Unified Gateway

# Unified AI Gateway
# Requires `--features openai-responses` (experimental and off by default).
#
# Routes traffic by classifier-promoted headers so a single
# listener handles Anthropic Messages, OpenAI Chat Completions,
# and OpenAI Responses requests.
#
# `ai_operation` classifies both Anthropic Messages and OpenAI Chat
# Completions from the request head, without reading the body, and both
# branch on its published filter results. One filter covers both protocol
# families: each protocol declares its own operation registry, and the
# classifier aggregates them.
#
# Responses still routes on a body fact. `openai_responses_request`
# classifies the body for its own filter results but does not promote a
# format header (avoids overwriting), and `anthropic_messages_request`
# promotes `x-praxis-ai-format` and `x-praxis-ai-model` for the requests
# that reach it. `/v1/messages` no longer needs a body-format router rule:
# the head already identified it.

listeners:
  - name: unified-gateway
    address: "127.0.0.1:8080"
    filter_chains: [unified-routing]

filter_chains:
  - name: unified-routing
    filters:
      - filter: ai_operation
        branch_chains:
          - name: anthropic-messages
            on_result:
              filter: ai_operation
              key: application_protocol
              result: anthropic_messages
            chains:
              - name: anthropic-chain
                filters:
                  - filter: router
                    routes:
                      - path_prefix: "/"
                        cluster: "anthropic-backend"
            rejoin: shared_load_balancer
          - name: chat-completions
            on_result:
              filter: ai_operation
              key: application_protocol
              result: openai_chat_completions
            chains:
              - name: chat-chain
                filters:
                  - filter: router
                    routes:
                      - path_prefix: "/"
                        cluster: "openai-backend"
            rejoin: shared_load_balancer

      # Validates the create-message envelope for Anthropic traffic the head
      # branch above did not take. Header promotion is disabled: this processor
      # owns only `POST /v1/messages`, so it cannot classify the Responses
      # traffic the router below still has to separate.
      - filter: anthropic_messages_request
        on_invalid: continue
        headers:
          format: ~
          model: ~
          stream: ~

      # Promotes the routing header the Responses route matches on. This filter
      # owns `/v1/responses`, so it publishes that fact itself rather than
      # leaning on a general-purpose body classifier.
      # `initialize_state: false` because nothing here consumes Responses state.
      - filter: openai_responses_request
        initialize_state: false
        on_invalid: continue
        headers:
          format: x-praxis-ai-format
          model: x-praxis-ai-model
          stream: x-praxis-ai-stream

      - name: body_classifiers
        filter: router
        routes:
          - path: "/v1/responses"
            headers:
              x-praxis-ai-format: "openai_responses"
            cluster: "responses-backend"
          - path_prefix: "/"
            cluster: "default-backend"

      - name: shared_load_balancer
        filter: load_balancer
        clusters:
          - name: "anthropic-backend"
            endpoints:
              - "127.0.0.1:3001"
          - name: "openai-backend"
            endpoints:
              - "127.0.0.1:3002"
          - name: "responses-backend"
            endpoints:
              - "127.0.0.1:3003"
          - name: "default-backend"
            endpoints:
              - "127.0.0.1:3004"

insecure_options:
  allow_private_endpoints: true # example proxies to local backends