feat(auth): wire JWT validation into /v1/* LLM endpoints

2026-08-31 23:01:59 -07:00
parent f9addf945d
commit 14cc67833c
5 changed files with 141 additions and 29 deletions
@@ -10,6 +10,14 @@ data:
    # Gateway configuration - loaded at startup, never compiled in
    # See REQUIREMENTS.md for full specification
    
+    # JWT Authentication for /v1/* endpoints (LLM API)
+    auth:
+      enabled: true
+      issuer: "https://authentik.riotpiao.com/application/o/local-llm/"
+      audience: "local-llm"
+      jwksUrl: "https://authentik.riotpiao.com/application/o/local-llm/jwks/"
+      requiredCapability: "llm:inference"
+    
    # Routes: standard HTTP proxy routes (not LLM-specific)
    # These are for non-LLM services (agent-pod/console, etc.)
    routes: []