LLM gateway
The LLM gateway is a LiteLLM proxy on dbb-server. Clients call one OpenAI-compatible endpoint. Provider keys stay on the proxy. Each client has its own virtual key. Postgres stores token counts and spend per key and model. The admin UI is the usage view.
The host is https://llm.server.daz.dev. The OpenAI base URL is https://llm.server.daz.dev/v1.
The deploy and the Coolify record are in platform/llm-gateway.md.
Access
Section titled “Access”The host is Tailscale-only. The rule is the same file as the other internal hosts, /data/coolify/proxy/dynamic/dbb-tailscale-only-apps.yaml. A source address outside 100.64.0.0/10, fd7a:115c:a1e0::/48, 127.0.0.1/32, and 10.0.0.0/8 receives 403. No extra host port is published.
dbb-auth is not in front of this host. An API request does not carry an Authelia session, so forward-auth does not fit.
The admin UI login page is https://llm.server.daz.dev/ui/login/. The Tailscale rule is the first gate, so the page is not reachable from the public internet. The login on that page is the master key, Coolify env LITELLM_MASTER_KEY on dbb-litellm. A virtual key does not sign in to the UI.
The API accepts Authorization: Bearer with a virtual key or the master key. The master key is for the UI and for creating keys. A client uses a virtual key.
Coolify
Section titled “Coolify”Project Platform, environment production. Previews are off.
| Resource | Name | UUID | Role |
|---|---|---|---|
| Application | dbb-litellm |
sif06fe18j8cqkvyjdksclam |
LiteLLM proxy. Compose platform/llm-gateway/docker-compose.yml. |
| Postgres 17.8 | dbb-litellm-db |
e4aw3wqqqxnu5xv3tb5nkbak |
Spend logs and virtual keys. Schema app, role llm_app. No host port. |
The database is this app’s own server. Each app has its own Postgres and its own backup. The shared preview server is for empty pull-request databases and is not the store for these logs.
The image is ghcr.io/berriai/litellm:v1.108.4, pinned by digest in the compose file.
Models
Section titled “Models”| Public name | Upstream id |
|---|---|
morph-kimik31 |
morph/morph-kimik31 |
morph-kimik3 |
morph/morph-kimik3 |
morph-dsv41flash |
morph/morph-dsv41flash |
morph-dsv41flash-1017 |
morph/morph-dsv41flash-1017 |
The provider prefix is openai/. api_base is https://api.morphllm.com/v1. The key is Coolify env MORPH_API_KEY. Input and output cost per token are 0. The spend log still records token counts.
Config is platform/llm-gateway/config.yaml. Usage telemetry is off (LITELLM_TELEMETRY_DISABLED).
Virtual keys
Section titled “Virtual keys”A key is created in the admin UI, on Virtual Keys, while signed in with the master key. The same call is POST /key/generate with the master key. The response contains the secret once. The client stores that secret. models on the key limits which public names it can call. The secret is never written to this repo.
| Alias | Use | Models | Budget / rate limits | Metadata |
|---|---|---|---|---|
oneisland-devbox-omp |
omp inside oneisland-devbox. Stored as the locked Coolify env LITELLM_API_KEY on that service. |
Morph only: morph-kimik31, morph-kimik3, morph-dsv41flash, morph-dsv41flash-1017 |
None | owner=darren, client=omp, service=oneisland-devbox |
dbb-mba-m4 |
Darren’s personal OpenCode client on DBB-MBA-M4. | Same Morph set | None (personal freespend) | owner=darren, purpose=freespend, client=opencode, machine=dbb-mba-m4 |
dbb-mbp-m4 |
Darren’s personal OpenCode client on DBB-MBP-M4. Created 12 Nov 2026; OpenCode on that Mac is not configured yet. | Same Morph set | None (personal freespend) | owner=darren, purpose=freespend, client=opencode, machine=dbb-mbp-m4 |
dbb-mba-m4 and dbb-mbp-m4 are Darren’s personal freespend keys: no max_budget, tpm_limit, rpm_limit, or expiry. Spend is attributable through the alias and that metadata. OpenCode on the MBA uses the provider litellm at https://llm.server.daz.dev/v1 and reads the key from a mode-600 file, not from this repo.
Point a client at it
Section titled “Point a client at it”An OpenAI-compatible client sets the base URL to https://llm.server.daz.dev/v1 and the API key to a virtual key. The model id is the public name.
omp’s LiteLLM provider reads two variables:
LITELLM_BASE_URL=https://llm.server.daz.dev/v1LITELLM_API_KEY=<virtual key>The admin UI shows token and spend logs. The rows are in dbb-litellm-db, schema app. Prompts are not stored.
Add a provider
Section titled “Add a provider”Add a locked runtime env on dbb-litellm for the provider key. Add a model_list entry: model_name is the public id, and litellm_params.model is openai/<upstream id> for an OpenAI-compatible API, with api_base and api_key: os.environ/<ENV>. Redeploy dbb-litellm. The proxy copies the file into Postgres on startup (store_model_in_db).
MORPH_API_KEY is that env for Morph. The value is set in Coolify on dbb-litellm, then that application is redeployed. The deploy script does not replace a value that is already set.