Initial commit: LlamaLink Go rewrite

Complete rewrite from Python/FastAPI to Go/Gin: - Go backend: auth (API keys + bcrypt), llama.cpp subprocess manager, hot-swap multi-model, rate limiting, quota system, webhooks - Vue 3 SPA admin panel (src/) with Tailwind CSS - Deployment: Docker multi-stage, docker-compose, nginx, systemd - GORM/SQLite models: ApiKey, Model, UsageLog, Quota, Webhook - REST API: /api/v1/admin/* (keys, models, chat, usage, health) - Embedded frontend via go:embed (build output at web/dist/) Removed legacy Python artifacts (app/, tests/, pyproject.toml, etc.)
2026-07-30 10:58:55 -04:00
commit 4c9ed3c24b
52 changed files with 5105 additions and 0 deletions
@@ -0,0 +1,60 @@
+# LlamaLink Caddyfile
+# Auto HTTPS via Let's Encrypt
+
+llamalink.local {
+    reverse_proxy llamalink:8000
+
+    log {
+        output file /var/log/caddy/llamalink.log
+    }
+
+    handle /health {
+        reverse_proxy llamalink:8000
+    }
+
+    handle /ready {
+        reverse_proxy llamalink:8000
+    }
+
+    handle /v1/chat/completions {
+        reverse_proxy llamalink:8000 {
+            flush_interval -1
+        }
+    }
+
+    handle {
+        reverse_proxy llamalink:8000
+    }
+}
+
+# Production with TLS
+# Replace with your domain
+llamalink.example.com {
+    reverse_proxy llamalink:8000
+
+    tls {
+        protocols tls1.2 tls1.3
+    }
+
+    log {
+        output file /var/log/caddy/llamalink.log
+    }
+
+    handle /health {
+        reverse_proxy llamalink:8000
+    }
+
+    handle /ready {
+        reverse_proxy llamalink:8000
+    }
+
+    handle /v1/chat/completions {
+        reverse_proxy llamalink:8000 {
+            flush_interval -1
+        }
+    }
+
+    handle {
+        reverse_proxy llamalink:8000
+    }
+}
@@ -0,0 +1,53 @@
+# Build stage
+FROM node:20-alpine AS node-builder
+
+WORKDIR /app
+
+COPY web/frontend/package*.json ./
+RUN npm ci
+
+COPY web/frontend/ ./
+RUN npm run build
+
+# Go stage
+FROM golang:1.23-alpine AS go-builder
+
+RUN apk add --no-cache git ca-certificates
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+# Copy frontend build
+COPY --from=node-builder /app/dist ./web/dist
+
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o llamalink ./cmd/llamalink
+
+# Final stage
+FROM alpine:3.19
+
+RUN apk add --no-cache ca-certificates curl
+
+WORKDIR /app
+
+# Create non-root user
+RUN addgroup -g 1000 llamalink && \
+    adduser -u 1000 -G llamalink -s /bin/sh -D llamalink
+
+COPY --from=go-builder /app/llamalink .
+COPY --from=go-builder /app/.env.example .env
+
+# Create data directory
+RUN mkdir -p /app/data && chown llamalink:llamalink /app/data
+
+USER llamalink
+
+EXPOSE 8000
+
+ENV LLAMALINK_HOST=0.0.0.0
+ENV LLAMALINK_PORT=8000
+
+ENTRYPOINT ["./llamalink"]
@@ -0,0 +1,79 @@
+services:
+  llamalink:
+    build:
+      context: .
+      dockerfile: deploy/Dockerfile
+    container_name: llamalink-api
+    ports:
+      - "8000:8000"
+    environment:
+      - LLAMALINK_ENV=production
+      - DATABASE_URL=sqlite+aiosqlite:///./data/llamalink.db
+      - MANAGE_LLAMA_SERVER=true
+      - LLAMA_SERVER_HOST=127.0.0.1
+      - LLAMA_SERVER_PORT=8080
+      - LLAMA_SERVER_BIN=/usr/local/bin/llama-server
+      - LLAMA_SERVER_STARTUP_TIMEOUT=120
+      - MODEL_SWAP_COOLDOWN=2
+      - LLAMA_SERVER_STOP_TIMEOUT=10
+      - RATE_LIMIT_PER_MINUTE=60
+      - RATE_LIMIT_STORAGE=memory
+      - LOG_LEVEL=info
+      - LOG_FORMAT=json
+      - ADMIN_TOKEN=${ADMIN_TOKEN}
+    volumes:
+      - llamalink-data:/app/data
+      - ./models:/models:ro
+    restart: unless-stopped
+    networks:
+      - llamalink-net
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+  llama-runner:
+    image: ghcr.io/ggml-org/llama.cpp:server
+    container_name: llama-runner
+    environment:
+      - CUDA_VISIBLE_DEVICES=0
+    volumes:
+      - ./models:/models:ro
+    restart: unless-stopped
+    networks:
+      - llamalink-net
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: all
+              capabilities: [gpu]
+
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: llamalink-nginx
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./deploy/nginx.conf:/etc/nginx/nginx.conf:ro
+    depends_on:
+      - llamalink
+    restart: unless-stopped
+    networks:
+      - llamalink-net
+
+volumes:
+  llamalink-data:
+
+networks:
+  llamalink-net:
+    driver: bridge
@@ -0,0 +1,35 @@
+[Unit]
+Description=llama-server instance %i
+After=network.target
+
+[Service]
+Type=simple
+User=llamalink
+WorkingDirectory=/opt/llamalink
+ExecStart=/usr/local/bin/llama-server \
+    --model /opt/llamalink/models/%i.gguf \
+    --alias %i \
+    --host 127.0.0.1 \
+    --port 8080 \
+    --ctx-size 8192 \
+    --n-gpu-layers auto \
+    --parallel 4 \
+    --rope-scaling linear
+Restart=on-failure
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=llama-server-%i
+
+Environment="CUDA_VISIBLE_DEVICES=0"
+
+# Security hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadOnlyPaths=/opt/llamalink/models
+ReadWritePaths=/opt/llamalink/data
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,28 @@
+[Unit]
+Description=LlamaLink API Gateway
+After=network.target
+
+[Service]
+Type=simple
+User=llamalink
+WorkingDirectory=/opt/llamalink
+ExecStart=/usr/local/bin/llamalink \
+    --host 0.0.0.0 \
+    --port 8000
+Restart=on-failure
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=llamalink
+
+# Security
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/llamalink/data
+ReadOnlyPaths=/opt/llamalink/models
+Environment=LLAMALINK_ENV=production
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,122 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log /var/log/nginx/access.log main;
+    error_log /var/log/nginx/error.log warn;
+
+    keepalive_timeout 65;
+    chunked_transfer_encoding on;
+
+    upstream llamalink {
+        server llamalink:8000;
+        keepalive 32;
+    }
+
+    server {
+        listen 80;
+        server_name _;
+
+        # Redirect to HTTPS
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 443 ssl http2;
+        server_name _;
+
+        # SSL (generate with letsencrypt or use self-signed for testing)
+        # ssl_certificate /etc/nginx/certs/cert.pem;
+        # ssl_certificate_key /etc/nginx/certs/key.pem;
+        # ssl_protocols TLSv1.2 TLSv1.3;
+        # ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
+        # ssl_prefer_server_ciphers off;
+
+        client_max_body_size 10M;
+        proxy_read_timeout 300s;
+        proxy_connect_timeout 75s;
+
+        # Rate limiting zones
+        limit_req_zone $binary_remote_addr zone=api:10m rate=60r/m;
+
+        # Admin SPA
+        location /admin/ {
+            proxy_pass http://llamalink;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+        }
+
+        location /admin/assets/ {
+            proxy_pass http://llamalink;
+            proxy_set_header Host $host;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+        }
+
+        # API endpoints
+        location /api/ {
+            limit_req zone=api burst=20 nodelay;
+
+            proxy_pass http://llamalink;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+
+            # For streaming responses
+            proxy_buffering off;
+            proxy_cache off;
+        }
+
+        # Health checks (no rate limit)
+        location /health {
+            proxy_pass http://llamalink;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+        }
+
+        location /ready {
+            proxy_pass http://llamalink;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+        }
+
+        # WebSocket
+        location /ws {
+            proxy_pass http://llamalink;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_read_timeout 86400;
+        }
+
+        # Docs
+        location /docs {
+            proxy_pass http://llamalink;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+        }
+
+        location /openapi.json {
+            proxy_pass http://llamalink;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+        }
+    }
+}