Ilker ManapandClaude Opus 5.5
e751c89937
The website was a file built by hand outside the repository. It is now a template in internal/web: every gateway serves it at /about, without a key, linked from the landing page's footer, and the published site is rendered from the same template. The fonts are vendored (Latin subsets, OFL) so the page sends nobody's browser to Google. The proxy configurations it shows are copies of deploy/proxy, kept equal by a test. A development build says so instead of linking to release files that do not exist. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
64 lines
2.4 KiB
Nginx Configuration File
64 lines
2.4 KiB
Nginx Configuration File
# llmgw behind nginx: the client-facing port (8080) on a public name.
|
|
#
|
|
# Put this in /etc/nginx/sites-available/llmgw (or conf.d/llmgw.conf), replace
|
|
# llm.example.com, and get a certificate — certbot --nginx -d llm.example.com
|
|
# fills in the ssl_ lines below. Then: nginx -t && systemctl reload nginx
|
|
#
|
|
# Only 8080 goes through here. 7443 (agents) is mutual TLS with the cluster's
|
|
# own authority and must reach llmgw directly; 9090 and 9091 stay private.
|
|
|
|
upstream llmgw {
|
|
server 127.0.0.1:8080;
|
|
keepalive 32;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name llm.example.com;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
# `listen ... http2` rather than `http2 on;`: the latter needs nginx
|
|
# 1.25.1, and Ubuntu 22.04 and Debian 12 ship older ones. Newer nginx
|
|
# accepts this form with a deprecation warning.
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_name llm.example.com;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/llm.example.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/llm.example.com/privkey.pem;
|
|
|
|
# The router reads at most 32 MiB of body (router.max_body_bytes).
|
|
client_max_body_size 32m;
|
|
|
|
location / {
|
|
proxy_pass http://llmgw;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
|
|
# Set, never appended: llmgw decides from X-Forwarded-Proto whether
|
|
# session cookies are Secure, and builds the base URL the landing page
|
|
# shows from X-Forwarded-Host. A value passed through from the client
|
|
# would be the client's choice.
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
|
# Streamed replies: tokens go out as they are generated. Buffering
|
|
# turns a stream into one late burst, and gzip buffers too.
|
|
proxy_buffering off;
|
|
proxy_cache off;
|
|
gzip off;
|
|
|
|
# nginx's default is 60 seconds between two reads from upstream. A
|
|
# large model can think longer than that before its first token, and
|
|
# the client then sees a 504 for a request that was about to succeed.
|
|
# llmgw has its own limits (timeouts.*); this must not be the shorter.
|
|
proxy_read_timeout 15m;
|
|
proxy_send_timeout 15m;
|
|
}
|
|
}
|