litellm:
  nameOverride: litellm
  replicaCount: 1

  image:
    pullPolicy: IfNotPresent
    tag: v1.84.0

  service:
    type: ClusterIP
    port: 4000

  resources:
    requests:
      cpu: 100m
      memory: 512Mi
    limits:
      memory: 2Gi

  masterkeySecretName: litellm-secrets
  masterkeySecretKey: master-key
  environmentConfigMaps:
    - litellm-env

  db:
    useExisting: true
    deployStandalone: false
    endpoint: litellm-pg-cluster-rw.litellm.svc.cluster.local
    database: litellm
    secret:
      name: litellm-pg-cluster-app
      usernameKey: username
      passwordKey: password
      endpointKey: host

  migrationJob:
    enabled: true
    hooks:
      argocd:
        enabled: false
      helm:
        enabled: false
    resources:
      requests:
        cpu: 100m
        memory: 512Mi
      limits:
        memory: 2Gi

  proxy_config:
    model_list:
      - model_name: qwen3-27b
        litellm_params:
          model: openai/qwen3.6-27B
          api_base: http://framework-llm:8080/v1
          api_key: not-needed
      - model_name: qwen3-122b-a10b
        litellm_params:
          model: openai/qwen3.5-122B-A10B
          api_base: http://framework-llm:8080/v1
          api_key: not-needed
      - model_name: qwen35-4b
        litellm_params:
          model: openai/qwen35-4b
          api_base: http://framework-llm:8080/v1
          api_key: not-needed
    general_settings:
      master_key: os.environ/PROXY_MASTER_KEY
    litellm_settings:
      drop_params: true

  envVars:
    DD_ENV: production
    DD_SERVICE: litellm
    USE_DDTRACE: "false"

  extraEnvVars:
    - name: LITELLM_SALT_KEY
      valueFrom:
        secretKeyRef:
          name: litellm-secrets
          key: salt-key

  extraResources:
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        name: litellm-env
        namespace: litellm
      data:
        LITELLM_ENV: production
    - apiVersion: postgresql.cnpg.io/v1
      kind: Cluster
      metadata:
        name: litellm-pg-cluster
        namespace: litellm
      spec:
        instances: 2
        bootstrap:
          initdb:
            database: litellm
            owner: litellm
        storage:
          storageClass: local-path
          size: 10Gi
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
          limits:
            memory: 512Mi
        plugins:
          - enabled: true
            name: barman-cloud.cloudnative-pg.io
            isWALArchiver: true
            parameters:
              barmanObjectName: litellm-backup-store
    - apiVersion: barmancloud.cnpg.io/v1
      kind: ObjectStore
      metadata:
        name: litellm-backup-store
        namespace: litellm
      spec:
        retentionPolicy: "30d"
        configuration:
          destinationPath: s3://cnpg-backup-litellm/
          endpointURL: http://rook-ceph-rgw-ceph-objectstore.rook-ceph.svc:80
          s3Credentials:
            accessKeyId:
              name: litellm-pg-backups
              key: AWS_ACCESS_KEY_ID
            secretAccessKey:
              name: litellm-pg-backups
              key: AWS_SECRET_ACCESS_KEY
          wal:
            compression: bzip2
          data:
            compression: bzip2
            immediateCheckpoint: true
    - apiVersion: postgresql.cnpg.io/v1
      kind: ScheduledBackup
      metadata:
        name: litellm-pg-backup
        namespace: litellm
      spec:
        method: plugin
        immediate: true
        schedule: "0 15 3 * * *"
        backupOwnerReference: self
        cluster:
          name: litellm-pg-cluster
        pluginConfiguration:
          name: barman-cloud.cloudnative-pg.io
    - apiVersion: objectbucket.io/v1alpha1
      kind: ObjectBucketClaim
      metadata:
        name: litellm-pg-backups
        namespace: litellm
      spec:
        bucketName: cnpg-backup-litellm
        storageClassName: ceph-bucket
        additionalConfig:
          maxSize: "50Gi"

oauth2-proxy:
  config:
    existingSecret: litellm-oauth2-proxy
    emailDomains:
      - "*"
    configFile: |-
      provider = "oidc"
      oidc_issuer_url = "https://sso.noxxos.nl/application/o/litellm/"
      redirect_url = "https://litellm.noxxos.nl/oauth2/callback"
      upstreams = [ "http://litellm:4000" ]
      email_domains = [ "*" ]
      reverse_proxy = true
      trusted_proxy_ips = [ "10.244.0.0/16" ]
      pass_authorization_header = true
      pass_access_token = true
      set_xauthrequest = true
      skip_provider_button = true
      cookie_secure = true
      cookie_samesite = "lax"
      cookie_domains = [ ".noxxos.nl" ]
      whitelist_domains = [ ".noxxos.nl" ]

  service:
    type: ClusterIP
    portNumber: 80

  gatewayApi:
    enabled: true
    gatewayRef:
      name: traefik-gateway
      namespace: traefik
      sectionName: websecure
    hostnames:
      - litellm.noxxos.nl
    rules:
      - matches:
          - path:
              type: PathPrefix
              value: /

  resources:
    requests:
      cpu: 50m
      memory: 128Mi
    limits:
      memory: 256Mi