auth login` store; token_url/client secrets are optional.

func (*OAuthConfig) EffectiveGrant 

func (o *OAuthConfig) EffectiveGrant() (string, error)

EffectiveGrant returns the OAuth grant type (auto or explicit). Auto: refresh_token when a refresh credential is configured; else client_credentials.

func (*OAuthConfig) ResolvedClientID 

func (o *OAuthConfig) ResolvedClientID() string

ResolvedClientID returns inline client_id or the value of client_id_env.

func (*OAuthConfig) ResolvedClientSecret 

func (o *OAuthConfig) ResolvedClientSecret() string

ResolvedClientSecret returns inline client_secret or the value of client_secret_env.

func (*OAuthConfig) ResolvedRefreshToken 

func (o *OAuthConfig) ResolvedRefreshToken() string

ResolvedRefreshToken returns inline refresh_token or the value of refresh_token_env.

type Provider 

type Provider struct {
	Kind    string `yaml:"kind"`
	BaseURL string `yaml:"base_url"` // includes version prefix, e.g. https://api.openai.com/v1
	// APIKeyEnv names an env var holding an upstream key. When set, it replaces
	// the client-forwarded key. When empty, the client's key is forwarded as-is.
	APIKeyEnv string `yaml:"api_key_env"`
	// Auth selects how the gateway authenticates to the upstream.
	// Empty or "api_key" (default): use client key / api_key_env with kind scheme.
	// "adc" / "service_account": OAuth2 access token via TokenSource (Bearer).
	// "oauth2": YAML oauth block → built-in TokenSource (client_credentials / refresh_token).
	// "client_bearer": always forward client Authorization Bearer; never replace with env.
	// "bearer": force Authorization: Bearer (useful for some Vertex-style hosts).
	Auth string `yaml:"auth"`
	// ServiceAccountFile is an optional path to a GCP service-account JSON key.
	// With auth: service_account (or adc), the binary auto-builds a JWT TokenSource
	// from this file when present (no SetTokenSource inject required).
	ServiceAccountFile string `yaml:"service_account_file"`
	// TokenFile is an optional path to a plain-text access token (trimmed).
	// Used with auth: adc / service_account for WIF sidecars or projected tokens
	// that write a short-lived bearer token to disk (#164). Re-read on each
	// Token() (cache via CachingTokenSource TTL).
	TokenFile string `yaml:"token_file"`
	// OAuth holds OAuth2 client settings when auth is oauth2 (#104).
	OAuth *OAuthConfig `yaml:"oauth"`
	// Capabilities overrides kind defaults. Nil → DefaultCapabilities(Kind).
	// openai_compat defaults to text-only; set image_gen/video_gen/… explicitly.
	Capabilities *Capabilities `yaml:"capabilities"`
}

func (Provider) AuthMode 

func (p Provider) AuthMode() string

AuthMode returns the effective auth mode for the provider (default api_key).

func (Provider) EffectiveCapabilities 

func (p Provider) EffectiveCapabilities() Capabilities

EffectiveCapabilities returns explicit overrides or kind defaults.

func (Provider) Supports 

func (p Provider) Supports(modality string) bool

Supports reports whether the provider can serve modality.

func (Provider) UsesTokenSource 

func (p Provider) UsesTokenSource() bool

UsesTokenSource reports whether the provider authenticates via a server-held TokenSource (ADC, service_account, or oauth2) rather than a client/env API key.

type Realtime 

type Realtime struct {
	MaxSessions       int `yaml:"max_sessions"`
	MaxSessionMinutes int `yaml:"max_session_minutes"`
}

Realtime holds process-wide WebSocket session limits (PR5+).

type TLSConfig 

type TLSConfig struct {
	CertFile string `yaml:"cert_file"`
	KeyFile  string `yaml:"key_file"`
}

TLSConfig is optional server-side TLS for the gateway process.

type WebhookHook 

type WebhookHook struct {
	URL     string        `yaml:"url"`
	Timeout time.Duration `yaml:"timeout"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.