trusted proxy for litellm

butane/ai.yaml.tftpl

@@ -45,8 +45,10 @@ systemd:
           -e LITELLM_SALT_KEY=${litellm_salt_key} \
           -e LITELLM_LOG=ERROR \
           -e JSON_LOGS=True \
+          -v /etc/litellm/config.yaml:/app/config.yaml:ro \
           -p 4000:4000 \
-          docker.litellm.ai/berriai/litellm:main-stable
+          docker.litellm.ai/berriai/litellm:main-stable \
+          --config /app/config.yaml --port 4000
         ExecStop=/usr/bin/docker stop litellm
         Restart=always
         RestartSec=5s
@@ -154,3 +156,30 @@ systemd:
         RestartSec=5s
         [Install]
         WantedBy=multi-user.target
+
+storage:
+  files:
+    # LiteLLM proxy settings. Models stay in the database
+    # (STORE_MODEL_IN_DB), so this file carries general_settings only --
+    # those have no environment equivalent and are readable only from a
+    # config file.
+    #
+    # Requests reach :4000 through a Cloudflare tunnel whose connector runs
+    # on 192.168.0.0/24, so every request arrives from that connector's
+    # address. Without use_x_forwarded_for LiteLLM does MCP access control
+    # against that peer, which sits inside the default internal ranges, and
+    # so treats every caller on the public internet as internal -- exposing
+    # MCP servers marked "available_on_public_internet: false".
+    #
+    # mcp_trusted_proxy_ranges is what keeps that safe: X-Forwarded-For is
+    # honoured only when the direct peer is the connector, so a crafted
+    # header from anywhere else cannot forge a client IP. Widen it if the
+    # tunnel ever moves off that subnet, or the header is ignored again.
+    - path: /etc/litellm/config.yaml
+      mode: 0644
+      contents:
+        inline: |
+          general_settings:
+            use_x_forwarded_for: true
+            mcp_trusted_proxy_ranges:
+              - 192.168.0.0/24