# DeltaLLM starter configuration
#
# This file is intentionally short:
# - the active settings are what a local, trial, or single-server instance needs
# - every setting you leave out uses its built-in default
# - optional features are listed, commented, under "Features" below
# - secrets come from environment variables, not hardcoded values
#
# Which features to turn on, what each needs, and ready-made profiles:
#   docs/deployment/feature-switches.md ("Choose what to turn on")
# Every general setting with its default:
#   docs/configuration/general-settings-reference.md
# A fuller single-server example (spend outbox for the Model Selector and Realtime, Batch API):
#   config.small-team.example.yaml
#
# Quick path:
# 1. Copy this file to config.yaml
# 2. Set the required environment variables from docs/getting-started/docker.md
# 3. Start DeltaLLM and verify /v1/models
# 4. After the first successful seed, you can set
#    general_settings.model_deployment_bootstrap_from_config: false
#    and manage deployments from the Admin UI or API

model_list:
  # Sample deployment used by the quickstart docs.
  # Keep this if you want to bootstrap one OpenAI-backed chat model on first start.
  - model_name: gpt-4o-mini
    deltallm_params:
      provider: openai
      model: openai/gpt-4o-mini
      api_key: os.environ/OPENAI_API_KEY
      api_base: https://api.openai.com/v1
      timeout: 60
      # Optional async Batch API chat execution control.
      # Missing chat_batching behaves like mode: concurrent.
      # For vLLM, concurrent is usually preferred because vLLM batches inside the engine.
      # chat_batching:
      #   mode: concurrent
      #   max_in_flight: 32
      # Use sync_microbatch only with a provider adapter that returns per-item results and usage.
      # chat_batching:
      #   mode: sync_microbatch
      #   upstream_max_batch_size: 8
      #   max_total_input_tokens: 32000
      #   # false is not supported until a provider adapter defines safe heterogeneous grouping.
      #   require_homogeneous_params: true

  # Mistral supports chat and embeddings. See docs/providers/mistral.md.
  # - model_name: mistral-chat
  #   deltallm_params:
  #     provider: mistral
  #     model: mistral-small-latest
  #     api_key: os.environ/MISTRAL_API_KEY
  #   model_info:
  #     mode: chat

  # Optional direct chat providers: deepseek, zai, qwen, tencent, minimax.
  # See docs/providers/compatible-chat.md for all five examples and regional bases.
  # - model_name: deepseek-chat
  #   deltallm_params:
  #     provider: deepseek
  #     model: deepseek-v4-flash
  #     api_key: os.environ/DEEPSEEK_API_KEY
  #   model_info:
  #     mode: chat
  #     # Configure verified token prices before enabling spend-based limits.

router_settings:
  routing_strategy: simple-shuffle
  # One retry on the same deployment, then fail over to the next one.
  num_retries: 1
  retry_after: 1
  timeout: 600
  # A deployment rests for cooldown_time seconds after more than allowed_fails
  # rate-limit, server, or timeout errors within five minutes. 0 would bench a
  # deployment on its first 429.
  cooldown_time: 60
  allowed_fails: 2
  # Treat unusable 200 answers (empty, bad tool-call JSON, unknown tool, non-JSON in JSON mode)
  # as failures that can retry or fall back. See docs/configuration/router.md.
  response_validation:
    enabled: true
    on_exhausted: return_response
    json_healing: false  # repair JSON-mode answers (code fences, extra text, trailing commas)
  # Set route-group workload mode explicitly. Older files that omit it infer one common
  # enabled-member mode (or chat when no member mode can be resolved) and log a warning.
  # route_groups:
  #   - key: search-embeddings
  #     mode: embedding
  #     strategy: weighted
  #     context:
  #       mode: smallest-sufficient
  #       unknown_capacity: allow
  #       safety_margin_tokens: 256
  #     members:
  #       - deployment_id: embeddings-primary
  #         weight: 3
  #       - deployment_id: embeddings-secondary
  #         weight: 1
  # Optional chat model router (issue #304). Before enabling, declare each member's
  # model_info.chat_capabilities and positive context capacity. The classifier also needs
  # explicit provider token prices and positive RPM/TPM limits; see docs/configuration/models.md.
  # The classifier is an independent concrete deployment; it need not be an answer member.
  # Requires general_settings.spend_ingestion_mode: outbox and its enabled healthy worker.
  # Selector cost is charged to customers; budgets remain soft checks, not spending holds.
  # Internal Batch chat selects per item and bypasses microbatch grouping.
  # Deterministic policy simulation does not execute the selector.
  # route_groups:
  #   - key: support-chat
  #     mode: chat
  #     strategy: least-busy
  #     context:
  #       mode: smallest-sufficient
  #       unknown_capacity: exclude
  #     selector:
  #       kind: llm-tier
  #       classifier_deployment_id: support-tiny-selector
  #       timeout_ms: 750
  #       max_input_chars: 8000
  #       default_lane: quality
  #       lanes:
  #         - id: economy
  #           rank: 0
  #           description: Routine extraction, formatting, and simple questions
  #         - id: quality
  #           rank: 1
  #           description: Complex reasoning, ambiguity, and advanced tool use
  #     members:
  #       - deployment_id: support-mini
  #         lane: economy
  #       - deployment_id: support-large
  #         lane: quality

general_settings:
  instance_name: DeltaLLM

  # Required secrets
  master_key: os.environ/DELTALLM_MASTER_KEY
  salt_key: os.environ/DELTALLM_SALT_KEY

  # Database and Redis
  # In Docker Compose, DATABASE_URL and REDIS_URL are wired automatically.
  database_url: os.environ/DATABASE_URL
  redis_url: os.environ/REDIS_URL

  # Admin session login
  # Set these only if you want an initial browser-login admin account created on boot.
  platform_bootstrap_admin_email: os.environ/PLATFORM_BOOTSTRAP_ADMIN_EMAIL
  platform_bootstrap_admin_password: os.environ/PLATFORM_BOOTSTRAP_ADMIN_PASSWORD

  # Recommended startup path:
  # - db_only: manage deployments from the Admin UI or API
  # - bootstrap_from_config: true so the sample model seeds on first boot
  #   After the first successful seed, set this back to false for steady-state use.
  model_deployment_source: db_only
  model_deployment_bootstrap_from_config: true

  # Check each deployment's provider every 5 minutes (a free model-list call, no tokens)
  # and rest unhealthy deployments before customer traffic finds them.
  background_health_checks: true
  health_check_interval: 300

  # Organization deletion requests. Startup fails while the deletion readiness check
  # finds missing migrations or unowned records, so enable only after it passes and
  # every API and worker replica reports the backend's current lifecycle
  # protocol version (v2 for this rollout).
  organization_deletion_requests_enabled: false

  # ---------------------------------------------------------------------------
  # Features. Off unless noted. Uncomment what you need; each line says what it
  # needs. Full table: docs/deployment/feature-switches.md
  # ---------------------------------------------------------------------------
  #
  # Durable spend and audit writes through a background worker (on by default once a
  # mode is outbox). Adds 10 PostgreSQL connections per process (telemetry pools of 5 + 5).
  # Required by the Model Selector and Realtime. Restart after changing.
  # spend_ingestion_mode: outbox
  # audit_ingestion_mode: outbox
  #
  # Response cache. Off by default: a hit is served without calling the provider and
  # is currently charged like a miss. Use redis when you run more than one process.
  # cache_enabled: true
  # cache_backend: redis
  # cache_ttl: 3600
  #
  # Batch API (/v1/batches). local storage works for one server only; use s3 when
  # more than one process or pod serves the API.
  # embeddings_batch_enabled: true
  # embeddings_batch_storage_backend: local
  #
  # Batch completion webhooks. The key encrypts callback URLs and signing secrets at
  # rest; it is read from the environment and unused until webhooks are on. Generate:
  #   python -c 'import base64,secrets; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).decode())'
  # batch_webhook_enabled: true
  batch_webhook_encryption_key: os.environ/DELTALLM_BATCH_WEBHOOK_ENCRYPTION_KEY
  #
  # MCP servers with OAuth 2.0 (per user). The key encrypts user tokens and client
  # secrets at rest. It is required only when such a server exists. Generate it
  # like the webhook key. The connect flow also needs email_base_url (the public
  # gateway origin) for the redirect URL /mcp/oauth/callback.
  mcp_oauth_encryption_key: os.environ/DELTALLM_MCP_OAUTH_ENCRYPTION_KEY
  #
  # Accounting v2 signing secret, read from the environment; used only with
  # accounting_execution_mode: local_journal (docs/deployment/accounting-v2.md).
  accounting_rpc_signing_secret: os.environ/DELTALLM_ACCOUNTING_RPC_SIGNING_SECRET
  #
  # OpenAI Realtime sessions. Needs Redis and spend_ingestion_mode: outbox. Restart.
  # realtime:
  #   enabled: true
  #
  # Reject overload before prompt, guardrail, and budget work. Size the limits from
  # docs/deployment/ingress-admission.md first. Restart.
  # gateway_ingress_enabled: true
  #
  # Refuse requests that need Redis-backed limits while Redis is down (default
  # fail_open lets them through). Production uses fail_closed.
  # redis_degraded_mode: fail_closed
  #
  # Browser sessions end after 60 idle minutes or 12 hours from sign-in (defaults).
  # auth_session_ttl_hours: 12
  # auth_session_idle_timeout_minutes: 60

  # Email delivery is optional.
  # Enable this when you want invitations, password reset, test email, or governance notifications.
  # For local/dev, point SMTP at Mailpit/MailHog.
  # For production, use smtp, resend, or sendgrid with real credentials.
  # email_base_url must be the public app origin when email is enabled.
  #
  # email_enabled: true
  # email_provider: smtp
  # email_from_address: no-reply@example.com
  # email_reply_to: support@example.com
  # email_base_url: http://localhost:4002
  # email_worker_enabled: true
  # email_worker_batch_size: 10
  # email_worker_max_concurrency: 3
  # email_worker_delivery_lease_seconds: 60
  # email_worker_audit_lease_seconds: 30
  # email_worker_startup_timeout_seconds: 5
  # email_worker_shutdown_drain_timeout_seconds: 20
  # email_max_attempts: 5
  # email_retry_initial_seconds: 60
  # email_retry_max_seconds: 3600
  #
  # SMTP example
  # smtp_host: localhost
  # smtp_port: 1025
  # smtp_username: null
  # smtp_password: null
  # smtp_use_tls: false
  #
  # Resend example
  # email_provider: resend
  # resend_api_key: os.environ/RESEND_API_KEY
  #
  # SendGrid example
  # email_provider: sendgrid
  # sendgrid_api_key: os.environ/SENDGRID_API_KEY

  # SSO is optional.
  # Enable this only after Redis is configured because SSO callback state is stored server-side.
  # DeltaLLM keeps SSO disabled if Redis-backed state storage is unavailable.
  #
  # enable_sso: true
  # sso_provider: oidc
  # sso_client_id: os.environ/SSO_CLIENT_ID
  # sso_client_secret: os.environ/SSO_CLIENT_SECRET
  # sso_authorize_url: https://idp.example.com/oauth2/authorize
  # sso_token_url: https://idp.example.com/oauth2/token
  # sso_userinfo_url: https://idp.example.com/oauth2/userinfo
  # sso_redirect_uri: http://localhost:4002/auth/callback
  # sso_scope: openid email profile
  # Initial admin role for verified new SSO accounts. Manage existing roles in People & Access.
  # sso_admin_email_list:
  #   - admin@example.com
  # Create missing default memberships while preserving existing org/team roles.
  # sso_default_team_id: team-123
  # sso_state_ttl_seconds: 600
  # SSO logins never show the DeltaLLM MFA enrollment prompt.
  # For accounts that already have DeltaLLM MFA: "optional" also asks for the
  # DeltaLLM TOTP code after SSO, "trust_idp" trusts the identity provider's MFA.
  # sso_local_mfa: optional
  #
  # Optional sign-in restrictions. Off by default. Platform admins can also edit
  # them in Settings > Single sign-on. The master key always works.
  # password_login_enabled: false   # SSO-only sign-in; requires enable_sso: true
  # sso_sign_in:
  #   allow_new_accounts: false     # only existing accounts, listed admins, mapped groups
  #   allowed_email_domains:        # every SSO sign-in needs a verified email here
  #     - example.com
  #
  # Optional SSO group sync: map values of a token claim to platform admin,
  # organization roles, and team roles at each SSO sign-in. Off by default.
  # Platform admins can also edit it in Settings > Single sign-on.
  # sso_group_sync:
  #   enabled: true
  #   claim: deltallm_role
  #   admin_values: [admin]
  #   require_mapped_value: false
  #   remove_unlisted: false   # true: also remove access the IdP no longer grants
  #   mappings:
  #     - value: team-ml
  #       team_id: team_ml
  #       team_role: team_developer
  #
  # Optional self-service developer sandbox onboarding for first-time SSO users.
  # Defaults are applied only when the account is first provisioned; admins can
  # edit the seeded org, team, memberships, budgets, and limits later.
  #
  # self_registration:
  #   enabled: true
  #   mode: sso_allowed_domain
  #   allowed_domains:
  #     - example.com
  #   require_email_verification: true
  #   require_admin_approval: false
  #   default_org:
  #     id: org-sandbox
  #     name: Developer Sandbox
  #     max_budget: 100
  #     soft_budget: 80
  #     rpm_limit: 300
  #     tpm_limit: 500000
  #     rph_limit: 2000
  #     rpd_limit: 10000
  #     tpd_limit: 5000000
  #   default_team:
  #     id: team-self-serve
  #     alias: Self-Service Developers
  #     role: team_developer
  #     max_budget: 50
  #     soft_budget: 40
  #     rpm_limit: 150
  #     tpm_limit: 250000
  #     rph_limit: 1000
  #     rpd_limit: 5000
  #     tpd_limit: 2500000
  #     self_service_keys_enabled: true
  #     self_service_max_keys_per_user: 2
  #     self_service_budget_ceiling: 5
  #     self_service_require_expiry: true
  #     self_service_max_expiry_days: 14
  #   default_user:
  #     max_budget: 10
  #     soft_budget: 8
  #     rpm_limit: 30
  #     tpm_limit: 50000
  #     rph_limit: 200
  #     rpd_limit: 1000
  #     tpd_limit: 500000

  # Optional JWT bearer authentication for proxy requests.
  #
  # enable_jwt_auth: true
  # jwt_public_key_url: https://idp.example.com/.well-known/jwks.json
  # jwt_audience: deltallm
  # jwt_issuer: https://idp.example.com/

deltallm_settings:
  # Keep callback and guardrail config minimal in the starter file.
  # Request, token, spend, cache, and latency metrics are emitted natively.
  # Configure callbacks only for external sinks or custom integrations.
  success_callback: []
  failure_callback: []
  turn_off_message_logging: false

  # Optional S3 callback target for request logs or exports.
  #
  # callback_settings:
  #   s3:
  #     bucket: os.environ/DELTALLM_S3_BUCKET
  #     region: us-east-1
  #     prefix: deltallm-logs/

  # Optional built-in guardrail examples.
  # Uncomment these only after their provider-specific dependencies are configured.
  #
  # guardrails:
  #   - guardrail_name: presidio-pii
  #     deltallm_params:
  #       guardrail: src.guardrails.presidio.PresidioGuardrail
  #       mode: pre_call
  #       default_on: true
  #       default_action: block
  #       anonymize: true
  #       threshold: 0.5
  #       entities:
  #         - EMAIL_ADDRESS
  #         - PHONE_NUMBER
  #         - US_SSN
  #   - guardrail_name: lakera-prompt-injection
  #     deltallm_params:
  #       guardrail: src.guardrails.lakera.LakeraGuardrail
  #       mode: pre_call
  #       default_on: true
  #       default_action: block
  #       api_key: os.environ/LAKERA_API_KEY
  #       threshold: 0.5
  #       fail_open: false