services:
  litellm:
    image: ghcr.io/berriai/litellm@sha256:7c311546c25e7bb6e8cafede9fcd3d0d622ac636b5c9418befaa32e85dfb0186
    container_name: litellm
    restart: unless-stopped
    command: ["--config", "/app/config.yaml"]
    environment:
      DEEPSEEK_API_KEY: ${DEEPSEEK_API_KEY}
      LITELLM_MASTER_KEY: ${LITELLM_MASTER_KEY}
      LITELLM_SALT_KEY: ${LITELLM_SALT_KEY}
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@litellm-db:5432/${POSTGRES_DB}
      STORE_MODEL_IN_DB: "True"
      CODEX_AUTH_FILE: /root/.codex/auth.json
      CLAUDE_AUTH_FILE: /root/.claude/.credentials.json
      CLAUDE_DEBUG: "1"
    volumes:
      - ./config.yaml:/app/config.yaml:ro
      - ./codex_provider.py:/app/codex_provider.py:ro
      - ./claude_provider.py:/app/claude_provider.py:ro
      # Mount the directory so atomic auth.json replacements from `codex login`
      # are immediately visible inside the container.
      - /home/felidae/.codex:/root/.codex:rw
      - /home/felidae/.claude/.credentials.json:/root/.claude/.credentials.json:rw
    depends_on:
      - litellm-db
    networks:
      - litellm
      - proxy
    labels:
      prune.protect: "true"
      # Traefik routing → /opt/traefik/dynamic/litellm.yml
      # API — sin auth, accesible con LITELLM_MASTER_KEY
      # UI — protegida con Authentik
      homepage.group: "Automatizacion y desarrollo"
      homepage.name: "LiteLLM"
      homepage.href: "https://llm.sherlockhomeless.net"
      homepage.description: "Proxy de APIs LLM (DeepSeek, OpenAI...)"
      homepage.icon: "https://docs.litellm.ai/img/favicon.ico"
      homepage.siteMonitor: "https://llm.sherlockhomeless.net"

  litellm-db:
    image: postgres:16
    container_name: litellm-pg
    restart: unless-stopped
    labels:
      prune.protect: "true"
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - ${LITELLM_DB_DATA_PATH}:/var/lib/postgresql/data:Z
    networks:
      litellm:
        aliases:
          - litellm-db

networks:
  litellm:
    driver: bridge
  proxy:
    external: true