address comments

Author: xzrderek

.gitignore

@@ -106,7 +106,7 @@ venv.bak/
 *.backup
 
 # Secrets
-secrets.json
+secrets.yaml
 
 # Spyder project settings
 .spyderproject

eval_protocol/proxy/Dockerfile.gateway

@@ -6,9 +6,6 @@ WORKDIR /app
 # Prevent Python from buffering stdout/stderr
 ENV PYTHONUNBUFFERED=1
 
-# Set secrets path to proxy directory
-ENV SECRETS_PATH=/app/proxy_core/secrets.json
-
 # Copy requirements file
 COPY ./requirements.txt /app/requirements.txt
 

eval_protocol/proxy/README.md

@@ -80,7 +80,7 @@ URL paths encode evaluation metadata that gets injected as Langfuse tags:
 3. **Retry logic**: Automatic retries with exponential backoff for incomplete traces
 
 ### Multi-Project Support
-- Store Langfuse credentials for multiple projects in `secrets.json`
+- Store Langfuse credentials for multiple projects in `secrets.yaml`
 - Route requests to the correct project via `project_id` in URL or use default
 - Credentials never exposed to clients
 
@@ -94,21 +94,17 @@ URL paths encode evaluation metadata that gets injected as Langfuse tags:
 
 1. **Create secrets file:**
    ```bash
-   cp proxy_core/secrets.json.example proxy_core/secrets.json
+   cp proxy_core/secrets.yaml.example proxy_core/secrets.yaml
    ```
 
-2. **Edit `proxy_core/secrets.json`** with your Langfuse credentials.
-**Important**: where we have  "my-project", you would use the ID of your Langfuse project, similar to format `cmg00asdf0123...`.
-   ```json
-   {
-     "langfuse_keys": {
-       "my-project": {
-         "public_key": "pk-lf-...",
-         "secret_key": "sk-lf-..."
-       }
-     },
-     "default_project_id": "my-project"
-   }
+2. **Edit `proxy_core/secrets.yaml`** with your Langfuse credentials.
+**Important**: use your real Langfuse project ID (e.g. `cmg00asdf0123...`).
+   ```yaml
+   langfuse_keys:
+     my-project:
+       public_key: pk-lf-...
+       secret_key: sk-lf-...
+   default_project_id: my-project
    ```
 
 3. **Start services:**
@@ -238,31 +234,27 @@ Forwards any other request to LiteLLM backend with API key injection.
 | `REDIS_HOST` | Yes | - | Redis hostname |
 | `REDIS_PORT` | No | 6379 | Redis port |
 | `REDIS_PASSWORD` | No | - | Redis password |
-| `SECRETS_PATH` | No | `proxy_core/secrets.json` | Path to secrets file |
-| `REQUEST_TIMEOUT` | No | 300.0 | Request timeout in seconds |
+| `SECRETS_PATH` | No | `proxy_core/secrets.yaml` | Path to secrets file (YAML) |
+| `LANGFUSE_HOST` | No | `https://cloud.langfuse.com` | Langfuse base URL |
+| `REQUEST_TIMEOUT` | No | 300.0 | Request timeout (LLM calls) in seconds |
 | `LOG_LEVEL` | No | INFO | Logging level |
 | `PORT` | No | 4000 | Gateway port |
 
 ### Secrets Configuration
 
-Create `proxy_core/secrets.json`:
-```json
-{
-  "langfuse_keys": {
-    "project-1": {
-      "public_key": "pk-lf-...",
-      "secret_key": "sk-lf-..."
-    },
-    "project-2": {
-      "public_key": "pk-lf-...",
-      "secret_key": "sk-lf-..."
-    }
-  },
-  "default_project_id": "project-1"
-}
+Create `proxy_core/secrets.yaml`:
+```yaml
+langfuse_keys:
+  project-1:
+    public_key: pk-lf-...
+    secret_key: sk-lf-...
+  project-2:
+    public_key: pk-lf-...
+    secret_key: sk-lf-...
+default_project_id: project-1
 ```
 
-**Security:** Add `secrets.json` to `.gitignore` (already configured).
+**Security:** `secrets.yaml` is ignored via `.gitignore`.
 
 ### LiteLLM Configuration
 
@@ -332,7 +324,7 @@ eval_protocol/proxy/
 │   ├── models.py           # Pydantic models
 │   ├── auth.py             # Authentication
 │   ├── main.py             # Entry point
-│   └── secrets.json.example
+│   └── secrets.yaml.example
 ├── docker-compose.yml       # Local development stack
 ├── Dockerfile.gateway       # Gateway container
 ├── config_no_cache.yaml     # LiteLLM config
@@ -345,17 +337,17 @@ eval_protocol/proxy/
 Extend `AuthProvider` in `auth.py`:
 ```python
 from .auth import AuthProvider
-from fastapi import HTTPException
+from fastapi import HTTPException, Request
 
 class MyAuthProvider(AuthProvider):
-    def validate(self, api_key: Optional[str]) -> Optional[str]:
-        if not api_key or not self.is_valid(api_key):
+    def validate(self, request: Request) -> Optional[str]:
+        api_key = None
+        auth_header = request.headers.get("authorization", "")
+        if auth_header.startswith("Bearer "):
+            api_key = auth_header.replace("Bearer ", "").strip()
+        if not api_key:
             raise HTTPException(status_code=401, detail="Invalid API key")
         return api_key
-
-    def is_valid(self, api_key: str) -> bool:
-        # Your validation logic
-        return True
 ```
 
 Then pass it to `create_app`:

eval_protocol/proxy/docker-compose.yml

@@ -22,7 +22,6 @@ services:
     environment:
       - LANGFUSE_PUBLIC_KEY=dummy  # Set dummy public and private key so Langfuse instance initializes in LiteLLM, then real keys get sent in proxy
       - LANGFUSE_SECRET_KEY=dummy
-      - LANGFUSE_HOST=https://langfuse.fireworks.ai
     volumes:
       - ./config_no_cache.yaml:/app/config.yaml:ro
     ports:
@@ -48,6 +47,8 @@ services:
       - REQUEST_TIMEOUT=300
       # Logging level: INFO (default)
       - LOG_LEVEL=INFO
+      # Langfuse and secrets
+      - SECRETS_PATH=/app/proxy_core/secrets.yaml
     ports:
       - "4000:4000"  # Main public-facing port
     networks:

eval_protocol/proxy/proxy_core/app.py

@@ -8,7 +8,7 @@
 import os
 import redis
 import logging
-import json
+import yaml
 from pathlib import Path
 import sys
 from contextlib import asynccontextmanager
@@ -36,33 +36,35 @@ def build_proxy_config() -> ProxyConfig:
     if not litellm_url:
         raise ValueError("LITELLM_URL environment variable must be set")
     request_timeout = float(os.getenv("REQUEST_TIMEOUT", "300.0"))
+    langfuse_host = os.getenv("LANGFUSE_HOST", "https://cloud.langfuse.com")
 
-    # Secrets - use SECRETS_PATH env var if set, otherwise default to proxy/secrets.json
+    # Secrets - use SECRETS_PATH env var if set, otherwise default to proxy/secrets.yaml
     secrets_path_str = os.getenv("SECRETS_PATH")
     if secrets_path_str:
         secrets_path = Path(secrets_path_str)
     else:
-        secrets_path = Path(__file__).parent / "secrets.json"
+        secrets_path = Path(__file__).parent / "secrets.yaml"
     if not secrets_path.exists():
         raise ValueError(
-            "secrets.json not found! Please create it from secrets.json.example:\n"
-            "  cp litellm_proxy_config/proxy/secrets.json.example litellm_proxy_config/proxy/secrets.json\n"
-            "Then add your Langfuse API keys to secrets.json"
+            "Secrets file not found! Please create it from secrets.yaml.example:\n"
+            "  cp eval_protocol/proxy/proxy_core/secrets.yaml.example eval_protocol/proxy/proxy_core/secrets.yaml\n"
+            "Then add your Langfuse API keys to the secrets file"
         )
     try:
         with open(secrets_path, "r") as f:
-            secrets_config = json.load(f)
+            secrets_config = yaml.safe_load(f)
         langfuse_keys = secrets_config["langfuse_keys"]
         default_project_id = secrets_config["default_project_id"]
-        logger.info(f"Loaded {len(langfuse_keys)} Langfuse project(s) from secrets.json")
+        logger.info(f"Loaded {len(langfuse_keys)} Langfuse project(s) from {secrets_path.name}")
     except KeyError as e:
-        raise ValueError(f"Missing required key in secrets.json: {e}")
-    except json.JSONDecodeError as e:
-        raise ValueError(f"Invalid JSON in secrets.json: {e}")
+        raise ValueError(f"Missing required key in secrets file: {e}")
+    except yaml.YAMLError as e:
+        raise ValueError(f"Invalid format in secrets file {secrets_path.name}: {e}")
 
     return ProxyConfig(
         litellm_url=litellm_url,
         request_timeout=request_timeout,
+        langfuse_host=langfuse_host,
         langfuse_keys=langfuse_keys,
         default_project_id=default_project_id,
     )
@@ -118,12 +120,7 @@ def get_redis(request: Request) -> redis.Redis:
         return request.app.state.redis
 
     async def require_auth(request: Request) -> None:
-        auth_header = request.headers.get("authorization", "")
-        api_key = None
-        if auth_header.startswith("Bearer "):
-            api_key = auth_header.replace("Bearer ", "").strip()
-
-        auth_provider.validate(api_key)
+        auth_provider.validate(request)
         return None
 
     # =====================

eval_protocol/proxy/proxy_core/auth.py

@@ -1,12 +1,13 @@
 from abc import ABC, abstractmethod
 from typing import Optional
+from fastapi import Request
 
 
 class AuthProvider(ABC):
     @abstractmethod
-    def validate(self, api_key: Optional[str]) -> Optional[str]: ...
+    def validate(self, request: Request) -> Optional[str]: ...
 
 
 class NoAuthProvider(AuthProvider):
-    def validate(self, api_key: Optional[str]) -> Optional[str]:
+    def validate(self, request: Request) -> Optional[str]:
         return None

eval_protocol/proxy/proxy_core/langfuse.py

@@ -210,7 +210,7 @@ async def fetch_langfuse_traces(
         langfuse_client = Langfuse(
             public_key=config.langfuse_keys[project_id]["public_key"],
             secret_key=config.langfuse_keys[project_id]["secret_key"],
-            host="https://langfuse.fireworks.ai",
+            host=config.langfuse_host,
         )
 
         # Parse datetime strings if provided

eval_protocol/proxy/proxy_core/litellm.py

@@ -87,7 +87,7 @@ async def handle_chat_completion(
     # Add Langfuse configuration
     data["langfuse_public_key"] = config.langfuse_keys[project_id]["public_key"]
     data["langfuse_secret_key"] = config.langfuse_keys[project_id]["secret_key"]
-    data["langfuse_host"] = "https://langfuse.fireworks.ai"
+    data["langfuse_host"] = config.langfuse_host
 
     # Forward to LiteLLM's standard /chat/completions endpoint
     # Set longer timeout for LLM API calls (LLMs can be slow)

eval_protocol/proxy/proxy_core/models.py

@@ -11,6 +11,7 @@ class ProxyConfig(BaseModel):
 
     litellm_url: str
     request_timeout: float = 300.0
+    langfuse_host: str
     langfuse_keys: Dict[str, Dict[str, str]]
     default_project_id: str