docker-compose.yml

version: "3.9"

name: litellm   # pins the Compose project name so named volumes are always
                # prefixed "litellm_" regardless of the host folder. Without this,
                # volumes inherit the folder name (e.g. "ai-proxy_cliproxy_auth")
                # and the -claude-login step in the README writes tokens into a
                # different volume than the running service reads.

services:
  litellm:
    image: ghcr.io/berriai/litellm:v1.82.3
    container_name: litellm
    ports:
      - "4000:4000"
    environment:
      - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY}
      - DATABASE_URL=${DATABASE_URL}
      - UI_USERNAME=${UI_USERNAME}
      - UI_PASSWORD=${UI_PASSWORD}
    volumes:
      - ./config.yaml:/app/config.yaml
    command: ["--config", "/app/config.yaml"]
    restart: always
    depends_on:
      db:
        condition: service_healthy

  cli-proxy-api:
    image: eceasy/cli-proxy-api:latest
    container_name: cli-proxy-api
    pull_policy: always
    restart: unless-stopped
    environment:
      - HOME=/root   # required: Alpine image may not set this, causing auth dir path to be empty
    # Port 8317 is NOT published to the host — only reachable internally by LiteLLM
    volumes:
      - ./cliproxyapi/config.yaml:/CLIProxyAPI/config.yaml
      - cliproxy_auth:/root/.cli-proxy-api   # OAuth tokens (persisted across restarts)
      - cliproxy_logs:/CLIProxyAPI/logs

  db:
    image: postgres:16
    container_name: litellm_db
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: always

volumes:
  postgres_data:
  cliproxy_auth:    # persists OAuth tokens across restarts/upgrades
  cliproxy_logs: