services:
  adc-init:
    image: alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
    restart: "no"
    environment:
      GOOGLE_ADC_B64: ${GOOGLE_ADC_B64}
    volumes:
      - google-adc:/credentials
    command:
      - /bin/sh
      - -c
      - |
        umask 077
        printf '%s' "$${GOOGLE_ADC_B64}" | base64 -d > /credentials/application_default_credentials.json

  litellm:
    image: ghcr.io/berriai/litellm:main-stable@sha256:3d88bd757134a00e8c00237b85a021ab1f6d54abb9c1df750f411dbe7256a500
    restart: unless-stopped
    depends_on:
      adc-init:
        condition: service_completed_successfully
    networks:
      hk-web:
        aliases:
          - litellm-api
    environment:
      GOOGLE_APPLICATION_CREDENTIALS: /credentials/application_default_credentials.json
      VERTEXAI_PROJECT: ${VERTEXAI_PROJECT}
      VERTEXAI_LOCATION: ${VERTEXAI_LOCATION:-global}
      LITELLM_MASTER_KEY: ${LITELLM_MASTER_KEY}
      VERTEXAI_ENABLED: "true"
      ZENMUX_SUBSCRIPTION_API_KEY: ${ZENMUX_SUBSCRIPTION_API_KEY:-}
      ZENMUX_PAYG_API_KEY: ${ZENMUX_PAYG_API_KEY:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
    volumes:
      - ./models.yaml:/etc/litellm/models.yaml:ro
      - ./provider_routes.py:/etc/litellm/provider_routes.py:ro
      - ./render_config.py:/etc/litellm/render_config.py:ro
      - google-adc:/credentials:ro
    entrypoint: ["/bin/sh", "-c"]
    command:
      - python /etc/litellm/render_config.py && exec litellm --config /tmp/litellm.yaml --host 0.0.0.0 --port ${LITELLM_PORT:-1049} --num_workers 1
    logging:
      driver: json-file
      options:
        max-size: 1m
        max-file: "2"

volumes:
  google-adc:

networks:
  hk-web:
    external: true
    name: hk-web