---
name: secure-llm-access-jwt
#region guard
guards:
  llm_jwt:
    type: jwt
    options:
      issuer: https://auth.example.com
      audience: https://llm.example.com
      keys:
        - kty: RSA
          n: tfIpDLlc-tOwAOe-_x1VV1xGohkpkSsxY6LB-3FwXIM6ueRZ--QtRUN4UOcw56Xs6TrQJFcbeF2rmtRZa3FZWC8dentLaO896vvc_w6pTyNQzlO5IHOv2snHFvT9dlG9wxwXv5jd1nNLYLQ9wTnROqJfK9KipUTGTTyOd1B6Ia7xUZT6kTPCSHZAvj4zVfafW37KfWtEdvq0LdDTivavc37yDnGOI7Z27MEAuA8RuAicZlIjF4tqMZ8qw-Y2NZs1OjoPbhGZde5k6hqET5i-hqrumI_ihf7yX7Vs0BLvovwczmcDF6SPHWywRd7Rs6g8A5sClRMGI9w8rJ4kk6KnHQ
          e: AQAB
          alg: RS256
          kid: example
#endregion guard
bindings:
  north_tcp_server:
    type: tcp
    kind: server
    options:
      host: 0.0.0.0
      port: 7161
    exit: north_http_server
  north_http_server:
    type: http
    kind: server
    exit: north_llm_server
  #region llm_server
  north_llm_server:
    type: llm
    kind: server
    options:
      dialect: openai
      authorization:
        llm_jwt:
          credentials: "Bearer {credentials}"
    exit: north_llm_proxy
  #endregion llm_server
  #region llm_proxy
  north_llm_proxy:
    type: llm
    kind: proxy
    routes:
      - when:
          - model:
              - gpt-*
        guarded:
          llm_jwt:
            - premium
        exit: south_llm_client_openai_premium
      - when:
          - model:
              - gpt-*
        exit: south_llm_client_openai
  #endregion llm_proxy
  #region llm_clients
  south_llm_client_openai_premium:
    type: llm
    kind: client
    options:
      dialect: openai
      server: https://api.openai.com
    telemetry:
      metrics:
        - llm.*
    exit: south_http_client_openai
  south_llm_client_openai:
    type: llm
    kind: client
    options:
      dialect: openai
      server: https://api.openai.com
    telemetry:
      metrics:
        - llm.*
    exit: south_http_client_openai
  #endregion llm_clients
  #region http_client
  south_http_client_openai:
    type: http
    kind: client
    options:
      overrides:
        authorization: Bearer ${{env.OPENAI_API_KEY}}
    exit: sys:tls_client
  #endregion http_client
telemetry:
  metrics:
    - llm.interactions
  exporters:
    prometheus_exporter:
      type: prometheus
      options:
        endpoints:
          - scheme: http
            port: 7190
            path: /metrics