# Gateway

Nginx reverse proxy that serves as the **single entry point** for all didiAI services. All requests (except `/health`) require Bearer token authentication.

## Prerequisites

- All global prerequisites (see main [README.md](../../README.md))
- Docker network `deploy_default` (shared with other modules)
- At least one backend service running (llm-inference, audio, web, catalog-api)

## Routes

| Route | Upstream | Description |
|-------|----------|-------------|
| `/health` | (nginx direct) | Health check, no auth required |
| `/llm/` | `didiAI-llm-api:14011` | LLM Inference API (SSE streaming enabled) |
| `/audio/` | `didiAI-audio-api:54300` | Audio Transcription API (10M body buffer) |
| `/web/` | `didiAI-web-api:51100` | Web Fact-checking API |
| `/catalog/` | `didiAI-catalog-api:11000` | Catalog API (service discovery) |
| `/embeddings/` | `didiAI-embeddings-api:14100` | Embeddings API (OpenAI-compatible) |
| `/rerank/` | `didiAI-rerank-api:14200` | Rerank API (Cohere/Jina-compatible) |

## Authentication

All routes except `/health` require a Bearer token:

```
Authorization: Bearer <GATEWAY_API_TOKEN>
```

Unauthorized requests receive:
```json
{"error": "unauthorized", "message": "Invalid or missing Bearer token"}
```

## Configuration

| Variable | Required | Description |
|----------|----------|-------------|
| `GATEWAY_API_TOKEN` | Yes | Bearer token for authentication |

## Quick Start

```bash
cd deploy/

# Configure
cp .env.example .env
# Edit .env and set GATEWAY_API_TOKEN

# Start
docker compose up -d

# Test
curl http://localhost:11000/health
curl -H "Authorization: Bearer <token>" http://localhost:11000/llm/health
```

## Port

| Port | Service | Description |
|------|---------|-------------|
| 11000 | Gateway | Only externally exposed port for the platform |

## Proxy Settings

- **Connect timeout:** 60s
- **Send timeout:** 300s
- **Read timeout:** 600s
- **Max upload size:** 500MB
- **Request ID:** Auto-generated `X-Request-ID` header on all requests

## Architecture

```
Client
  |
  v
Gateway (nginx :11000) ---> Bearer token check
  |
  +-- /llm/        --> didiAI-llm-api:14011        (SSE streaming)
  +-- /audio/      --> didiAI-audio-api:54300       (large uploads)
  +-- /web/        --> didiAI-web-api:51100
  +-- /catalog/    --> didiAI-catalog-api:11000
  +-- /embeddings/ --> didiAI-embeddings-api:14100
  +-- /rerank/     --> didiAI-rerank-api:14200
```