From f735e2e910f90110de64d1093690fe3e43c47dd1 Mon Sep 17 00:00:00 2001 From: Daniel Date: Fri, 11 Sep 2026 02:39:57 +0200 Subject: [PATCH] fix: ped-ai leaves Open WebUI's network, and pins LiteLLM internally on purpose MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ped-ai joined open-webui_openwebui-network to resolve exactly one hostname: libretranslate. LibreTranslate is its own Compose project but had no network of its own, so it borrowed Open WebUI's — which meant a clinical app's startup was coupled to an unrelated stack's lifecycle for a translation call. LibreTranslate now owns danvics_translate and ped-ai joins that instead. It also keeps its Open WebUI attachment, because Open WebUI is configured to use it (webui.db refers to it) and cutting that would have broken translation there silently. Verified after the move that Open WebUI still reaches it. LITELLM_API_BASE is pinned to the container network again, now deliberately and with the reason recorded: clinical traffic should not leave the host or depend on Caddy, public DNS and edge TLS. Speed is not the reason — it is ~19ms on calls taking hundreds of ms, and quoting that as "4x" was misleading. OpenBao still stores the public URL for this key and Compose wins, so the vault value is dead until someone changes it by hand; the app's AppRole is read-only by design. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU --- docker-compose.yml | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 281d3a01..f23db168 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -17,10 +17,17 @@ services: CLINICAL_ASSISTANT_MCP_URL: http://mcp:8000/mcp REDIS_URL: redis://ped-ai-redis:6379 LOKI_URL: http://monitoring-loki:3100 - # LITELLM_API_BASE is deliberately NOT set here. Compose env wins over - # OpenBao, so hardcoding the internal URL silently overrode the vault's - # https://llm.danvics.com and the intended config never took effect. - # Set it here only to pin ped-ai to the internal gateway on purpose. + # Deliberate: ped-ai talks to LiteLLM over the container network, not the + # public hostname. Clinical traffic then never leaves the host and does + # not depend on Caddy, public DNS or edge TLS being up. The latency + # difference is ~19ms on calls that take hundreds of ms, so speed is not + # the reason — not leaving the box is. + # + # OpenBao still stores https://llm.danvics.com for this key and Compose + # env wins, so the vault value is dead. Change it in the vault to match, + # or this line will keep looking like the accidental override it used to + # be. The app's AppRole is read-only, so that has to be done by hand. + LITELLM_API_BASE: http://litellm:4000 TTS_PROVIDER: litellm LITELLM_TTS_MODEL: local-kokoro-tts LITELLM_TTS_VOICE: sherpa/kokoro:am_adam @@ -58,7 +65,7 @@ services: - danvics_mcp - danvics_monitoring - ped-ai-storage-assets - - openwebui_openwebui + - danvics_translate healthcheck: test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health"] interval: 30s @@ -119,6 +126,8 @@ networks: ped-ai-storage-assets: external: true name: personal-assistant-storage-milvus_assets - openwebui_openwebui: + # LibreTranslate's own service network, owned by the libretranslate project. + # ped-ai used to join open-webui's stack network purely to resolve this one + # hostname, which coupled a clinical app to an unrelated stack's lifecycle. + danvics_translate: external: true - name: open-webui_openwebui-network