infer-stack 0.6.0__py3-none-any.whl

infer_stack/templates/docker-compose.yml.j2

@@ -0,0 +1,430 @@
+services:
+{% if lock.deployment.frontends.open_webui.enabled %}
+  postgres-open-webui:
+    image: {{ lock.deployment.images.postgres }}
+    container_name: postgres-open-webui
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${OPENWEBUI_POSTGRES_DB}
+      POSTGRES_USER: ${OPENWEBUI_POSTGRES_USER}
+      POSTGRES_PASSWORD: ${OPENWEBUI_POSTGRES_PASSWORD}
+    volumes:
+      - {{ lock.deployment.state.postgres_open_webui }}:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+{% endif %}
+{% if lock.deployment.gateways.litellm.enabled %}
+  postgres-litellm:
+    image: {{ lock.deployment.images.postgres }}
+    container_name: postgres-litellm
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${LITELLM_POSTGRES_DB}
+      POSTGRES_USER: ${LITELLM_POSTGRES_USER}
+      POSTGRES_PASSWORD: ${LITELLM_POSTGRES_PASSWORD}
+    volumes:
+      - {{ lock.deployment.state.postgres_litellm }}:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+{% endif %}
+{% if lock.deployment.providers.ollama.enabled %}
+  ollama:
+    image: {{ lock.deployment.images.ollama }}
+    container_name: ollama
+    restart: unless-stopped
+{% if lock.deployment.providers.ollama.labels %}
+    labels:
+{% for key, value in lock.deployment.providers.ollama.labels.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.providers.ollama.env_file %}
+    env_file:
+{% for env_file in lock.deployment.providers.ollama.env_file %}
+      - {{ env_file }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.providers.ollama.extra_hosts %}
+    extra_hosts:
+{% for extra_host in lock.deployment.providers.ollama.extra_hosts %}
+      - {{ extra_host|compose_quote }}
+{% endfor %}
+{% endif %}
+    environment:
+      NVIDIA_DRIVER_CAPABILITIES: compute,utility
+      CUDA_VISIBLE_DEVICES: {{ (lock.deployment.providers.ollama.gpu_indices | join(','))|compose_quote }}
+      OLLAMA_HOST: {{ lock.deployment.providers.ollama.host|compose_quote }}
+      OLLAMA_KEEP_ALIVE: {{ lock.deployment.providers.ollama.keep_alive|compose_quote }}
+      OLLAMA_CONTEXT_LENGTH: {{ lock.deployment.providers.ollama.context_length|compose_quote }}
+      OLLAMA_NUM_PARALLEL: {{ lock.deployment.providers.ollama.num_parallel|compose_quote }}
+      OLLAMA_MAX_LOADED_MODELS: {{ lock.deployment.providers.ollama.max_loaded_models|compose_quote }}
+      OLLAMA_MAX_QUEUE: {{ lock.deployment.providers.ollama.max_queue|compose_quote }}
+{% for key, value in lock.deployment.providers.ollama.extra_env.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+    volumes:
+      - {{ lock.deployment.state.ollama }}:/root/.ollama
+{% for volume in lock.deployment.providers.ollama.extra_volumes %}
+      - {{ volume }}
+{% endfor %}
+{% if lock.deployment.providers.ollama.publish_port or lock.deployment.providers.ollama.additional_ports %}
+    ports:
+{% if lock.deployment.providers.ollama.publish_port %}
+      - "127.0.0.1:{{ lock.deployment.ports.ollama or 11434 }}:11434"
+{% endif %}
+{% for port in lock.deployment.providers.ollama.additional_ports %}
+      - {{ port|compose_quote }}
+{% endfor %}
+{% endif %}
+    healthcheck:
+      test: ["CMD-SHELL", "ollama list >/dev/null 2>&1 || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 30
+      start_period: 60s
+{% if lock.deployment.providers.ollama.gpus is not none %}
+{{ lock.deployment.providers.ollama.gpus|compose_gpus }}
+{% elif lock.deployment.providers.ollama.gpu_indices %}
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              device_ids: [{% for idx in lock.deployment.providers.ollama.gpu_indices %}"{{ idx }}"{% if not loop.last %}, {% endif %}{% endfor %}]
+              capabilities: [gpu]
+{% endif %}
+
+{% endif %}
+{% for name, svc in lock.deployment.providers.vllm.runtimes.items() %}
+  {{ svc.compose_service_name }}:
+    image: {{ lock.deployment.images.vllm }}
+    container_name: {{ svc.container_name or svc.compose_service_name }}
+    restart: unless-stopped
+    ipc: host
+    labels:
+      infer_stack.profile_name: {{ svc.profile_name|compose_quote }}
+      infer_stack.public_name: {{ svc.profile_public_name|compose_quote }}
+      infer_stack.logical_model_name: {{ svc.logical_model_name|compose_quote }}
+      infer_stack.protocol_mode: {{ svc.protocol_mode|compose_quote }}
+{% for key, value in svc.labels.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+{% if svc.env_file %}
+    env_file:
+{% for env_file in svc.env_file %}
+      - {{ env_file }}
+{% endfor %}
+{% endif %}
+{% if svc.extra_hosts %}
+    extra_hosts:
+{% for extra_host in svc.extra_hosts %}
+      - {{ extra_host|compose_quote }}
+{% endfor %}
+{% endif %}
+    environment:
+      NVIDIA_DRIVER_CAPABILITIES: compute,utility
+      HF_TOKEN: ${HF_TOKEN}
+      VLLM_API_KEY: ${VLLM_BACKEND_API_KEY}
+      HF_HOME: /root/.cache/huggingface
+      HF_HUB_CACHE: /root/.cache/huggingface/hub
+      HUGGINGFACE_HUB_CACHE: /root/.cache/huggingface/hub
+      VLLM_CACHE_ROOT: /root/.cache/vllm
+      TORCH_HOME: /root/.cache/torch
+      TORCHINDUCTOR_CACHE_DIR: /root/.cache/torch/inductor
+      TRITON_CACHE_DIR: /root/.cache/triton
+      CUDA_CACHE_PATH: /root/.cache/nvidia/ComputeCache
+{% if lock.deployment.vllm.enable_responses_api_store %}
+      VLLM_ENABLE_RESPONSES_API_STORE: "1"
+{% endif %}
+      VLLM_LOGGING_LEVEL: {{ lock.deployment.vllm.logging_level|compose_quote }}
+{% for key, value in svc.extra_env.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+    command:
+      - {{ svc.hf_model_id|compose_quote }}
+      - --host
+      - 0.0.0.0
+      - --port
+      - "8000"
+      - --api-key
+      - ${VLLM_BACKEND_API_KEY}
+      - --served-model-name
+      - {{ svc.served_model_name|compose_quote }}
+      - --tensor-parallel-size
+      - {{ svc.tensor_parallel_size|compose_quote }}
+      - --data-parallel-size
+      - {{ svc.data_parallel_size|compose_quote }}
+      - --max-model-len
+      - {{ svc.max_model_len|compose_quote }}
+      - --gpu-memory-utilization
+      - {{ svc.gpu_memory_utilization|compose_quote }}
+      - --max-num-batched-tokens
+      - {{ svc.max_num_batched_tokens|compose_quote }}
+      - --max-num-seqs
+      - {{ svc.max_num_seqs|compose_quote }}
+{% if svc.enable_prefix_caching %}
+      - --enable-prefix-caching
+{% endif %}
+{% if svc.enable_auto_tool_choice %}
+      - --enable-auto-tool-choice
+      - --tool-call-parser
+      - {{ svc.tool_call_parser|compose_quote }}
+{% endif %}
+{% if svc.reasoning_enabled and svc.reasoning_parser %}
+      - --reasoning-parser
+      - {{ svc.reasoning_parser|compose_quote }}
+{% endif %}
+{% for extra_arg in svc.extra_args %}
+      - {{ extra_arg|compose_quote }}
+{% endfor %}
+    volumes:
+      - {{ lock.deployment.state.hf_cache }}:/root/.cache/huggingface
+      - {{ lock.deployment.state.vllm_cache }}:/root/.cache/vllm
+      - {{ lock.deployment.state.torch_cache }}:/root/.cache/torch
+      - {{ lock.deployment.state.triton_cache }}:/root/.cache/triton
+      - {{ lock.deployment.state.cuda_cache }}:/root/.cache/nvidia/ComputeCache
+{% for volume in svc.extra_volumes %}
+      - {{ volume }}
+{% endfor %}
+{% if svc.publish_port or svc.additional_ports %}
+    ports:
+{% if svc.publish_port %}
+      - "127.0.0.1:${INFER_STACK_VLLM_{{ loop.index0 }}_PORT:-{{ svc.host_port or (18000 + loop.index0) }}}:8000"
+{% endif %}
+{% for port in svc.additional_ports %}
+      - {{ port|compose_quote }}
+{% endfor %}
+{% endif %}
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8000/health >/dev/null 2>&1 || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 30
+      start_period: 1800s
+{% if svc.gpus is not none %}
+{{ svc.gpus|compose_gpus }}
+{% else %}
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              device_ids: [{% for idx in svc.gpu_indices %}"{{ idx }}"{% if not loop.last %}, {% endif %}{% endfor %}]
+              capabilities: [gpu]
+{% endif %}
+
+{% endfor %}
+{% if lock.deployment.gateways.litellm.enabled %}
+  litellm:
+    image: {{ lock.deployment.images.litellm }}
+    container_name: litellm
+    restart: unless-stopped
+{% if lock.deployment.gateways.litellm.labels %}
+    labels:
+{% for key, value in lock.deployment.gateways.litellm.labels.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+{% endif %}
+    depends_on:
+      postgres-litellm:
+        condition: service_healthy
+    # Do not depend directly on provider health here. LiteLLM can load its
+    # route table before upstream providers are healthy, and avoiding provider
+    # dependency edges prevents Compose from restarting LiteLLM on every vLLM
+    # model swap. Smoke tests and clients should retry until the selected
+    # upstream model is healthy.
+{% if lock.deployment.gateways.litellm.env_file %}
+    env_file:
+{% for env_file in lock.deployment.gateways.litellm.env_file %}
+      - {{ env_file }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.gateways.litellm.extra_hosts %}
+    extra_hosts:
+{% for extra_host in lock.deployment.gateways.litellm.extra_hosts %}
+      - {{ extra_host|compose_quote }}
+{% endfor %}
+{% endif %}
+    environment:
+      LITELLM_MASTER_KEY: ${LITELLM_MASTER_KEY}
+      VLLM_BACKEND_API_KEY: ${VLLM_BACKEND_API_KEY}
+      DATABASE_URL: postgresql://${LITELLM_POSTGRES_USER}:${LITELLM_POSTGRES_PASSWORD}@postgres-litellm:5432/${LITELLM_POSTGRES_DB}
+{% for key, value in lock.deployment.gateways.litellm.extra_env.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+    command:
+      - --config
+      - /app/config.yaml
+      - --port
+      - "4000"
+      - --num_workers
+      - "1"
+    volumes:
+      - {{ lock.deployment.state.runtime }}/litellm_config.yaml:/app/config.yaml:ro
+{% for volume in lock.deployment.gateways.litellm.extra_volumes %}
+      - {{ volume }}
+{% endfor %}
+{% if lock.deployment.gateways.litellm.additional_ports or lock.deployment.ports.litellm %}
+    ports:
+      - "${INFER_STACK_LITELLM_PORT:-{{ lock.deployment.ports.litellm or 14042 }}}:4000"
+{% for port in lock.deployment.gateways.litellm.additional_ports %}
+      - {{ port|compose_quote }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.gateways.litellm.gpus is not none %}
+{{ lock.deployment.gateways.litellm.gpus|compose_gpus }}
+{% endif %}
+
+{% endif %}
+{% if lock.deployment.frontends.open_webui.enabled %}
+  open-webui:
+    image: {{ lock.deployment.images.open_webui }}
+    container_name: open-webui
+    restart: unless-stopped
+{% if lock.deployment.frontends.open_webui.labels %}
+    labels:
+{% for key, value in lock.deployment.frontends.open_webui.labels.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+{% endif %}
+    depends_on:
+      postgres-open-webui:
+        condition: service_healthy
+{% if lock.deployment.frontends.open_webui.provider == 'ollama' %}
+      ollama:
+        condition: service_started
+{% elif lock.deployment.frontends.open_webui.provider == 'litellm' %}
+      litellm:
+        condition: service_started
+{% endif %}
+{% if lock.deployment.frontends.open_webui.env_file %}
+    env_file:
+{% for env_file in lock.deployment.frontends.open_webui.env_file %}
+      - {{ env_file }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.frontends.open_webui.extra_hosts %}
+    extra_hosts:
+{% for extra_host in lock.deployment.frontends.open_webui.extra_hosts %}
+      - {{ extra_host|compose_quote }}
+{% endfor %}
+{% endif %}
+    environment:
+      WEBUI_AUTH: {{ ('True' if lock.deployment.frontends.open_webui.auth else 'False')|compose_quote }}
+      ENABLE_PERSISTENT_CONFIG: "False"
+      DATABASE_URL: postgresql://${OPENWEBUI_POSTGRES_USER}:${OPENWEBUI_POSTGRES_PASSWORD}@postgres-open-webui:5432/${OPENWEBUI_POSTGRES_DB}
+{% if lock.deployment.frontends.open_webui.webui_url %}
+      WEBUI_URL: {{ lock.deployment.frontends.open_webui.webui_url|compose_quote }}
+{% endif %}
+{% if lock.deployment.frontends.open_webui.cors_allow_origin %}
+      CORS_ALLOW_ORIGIN: {{ lock.deployment.frontends.open_webui.cors_allow_origin|compose_quote }}
+{% endif %}
+{% if lock.deployment.frontends.open_webui.provider == 'ollama' %}
+      ENABLE_OLLAMA_API: "True"
+      OLLAMA_BASE_URL: http://ollama:11434
+{% elif lock.deployment.frontends.open_webui.provider == 'litellm' %}
+      ENABLE_OLLAMA_API: "False"
+      OPENAI_API_BASE_URL: http://litellm:4000/v1
+      OPENAI_API_KEY: ${LITELLM_MASTER_KEY}
+{% endif %}
+      WEBUI_SECRET_KEY: ${WEBUI_SECRET_KEY}
+{% if lock.deployment.frontends.open_webui.ldap.enabled %}
+{% for key, value in lock.deployment.frontends.open_webui.ldap.env.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+{% endif %}
+{% for key, value in lock.deployment.frontends.open_webui.extra_env.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+    volumes:
+      - {{ lock.deployment.state.open_webui }}:/app/backend/data
+{% for volume in lock.deployment.frontends.open_webui.extra_volumes %}
+      - {{ volume }}
+{% endfor %}
+{% if lock.deployment.frontends.open_webui.publish_port or lock.deployment.frontends.open_webui.additional_ports %}
+    ports:
+{% if lock.deployment.frontends.open_webui.publish_port %}
+      - "${INFER_STACK_OPEN_WEBUI_PORT:-{{ lock.deployment.ports.open_webui or 13000 }}}:8080"
+{% endif %}
+{% for port in lock.deployment.frontends.open_webui.additional_ports %}
+      - {{ port|compose_quote }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.frontends.open_webui.gpus is not none %}
+{{ lock.deployment.frontends.open_webui.gpus|compose_gpus }}
+{% endif %}
+
+{% endif %}
+{% if lock.deployment.frontends.reverse_proxy.enabled %}
+  {{ lock.deployment.frontends.reverse_proxy.service_name }}:
+    image: {{ lock.deployment.frontends.reverse_proxy.image }}
+    container_name: {{ lock.deployment.frontends.reverse_proxy.container_name }}
+    restart: unless-stopped
+{% if lock.deployment.frontends.reverse_proxy.labels %}
+    labels:
+{% for key, value in lock.deployment.frontends.reverse_proxy.labels.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.frontends.reverse_proxy.depends_on %}
+    depends_on:
+{% for service in lock.deployment.frontends.reverse_proxy.depends_on %}
+      - {{ service }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.frontends.reverse_proxy.env_file %}
+    env_file:
+{% for env_file in lock.deployment.frontends.reverse_proxy.env_file %}
+      - {{ env_file }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.frontends.reverse_proxy.extra_env %}
+    environment:
+{% for key, value in lock.deployment.frontends.reverse_proxy.extra_env.items() %}
+      {{ key }}: {{ value|compose_quote }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.frontends.reverse_proxy.extra_hosts %}
+    extra_hosts:
+{% for extra_host in lock.deployment.frontends.reverse_proxy.extra_hosts %}
+      - {{ extra_host|compose_quote }}
+{% endfor %}
+{% endif %}
+    volumes:
+      - {{ lock.deployment.frontends.reverse_proxy.nginx_config_path }}:/etc/nginx/conf.d/default.conf:ro
+{% if lock.deployment.frontends.reverse_proxy.ssl.enabled and lock.deployment.frontends.reverse_proxy.ssl.certificate %}
+      - {{ lock.deployment.frontends.reverse_proxy.ssl.certificate }}:{{ lock.deployment.frontends.reverse_proxy.ssl.certificate_container_path }}:ro
+{% endif %}
+{% if lock.deployment.frontends.reverse_proxy.ssl.enabled and lock.deployment.frontends.reverse_proxy.ssl.certificate_key %}
+      - {{ lock.deployment.frontends.reverse_proxy.ssl.certificate_key }}:{{ lock.deployment.frontends.reverse_proxy.ssl.certificate_key_container_path }}:ro
+{% endif %}
+{% if lock.deployment.frontends.reverse_proxy.ssl.enabled and lock.deployment.frontends.reverse_proxy.ssl.dhparam %}
+      - {{ lock.deployment.frontends.reverse_proxy.ssl.dhparam }}:{{ lock.deployment.frontends.reverse_proxy.ssl.dhparam_container_path }}:ro
+{% endif %}
+{% for volume in lock.deployment.frontends.reverse_proxy.extra_volumes %}
+      - {{ volume }}
+{% endfor %}
+{% if lock.deployment.frontends.reverse_proxy.publish_http or lock.deployment.frontends.reverse_proxy.publish_https or lock.deployment.frontends.reverse_proxy.additional_ports %}
+    ports:
+{% if lock.deployment.frontends.reverse_proxy.publish_http %}
+      - "{{ lock.deployment.frontends.reverse_proxy.http_bind_host }}{% if lock.deployment.frontends.reverse_proxy.http_bind_host %}:{% endif %}${INFER_STACK_REVERSE_PROXY_HTTP_PORT:-{{ lock.deployment.frontends.reverse_proxy.http_port }}}:80"
+{% endif %}
+{% if lock.deployment.frontends.reverse_proxy.publish_https %}
+      - "{{ lock.deployment.frontends.reverse_proxy.https_bind_host }}{% if lock.deployment.frontends.reverse_proxy.https_bind_host %}:{% endif %}${INFER_STACK_REVERSE_PROXY_HTTPS_PORT:-{{ lock.deployment.frontends.reverse_proxy.https_port }}}:443"
+{% endif %}
+{% for port in lock.deployment.frontends.reverse_proxy.additional_ports %}
+      - {{ port|compose_quote }}
+{% endfor %}
+{% endif %}
+{% if lock.deployment.frontends.reverse_proxy.gpus is not none %}
+{{ lock.deployment.frontends.reverse_proxy.gpus|compose_gpus }}
+{% endif %}
+{% endif %}

infer_stack/templates/litellm_config.yaml.j2

@@ -0,0 +1,44 @@
+general_settings:
+  master_key: os.environ/LITELLM_MASTER_KEY
+  store_model_in_db: True
+
+model_list:
+{% for alias, route in lock.deployment.gateways.litellm.routes.items() %}
+{% set max_model_len = route.max_model_len or 4096 %}
+{% set max_output = max_model_len // 2 %}
+{% set max_input = max_model_len - max_output %}
+  - model_name: {{ alias }}
+    litellm_params:
+{% if route.provider == 'ollama' %}
+      model: ollama_chat/{{ route.upstream_model }}
+      api_base: http://ollama:11434
+      drop_params: true
+{% elif route.protocol_mode == 'completions' %}
+      model: text-completion-openai/{{ route.served_model_name }}
+      api_base: http://{{ route.upstream_service_name or route.service_name }}:8000/v1
+      api_key: os.environ/VLLM_BACKEND_API_KEY
+{% else %}
+      model: openai/{{ route.served_model_name }}
+      api_base: http://{{ route.upstream_service_name or route.service_name }}:8000/v1
+      api_key: os.environ/VLLM_BACKEND_API_KEY
+      merge_reasoning_content_in_choices: true
+{% endif %}
+{% if route.chat_compat_enabled and route.chat_compat_strategy == 'flat_messages' %}
+      initial_prompt_value: ""
+      roles:
+        system:
+          pre_message: ""
+          post_message: "\n"
+        user:
+          pre_message: ""
+          post_message: "\n"
+        assistant:
+          pre_message: ""
+          post_message: "\n"
+      final_prompt_value: ""
+{% endif %}
+    model_info:
+      max_tokens: {{ max_model_len }}
+      max_input_tokens: {{ max_input }}
+      max_output_tokens: {{ max_output }}
+{% endfor %}

infer_stack/templates/nginx.conf.j2

@@ -0,0 +1,84 @@
+# Rendered by infer-stack.  To take full manual control, set
+# frontends.reverse_proxy.config_path to an existing nginx config file.
+upstream infer_stack_target {
+    server {{ rp.target_service }}:{{ rp.target_port }};
+}
+
+{% macro proxy_location(rp) %}
+location / {
+    proxy_pass         {{ rp.target_scheme }}://infer_stack_target;
+    proxy_redirect     off;
+    proxy_http_version 1.1;
+    proxy_cache_bypass $http_upgrade;
+    proxy_set_header   Upgrade $http_upgrade;
+    proxy_set_header   Connection "upgrade";
+    proxy_set_header   Host $host;
+    proxy_set_header   X-Real-IP $remote_addr;
+    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header   X-Forwarded-Proto $scheme;
+    proxy_set_header   X-Forwarded-Host $server_name;
+    proxy_buffer_size           {{ rp.proxy_buffer_size }};
+    proxy_buffers               {{ rp.proxy_buffers }};
+    proxy_busy_buffers_size     {{ rp.proxy_busy_buffers_size }};
+    proxy_connect_timeout {{ rp.proxy_connect_timeout }};
+    proxy_read_timeout {{ rp.proxy_read_timeout }};
+    proxy_send_timeout {{ rp.proxy_send_timeout }};
+{% if rp.proxy_buffering is not none %}
+    proxy_buffering {{ 'on' if rp.proxy_buffering else 'off' }};
+{% endif %}
+{% if rp.proxy_cache is not none %}
+    proxy_cache {{ rp.proxy_cache }};
+{% endif %}
+    client_max_body_size {{ rp.client_max_body_size }};
+}
+{% endmacro %}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name {{ rp.server_name }};
+{% if rp.ssl.enabled and rp.force_https %}
+
+    return 301 https://$host$request_uri;
+{% else %}
+
+{{ proxy_location(rp)|indent(4, true) }}
+{% endif %}
+}
+
+{% if rp.ssl.enabled %}
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name {{ rp.server_name }};
+
+    ssl_certificate {{ rp.ssl.certificate_container_path }};
+    ssl_certificate_key {{ rp.ssl.certificate_key_container_path }};
+{% if rp.ssl.dhparam %}
+    ssl_dhparam {{ rp.ssl.dhparam_container_path }};
+{% endif %}
+    ssl_protocols {{ rp.ssl.protocols }};
+    ssl_ciphers {{ rp.ssl.ciphers }};
+    ssl_prefer_server_ciphers {{ 'on' if rp.ssl.prefer_server_ciphers else 'off' }};
+    ssl_session_cache {{ rp.ssl.session_cache }};
+    ssl_ecdh_curve {{ rp.ssl.ecdh_curve }};
+    ssl_session_tickets {{ 'on' if rp.ssl.session_tickets else 'off' }};
+    ssl_stapling {{ 'on' if rp.ssl.stapling else 'off' }};
+    ssl_stapling_verify {{ 'on' if rp.ssl.stapling_verify else 'off' }};
+{% if rp.resolver %}
+    resolver {{ rp.resolver | join(' ') }} valid=300s;
+    resolver_timeout {{ rp.resolver_timeout }};
+{% endif %}
+{% if rp.hsts.enabled %}
+    add_header Strict-Transport-Security "max-age={{ rp.hsts.max_age }}{% if rp.hsts.include_subdomains %}; includeSubdomains{% endif %}{% if rp.hsts.preload %}; preload{% endif %}" always;
+{% endif %}
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+
+{{ proxy_location(rp)|indent(4, true) }}
+{% if rp.extra_config %}
+
+{{ rp.extra_config }}
+{% endif %}
+}
+{% endif %}

infer_stack/tuning.py

@@ -0,0 +1,3 @@
+from __future__ import annotations
+
+# Placeholder for future tuning expansion.