From 733a40fec029cd2678bf9e5a29f097cd947e8847 Mon Sep 17 00:00:00 2001 From: Chewbaccalakis Date: Wed, 23 Sep 2026 07:57:27 +0000 Subject: [PATCH] trusted proxy for litellm --- butane/ai.yaml.tftpl | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/butane/ai.yaml.tftpl b/butane/ai.yaml.tftpl index 6d64c97..e6df71f 100644 --- a/butane/ai.yaml.tftpl +++ b/butane/ai.yaml.tftpl @@ -45,8 +45,10 @@ systemd: -e LITELLM_SALT_KEY=${litellm_salt_key} \ -e LITELLM_LOG=ERROR \ -e JSON_LOGS=True \ + -v /etc/litellm/config.yaml:/app/config.yaml:ro \ -p 4000:4000 \ - docker.litellm.ai/berriai/litellm:main-stable + docker.litellm.ai/berriai/litellm:main-stable \ + --config /app/config.yaml --port 4000 ExecStop=/usr/bin/docker stop litellm Restart=always RestartSec=5s @@ -154,3 +156,30 @@ systemd: RestartSec=5s [Install] WantedBy=multi-user.target + +storage: + files: + # LiteLLM proxy settings. Models stay in the database + # (STORE_MODEL_IN_DB), so this file carries general_settings only -- + # those have no environment equivalent and are readable only from a + # config file. + # + # Requests reach :4000 through a Cloudflare tunnel whose connector runs + # on 192.168.0.0/24, so every request arrives from that connector's + # address. Without use_x_forwarded_for LiteLLM does MCP access control + # against that peer, which sits inside the default internal ranges, and + # so treats every caller on the public internet as internal -- exposing + # MCP servers marked "available_on_public_internet: false". + # + # mcp_trusted_proxy_ranges is what keeps that safe: X-Forwarded-For is + # honoured only when the direct peer is the connector, so a crafted + # header from anywhere else cannot forge a client IP. Widen it if the + # tunnel ever moves off that subnet, or the header is ignored again. + - path: /etc/litellm/config.yaml + mode: 0644 + contents: + inline: | + general_settings: + use_x_forwarded_for: true + mcp_trusted_proxy_ranges: + - 192.168.0.0/24