chore: move deployment sources under litellm/deploy (#50981)

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/CODEOWNERS

@@ -1,6 +1,6 @@
 /model_prices_and_context_window.json @mateo-berri @ryan-crabbe-berri @kerry-berri @joshua-berri
 /litellm/model_prices_and_context_window_backup.json @mateo-berri @ryan-crabbe-berri @kerry-berri @joshua-berri
 /ci_cd/cost_map_pins.json @mateo-berri @ryan-crabbe-berri @kerry-berri @joshua-berri
-/helm/ @yassin-berriai
-/terraform/ @yassin-berriai
+/litellm/deploy/helm/ @yassin-berriai
+/litellm/deploy/terraform/ @yassin-berriai
 /.github/workflows/zizmor.yml @yuneng-berri

.github/CONTRIBUTING.md

@@ -306,7 +306,7 @@ If you want to build the Docker image yourself:
 
 ```bash
 # Build the image (runs as a non-root user by default)
-docker build -t litellm_dev .
+docker build -f litellm/deploy/docker/Dockerfile -t litellm_dev .
 
 # Generate a master key. Requests send it as the bearer token
 export LITELLM_MASTER_KEY="sk-$(openssl rand -hex 32)"

.github/scripts/verify_linux_native_wheel.py

@@ -128,6 +128,7 @@ def main(
             member.filename
             for member in wheel_members
             if member.filename.endswith((".pdb", ".dwp", ".rlib", ".rmeta", "Cargo.toml", "Cargo.lock"))
+            or member.filename.startswith("litellm/deploy/")
             or any(part.endswith(".dSYM") for part in PurePosixPath(member.filename).parts)
         )
         native_member: Final = native_members[0]

.github/workflows/image-scan.yml

@@ -7,9 +7,9 @@ on:
       - litellm_oss_branch
       - "litellm_**"
     paths:
-      - Dockerfile
-      - .dockerignore
-      - docker-entrypoint.sh
+      - litellm/deploy/docker/Dockerfile
+      - litellm/deploy/docker/Dockerfile.dockerignore
+      - litellm/deploy/docker/docker-entrypoint.sh
       - migrations/run.py
       - gateway/main.py
       - gateway/launch.py
@@ -60,7 +60,7 @@ jobs:
           persist-credentials: false
 
       - name: Build the image
-        run: docker build --build-arg MATURIN_PEP517_ARGS="--profile ci" --build-arg LITELLM_RELEASE_TAG=v0.0.0-lens-ci -t "$IMAGE" .
+        run: docker build -f litellm/deploy/docker/Dockerfile --build-arg MATURIN_PEP517_ARGS="--profile ci" --build-arg LITELLM_RELEASE_TAG=v0.0.0-lens-ci -t "$IMAGE" .
 
       - name: Save the image for the verify matrix
         run: docker save "$IMAGE" | zstd -T0 -3 -o "$RUNNER_TEMP/litellm-image.tar.zst"
@@ -73,7 +73,7 @@ jobs:
           compression-level: 0
 
       - name: Build the Admin MCP schema image
-        run: docker build --build-arg MATURIN_PEP517_ARGS="--profile ci" --build-arg LITELLM_RELEASE_TAG=v0.0.0-lens-ci --target builder -t "$ADMIN_MCP_SCHEMA_IMAGE" .
+        run: docker build -f litellm/deploy/docker/Dockerfile --build-arg MATURIN_PEP517_ARGS="--profile ci" --build-arg LITELLM_RELEASE_TAG=v0.0.0-lens-ci --target builder -t "$ADMIN_MCP_SCHEMA_IMAGE" .
 
       - name: Save the Admin MCP schema image for the verify matrix
         run: docker save "$ADMIN_MCP_SCHEMA_IMAGE" | zstd -T0 -3 -o "$RUNNER_TEMP/litellm-admin-mcp-schema.tar.zst"

.github/workflows/test-merge-smoke.yml

@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Build the dashboard stage
-        run: docker build --target ui-builder -f Dockerfile .
+        run: docker build --target ui-builder -f litellm/deploy/docker/Dockerfile .
 
   core-checks:
     name: py${{ matrix.python-version }}

.github/workflows/test-terraform-modules.yml

@@ -3,16 +3,16 @@ name: Terraform Modules
 on:
   push:
     paths:
-      - "terraform/litellm/aws/**"
-      - "terraform/litellm/gcp/**"
+      - "litellm/deploy/terraform/litellm/aws/**"
+      - "litellm/deploy/terraform/litellm/gcp/**"
       - ".github/workflows/test-terraform-modules.yml"
   pull_request:
     branches:
       - main
       - "litellm_**"
     paths:
-      - "terraform/litellm/aws/**"
-      - "terraform/litellm/gcp/**"
+      - "litellm/deploy/terraform/litellm/aws/**"
+      - "litellm/deploy/terraform/litellm/gcp/**"
       - ".github/workflows/test-terraform-modules.yml"
 
 permissions:
@@ -33,7 +33,7 @@ jobs:
         module: [aws, gcp]
     defaults:
       run:
-        working-directory: terraform/litellm/${{ matrix.module }}
+        working-directory: litellm/deploy/terraform/litellm/${{ matrix.module }}
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:

.github/workflows/test-terraform-provider.yml

@@ -3,14 +3,14 @@ name: Terraform Provider
 on:
   push:
     paths:
-      - "terraform/provider/**"
+      - "litellm/deploy/terraform/provider/**"
       - ".github/workflows/test-terraform-provider.yml"
   pull_request:
     branches:
       - main
       - "litellm_**"
     paths:
-      - "terraform/provider/**"
+      - "litellm/deploy/terraform/provider/**"
       - "litellm/proxy/**"
       - "enterprise/**"
       - ".github/workflows/test-terraform-provider.yml"
@@ -29,7 +29,7 @@ jobs:
     timeout-minutes: 10
     defaults:
       run:
-        working-directory: terraform/provider
+        working-directory: litellm/deploy/terraform/provider
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
@@ -37,9 +37,9 @@ jobs:
 
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version-file: terraform/provider/go.mod
+          go-version-file: litellm/deploy/terraform/provider/go.mod
           cache: true
-          cache-dependency-path: terraform/provider/go.sum
+          cache-dependency-path: litellm/deploy/terraform/provider/go.sum
 
       - name: gofmt
         run: |
@@ -115,14 +115,14 @@ jobs:
 
       - name: Generate proxy OpenAPI schema
         run: |
-          uv run --no-sync python terraform/provider/tools/dump_openapi.py "${RUNNER_TEMP}/openapi.json"
+          uv run --no-sync python litellm/deploy/terraform/provider/tools/dump_openapi.py "${RUNNER_TEMP}/openapi.json"
 
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version-file: terraform/provider/go.mod
+          go-version-file: litellm/deploy/terraform/provider/go.mod
           cache: true
-          cache-dependency-path: terraform/provider/go.sum
+          cache-dependency-path: litellm/deploy/terraform/provider/go.sum
 
       - name: Audit provider endpoints against the schema
-        working-directory: terraform/provider
+        working-directory: litellm/deploy/terraform/provider
         run: go run ./tools/endpointaudit -provider-dir ./litellm -spec "${RUNNER_TEMP}/openapi.json" -coverage-allowlist ./tools/endpointaudit/coverage_allowlist.txt

.github/workflows/test-unit.yml

@@ -1379,7 +1379,7 @@ jobs:
 
       - name: Run unit tests
         run: |
-          chart=helm/litellm
+          chart=litellm/deploy/helm/litellm
           declared="$(grep -h '^suite:' "$chart"/tests/*.yaml | wc -l | tr -d '[:space:]')"
           output="$(mktemp)"
           helm unittest -f 'tests/*.yaml' "$chart" | tee "$output"

.gitignore

@@ -61,8 +61,8 @@ ui/litellm-dashboard/next-env.d.ts
 *.tsbuildinfo
 ui/litellm-dashboard/package.json
 ui/litellm-dashboard/package-lock.json
-helm/litellm/charts/*.tgz
-helm/*.tgz
+litellm/deploy/helm/litellm/charts/*.tgz
+litellm/deploy/helm/*.tgz
 litellm/proxy/vertex_key.json
 **/.vim/
 **/node_modules

Makefile

@@ -341,7 +341,7 @@ test-integration: install-test-deps
 	$(UV_RUN) pytest tests/
 
 test-unit-helm: install-helm-unittest
-	helm unittest -f 'tests/*.yaml' helm/litellm
+	helm unittest -f 'tests/*.yaml' litellm/deploy/helm/litellm
 
 # LLM Translation testing targets
 test-llm-translation: install-test-deps

README.md

@@ -526,7 +526,7 @@ Run the LiteLLM proxy as a production-ready componentized stack (gateway, backen
 
 ```bash
 git clone https://github.com/BerriAI/litellm.git
-cd litellm/terraform/litellm/aws/examples/default
+cd litellm/litellm/deploy/terraform/litellm/aws/examples/default
 cp terraform.tfvars.example terraform.tfvars   # edit region/tenant/env
 terraform init && terraform apply
 ```
@@ -579,7 +579,7 @@ Provider API keys live in AWS Secrets Manager; reference ARNs via `gateway_extra
 
 [![Open in Cloud Shell](https://gstatic.com/cloudssh/images/open-btn.png)](https://ssh.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2FBerriAI%2Fterraform-google-litellm&cloudshell_git_branch=v1.105.0&cloudshell_workspace=examples%2Fdefault&cloudshell_tutorial=TUTORIAL.md&cloudshell_image=gcr.io/ds-artifacts-cloudshell/deploystack_custom_image&shellonly=true)
 
-Real 1-click. Opens Cloud Shell, clones the [terraform-google-litellm](https://github.com/BerriAI/terraform-google-litellm) module mirror at the latest stable release (a small download instead of the full litellm repo), and walks you through `terraform apply` via a built-in [DeployStack tutorial](./terraform/litellm/gcp/examples/default/TUTORIAL.md). Pick the project, the tutorial sets up the Artifact Registry remote repo, writes `terraform.tfvars` from your answers, and runs apply
+Real 1-click. Opens Cloud Shell, clones the [terraform-google-litellm](https://github.com/BerriAI/terraform-google-litellm) module mirror at the latest stable release (a small download instead of the full litellm repo), and walks you through `terraform apply` via a built-in [DeployStack tutorial](./litellm/deploy/terraform/litellm/gcp/examples/default/TUTORIAL.md). Pick the project, the tutorial sets up the Artifact Registry remote repo, writes `terraform.tfvars` from your answers, and runs apply
 
 [Module page →](https://registry.terraform.io/modules/BerriAI/litellm/google/latest)
 
@@ -646,14 +646,14 @@ Provider API keys live in Secret Manager; reference resource IDs (e.g. `projects
 - Versioned object store for proxy state + file uploads
 - An auto-generated `LITELLM_MASTER_KEY` in your cloud's secret manager
 - A one-off migration job that runs `prisma migrate deploy` before the proxy starts
-- The same `proxy_config` surface as the [Helm chart](./helm/litellm/) — pass YAML as a typed map
+- The same `proxy_config` surface as the [Helm chart](./litellm/deploy/helm/litellm/) — pass YAML as a typed map
 
-The Terraform modules live at [`terraform/litellm/aws/`](./terraform/litellm/aws/) and [`terraform/litellm/gcp/`](./terraform/litellm/gcp/) in this repo; the registry entries are read-only mirrors updated on each release.
+The Terraform modules live at [`litellm/deploy/terraform/litellm/aws/`](./litellm/deploy/terraform/litellm/aws/) and [`litellm/deploy/terraform/litellm/gcp/`](./litellm/deploy/terraform/litellm/gcp/) in this repo; the registry entries are read-only mirrors updated on each release.
 
 ### Run in Developer Mode
 #### Services
 1. Setup .env file in root
-2. Run dependent services `docker-compose up db prometheus`
+2. Run dependent services `docker compose -f litellm/deploy/compose/docker-compose.yml up db prometheus`
 
 #### Backend
 1. Run `make bootstrap`

litellm/deploy/compose/README.md

@@ -0,0 +1,13 @@
+# Compose deployments
+
+The LiteAdmin overlay requires an explicit project name. Moving the Compose files changes the default project name and therefore the state volume name. Reuse the existing name so the agent keeps its saved state.
+
+Set `EXISTING_LITEADMIN_CONTAINER` to the running or stopped agent container, then read its project label before upgrading.
+
+```sh
+export COMPOSE_PROJECT_NAME="$(docker inspect --format '{{ index .Config.Labels "com.docker.compose.project" }}' "$EXISTING_LITEADMIN_CONTAINER")"
+docker compose -f litellm/deploy/compose/docker-compose.yml \
+  -f litellm/deploy/compose/docker-compose.liteadmin.yml up -d
+```
+
+Passing the same existing name with `docker compose --project-name` also works. For a new deployment, choose a stable project name and keep using it.

litellm/deploy/compose/docker-compose.liteadmin.yml

@@ -1,3 +1,5 @@
+name: ${COMPOSE_PROJECT_NAME:?Set the existing Compose project name to preserve LiteAdmin state}
+
 services:
   litellm:
     image: ${LITELLM_IMAGE:?Set the native-enabled gateway image}

litellm/deploy/compose/docker-compose.yml

@@ -1,15 +1,16 @@
 # LiteLLM plus a Postgres database that stores models, virtual keys and spend
 # logs. Used by https://docs.litellm.ai/docs/proxy/docker_quick_start
 #
-#   curl -sSLO https://github.com/BerriAI/litellm/raw/main/docker-compose.yml
+#   curl -sSLO https://github.com/BerriAI/litellm/raw/main/litellm/deploy/compose/docker-compose.yml
 #   printf 'LITELLM_MASTER_KEY=sk-%s\nLITELLM_SALT_KEY=sk-%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
-#   docker compose up -d
+#   LITELLM_ENV_FILE=.env docker compose up -d
 #
 # `docker compose up` runs the published image. From a checkout of the repo,
-# `docker compose up --build` builds the Dockerfile next to this file instead.
+# `docker compose up --build` builds from the repository root context instead.
 # `docker compose --profile monitoring up -d` also starts Prometheus on 9090.
 #
-# Compose reads .env from this directory. Keep it: regenerating LITELLM_SALT_KEY
+# The container reads the checkout-root .env, or LITELLM_ENV_FILE when set.
+# Keep it: regenerating LITELLM_SALT_KEY
 # makes credentials already stored in the database unreadable. A database
 # created without LITELLM_SALT_KEY encrypted them with the master key, so when
 # upgrading one, write only LITELLM_MASTER_KEY (the existing one) to .env. For anything
@@ -18,14 +19,15 @@ services:
   litellm:
     image: docker.litellm.ai/berriai/litellm:main-stable
     build:
-      context: .
+      context: ../../..
+      dockerfile: litellm/deploy/docker/Dockerfile
       target: runtime
     pull_policy: missing
     ports:
       - "4000:4000"
     # The same image runs every component. The first word of `command` picks
     # it: proxy (default), gateway, backend, ui, migrations, metrics,
-    # collector. See docker/README.md
+    # collector. See litellm/deploy/docker/README.md
     # command: ["--config", "/app/config.yaml"]
     # volumes:
     #   - ./config.yaml:/app/config.yaml:ro
@@ -35,7 +37,7 @@ services:
       DATABASE_URL: postgresql://llmproxy:dbpassword9090@db:5432/litellm
       STORE_MODEL_IN_DB: "True"
     env_file:
-      - path: .env
+      - path: ${LITELLM_ENV_FILE:-../../../.env}
         required: false
     read_only: true
     cap_drop:

litellm/deploy/docker/Dockerfile

@@ -99,7 +99,7 @@ RUN rm -rf litellm/proxy/_experimental/out
 COPY --from=ui-builder /ui/out/. litellm/proxy/_experimental/out/
 
 # Build Admin UI before final sync (applies the enterprise color override when present)
-RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
+RUN sed -i 's/\r$//' litellm/deploy/docker/build_admin_ui.sh && chmod +x litellm/deploy/docker/build_admin_ui.sh && ./litellm/deploy/docker/build_admin_ui.sh
 
 # Install project and workspace packages (fast - deps already cached)
 ARG MATURIN_PEP517_ARGS=""
@@ -120,7 +120,7 @@ RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/
     npm_config_cache=/root/.npm \
     prisma generate --schema=./schema.prisma
 
-RUN sed -i 's/\r$//' docker-entrypoint.sh && chmod +x docker-entrypoint.sh
+RUN sed -i 's/\r$//' litellm/deploy/docker/docker-entrypoint.sh && chmod +x litellm/deploy/docker/docker-entrypoint.sh
 
 RUN mkdir -p /var/lib/litellm/ui /var/lib/litellm/assets && \
     cp -r litellm/proxy/_experimental/out/. /var/lib/litellm/ui/ && \
@@ -178,7 +178,7 @@ ENV PATH="/app/.venv/bin:${PATH}" \
 # ship (manifest-scanning tools attribute everything in it to this image).
 COPY --from=builder /app/.venv /app/.venv
 COPY --from=liteadmin-builder /opt/liteadmin /opt/liteadmin
-COPY --from=builder /app/docker-entrypoint.sh /app/docker-entrypoint.sh
+COPY --from=builder /app/litellm/deploy/docker/docker-entrypoint.sh /app/docker-entrypoint.sh
 COPY --from=builder /app/schema.prisma /app/schema.prisma
 COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/prisma_migration.py
 # enterprise/ is imported by source path at runtime (proxy_cli puts the

litellm/deploy/docker/Dockerfile.dockerignore

@@ -54,3 +54,9 @@ litellm/rust_bridge/_native*.so
 *.log
 .env
 .env.local
+
+litellm/deploy/**
+!litellm/deploy/docker/
+litellm/deploy/docker/**
+!litellm/deploy/docker/build_admin_ui.sh
+!litellm/deploy/docker/docker-entrypoint.sh

litellm/deploy/docker/README.md

@@ -2,17 +2,29 @@
 
 This guide provides instructions for building and running the LiteLLM application using Docker and Docker Compose.
 
-> **Just want to run LiteLLM?** `docker-compose.yml` in the repository root runs
+> **Just want to run LiteLLM?** `litellm/deploy/compose/docker-compose.yml` runs
 > the published image with a Postgres database, the stack the
 > [Docker quickstart](https://docs.litellm.ai/docs/proxy/docker_quick_start) documents,
 > and it works on its own outside a checkout:
 >
 > ```bash
-> curl -sSLO https://github.com/BerriAI/litellm/raw/main/docker-compose.yml
+> curl -sSLO https://github.com/BerriAI/litellm/raw/main/litellm/deploy/compose/docker-compose.yml
 > printf 'LITELLM_MASTER_KEY=sk-%s\nLITELLM_SALT_KEY=sk-%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
-> docker compose up -d
+> LITELLM_ENV_FILE=.env docker compose up -d
 > ```
 
+## Updating an existing quickstart installation
+
+Saved quickstart scripts need a one-time URL override after the source layout migration. Run this from the installation directory to preserve its existing `.env` and database.
+
+```bash
+LITELLM_COMPOSE_URL=https://raw.githubusercontent.com/BerriAI/litellm/main/litellm/deploy/docker/docker-compose.quickstart.yml \
+LITELLM_SCRIPT_URL=https://raw.githubusercontent.com/BerriAI/litellm/main/scripts/quickstart.sh \
+litellm-gateway update
+```
+
+In PowerShell, set the same environment variables, with `LITELLM_SCRIPT_URL` ending in `scripts/quickstart.ps1`, before running `litellm-gateway update`. Remove the overrides after the saved script refreshes.
+
 ## Prerequisites
 
 - Docker
@@ -20,7 +32,7 @@ This guide provides instructions for building and running the LiteLLM applicatio
 
 ## Building and Running the Application
 
-The same `docker-compose.yml` builds from source when you pass `--build`: it builds the `Dockerfile` in the repository root, the one image LiteLLM ships. `docker-entrypoint.sh` next to it is the only entrypoint script; every container starts through it
+The same compose file builds from source when you pass `--build`. It uses `litellm/deploy/docker/Dockerfile` with the repository root as the build context. `docker-entrypoint.sh` next to it is the only entrypoint script. Every container starts through it
 
 ## One image, many components
 
@@ -51,9 +63,10 @@ The image runs as uid `65532` (`nonroot` in the Wolfi base) and also works as an
 
 ### 1. Set the Master and Salt Keys
 
-The proxy signs virtual keys with `LITELLM_MASTER_KEY` and encrypts stored provider credentials with `LITELLM_SALT_KEY`. Compose reads both from a `.env` file in the directory you run it from, so generate them once:
+From a repository checkout, first run `cd litellm/deploy/compose`. The proxy signs virtual keys with `LITELLM_MASTER_KEY` and encrypts stored provider credentials with `LITELLM_SALT_KEY`. Select the local `.env` with `LITELLM_ENV_FILE` so Compose passes both keys to the container, then generate them once:
 
 ```bash
+export LITELLM_ENV_FILE=.env
 printf 'LITELLM_MASTER_KEY=sk-%s\nLITELLM_SALT_KEY=sk-%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
 ```
 
@@ -65,7 +78,7 @@ Keep the file: regenerating `LITELLM_SALT_KEY` makes credentials already stored
 docker compose up -d --build
 ```
 
-This command builds the image from the root `Dockerfile` and starts the `litellm` and `db` services in detached mode. Without `--build`, `docker compose up` pulls the published `main-stable` image instead. Add `--profile monitoring` to also start Prometheus on port 9090, scraping the proxy with the root `prometheus.yml`
+This command builds the image and starts the `litellm` and `db` services in detached mode. Without `--build`, `docker compose up` pulls the published `main-stable` image instead. Add `--profile monitoring` to also start Prometheus on port 9090, scraping the proxy with `prometheus.yml` beside the compose file
 
 ### 3. Verifying the Application is Running
 
@@ -129,4 +142,4 @@ docker run --rm --network none --entrypoint prisma docker.litellm.ai/berriai/lit
 
 -   **`required variable LITELLM_MASTER_KEY is missing a value`**: Compose did not find a `.env` file with `LITELLM_MASTER_KEY` in the directory you ran it from. Generate one as shown above.
 -   **`password authentication failed for user "llmproxy"`**: the `litellm_postgres_data` volume was initialised by an older compose file with different credentials. `docker compose down -v` drops it and the next `up` recreates the database.
--   **`build_admin_ui.sh: not found`**: the build context is wrong. Run `docker compose` from the root of the repository.
+-   **`build_admin_ui.sh: not found`**: the build context is wrong. From a checkout, run `docker compose` in `litellm/deploy/compose`.

litellm/deploy/docker/docker-compose.quickstart.yml

@@ -2,7 +2,7 @@
 # models, virtual keys, and spend logs. Used by
 # https://docs.litellm.ai/docs/proxy/docker_quick_start
 #
-#   curl -sSLO https://github.com/BerriAI/litellm/raw/main/docker/docker-compose.quickstart.yml
+#   curl -sSLO https://github.com/BerriAI/litellm/raw/main/litellm/deploy/docker/docker-compose.quickstart.yml
 #   printf 'LITELLM_MASTER_KEY=sk-%s\nLITELLM_SALT_KEY=sk-%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
 #   docker compose -f docker-compose.quickstart.yml up -d
 #

litellm/deploy/docker/docker-compose.tracing.yml

@@ -3,7 +3,8 @@ name: litellm-tracing
 services:
   litellm:
     build:
-      context: ..
+      context: ../../..
+      dockerfile: litellm/deploy/docker/Dockerfile
       target: runtime
       args:
         LITELLM_RELEASE_TAG: ${LITELLM_RELEASE_TAG:-}

litellm/deploy/docker/docker-entrypoint.sh

@@ -100,7 +100,11 @@ os.execvp("litellm", ["litellm", *sys.argv[1:]])' "$@"
         set -- uvicorn backend.main:app --host 0.0.0.0 --port 4001 "$@"
         ;;
     ui)
-        sh "$(dirname "$0")/ui/docker-entrypoint.d/40-litellm-runtime-config.sh"
+        ui_hook="$(dirname "$0")/ui/docker-entrypoint.d/40-litellm-runtime-config.sh"
+        if [ ! -f "$ui_hook" ]; then
+            ui_hook="$(dirname "$0")/../../../ui/docker-entrypoint.d/40-litellm-runtime-config.sh"
+        fi
+        sh "$ui_hook"
         exec nginx -g 'daemon off;' "$@"
         ;;
     migrations)

litellm/deploy/helm/litellm/README.md

@@ -15,7 +15,7 @@ Kubernetes 1.25+ and Helm 3.8+. Bring your own PostgreSQL (`database.writer.*`)
 
 ```bash
 kubectl create secret generic litellm-master-key-secret --from-literal=master-key=sk-change-me
-helm install litellm helm/litellm \
+helm install litellm litellm/deploy/helm/litellm \
   --set database.writer.host=postgres.example.com \
   --set database.writer.dbname=litellm \
   --set database.writer.passwordSecret.name=litellm-db-secret
@@ -26,7 +26,7 @@ The image tag defaults to the chart's `appVersion`. Override it with `image.tag`
 ## Monolith quickstart
 
 ```bash
-helm install litellm helm/litellm \
+helm install litellm litellm/deploy/helm/litellm \
   --set monolith.enabled=true \
   --set masterKey.secretName="" \
   --set masterKey.generate=true \
@@ -70,14 +70,14 @@ backend:
 ## Testing
 
 ```bash
-helm lint helm/litellm
-helm unittest -f 'tests/*.yaml' helm/litellm
+helm lint litellm/deploy/helm/litellm
+helm unittest -f 'tests/*.yaml' litellm/deploy/helm/litellm
 helm test <release> --logs
 ```
 
 ## Migrating from the litellm-helm chart
 
-The `litellm-helm` chart (`oci://ghcr.io/berriai/litellm-helm`) is retired; its published packages stay available for a grace period. Its flat values described one monolith Deployment, so the equivalent install here is `monolith.enabled: true` with the values moved under `gateway.*`. The per-component `gateway.image`, `backend.image`, `ui.image` and `migrations.image` blocks of earlier `helm/litellm` versions are gone too: the chart is a major bump to `1.0.0` and every container uses the top-level `image`
+The `litellm-helm` chart (`oci://ghcr.io/berriai/litellm-helm`) is retired; its published packages stay available for a grace period. Its flat values described one monolith Deployment, so the equivalent install here is `monolith.enabled: true` with the values moved under `gateway.*`. The per-component `gateway.image`, `backend.image`, `ui.image` and `migrations.image` blocks of earlier `litellm/deploy/helm/litellm` versions are gone too: the chart is a major bump to `1.0.0` and every container uses the top-level `image`
 
 | litellm-helm value | litellm value |
 |---|---|

litellm/deploy/terraform/litellm/README.md

@@ -2,7 +2,7 @@
 
 Two self-contained, reusable Terraform **modules** that deploy the
 **componentized** LiteLLM proxy — the gateway, backend, and UI as three
-independent containers (see `helm/litellm/` for the canonical chart with the
+independent containers (see `litellm/deploy/helm/litellm/` for the canonical chart with the
 same split).
 
 Each module declares **no `provider` block of its own**, so it can be called
@@ -14,7 +14,7 @@ by source:
 
 ```hcl
 module "litellm" {
-  source = "github.com/BerriAI/litellm//terraform/litellm/aws?ref=<tag>"
+  source = "github.com/BerriAI/litellm//litellm/deploy/terraform/litellm/aws?ref=<tag>"
   # ... inputs ...
 }
 ```
@@ -26,7 +26,7 @@ module "litellm" {
 
 Each stack creates its own VPC and managed data stores — from
 `<stack>/examples/default/`, drop in a tfvars file and run `terraform apply`.
-Both stacks support a typed `proxy_config` input (mirrors `helm/litellm`'s
+Both stacks support a typed `proxy_config` input (mirrors `litellm/deploy/helm/litellm`'s
 `gateway.config.proxy_config`) and per-component extra env vars /
 secret-manager refs.
 
@@ -52,7 +52,7 @@ everything else to the backend.
 
 ## Architecture
 
-### AWS (`terraform/litellm/aws/`)
+### AWS (`litellm/deploy/terraform/litellm/aws/`)
 
 ```
                         ┌───────────────────────────────────────┐
@@ -97,7 +97,7 @@ everything else to the backend.
                     egress to LLM providers
 ```
 
-### GCP (`terraform/litellm/gcp/`)
+### GCP (`litellm/deploy/terraform/litellm/gcp/`)
 
 ```
                         ┌───────────────────────────────────────┐
@@ -238,11 +238,11 @@ dynamic-credentials OIDC).
 
 Required overrides the launcher must supply per stack:
 
-- **AWS** (`terraform/litellm/aws`): `region`, `azs`, `tenant`, `env`.
+- **AWS** (`litellm/deploy/terraform/litellm/aws`): `region`, `azs`, `tenant`, `env`.
   `image` can be left at its default: the GHCR image is
   anonymous-readable and ECS Fargate pulls it without extra credentials.
 
-- **GCP** (`terraform/litellm/gcp`): `project`, `tenant`, `env`, **and
+- **GCP** (`litellm/deploy/terraform/litellm/gcp`): `project`, `tenant`, `env`, **and
   one of**:
   - `image_registry` pointed at an Artifact Registry **remote** repository
     backed by `https://ghcr.io` (e.g.
@@ -254,7 +254,7 @@ Required overrides the launcher must supply per stack:
   The defaults (`ghcr.io/berriai`) cause Cloud Run admission to reject
   the service spec — Cloud Run only authenticates against Artifact
   Registry, `[region.]gcr.io`, or `docker.io`. See
-  `terraform/litellm/gcp/README.md#image-pulls` for the
+  `litellm/deploy/terraform/litellm/gcp/README.md#image-pulls` for the
   `gcloud artifacts repositories create … --mode=remote-repository`
   command that sets up the passthrough repo (one-time, per project).
 

litellm/deploy/terraform/litellm/aws/README.md

@@ -391,7 +391,7 @@ For a per-tenant instance via the example root, the only inputs that
 change are the tenant slug, env, and the two pre-issued secrets:
 
 ```bash
-cd terraform/litellm/aws/examples/default
+cd litellm/deploy/terraform/litellm/aws/examples/default
 export TF_VAR_litellm_master_key="sk-..."   # the tenant's master key
 export TF_VAR_litellm_license="lic-..."     # their LITELLM_LICENSE
 
@@ -408,7 +408,7 @@ To run *many* tenants from a single config, call the module with
 ```hcl
 module "litellm" {
   for_each = toset(["acme", "globex"])
-  source    = "github.com/BerriAI/litellm//terraform/litellm/aws?ref=<tag>"
+  source    = "github.com/BerriAI/litellm//litellm/deploy/terraform/litellm/aws?ref=<tag>"
   image_tag = "<litellm release tag>"
   tenant    = each.key
   env      = "prod"
@@ -432,7 +432,7 @@ example files.
 ## Quick start
 
 ```bash
-cd terraform/litellm/aws/examples/default
+cd litellm/deploy/terraform/litellm/aws/examples/default
 cp terraform.tfvars.example terraform.tfvars
 # Edit: region, tenant, env, azs, proxy_config, gateway_extra_secrets.
 
@@ -473,7 +473,7 @@ provider "aws" {
 }
 
 module "litellm" {
-  source = "github.com/BerriAI/litellm//terraform/litellm/aws?ref=<tag>"
+  source = "github.com/BerriAI/litellm//litellm/deploy/terraform/litellm/aws?ref=<tag>"
 
   image_tag = "<litellm release tag>" # a git ref ships no image default, a registry version does
 

litellm/deploy/terraform/litellm/aws/autoscaling.tf

@@ -1,5 +1,5 @@
 # Application Auto Scaling for the three ECS services. Mirrors the HPA values
-# baked into the helm chart at helm/litellm/values.yaml:
+# baked into the helm chart at litellm/deploy/helm/litellm/values.yaml:
 #
 #   gateway: 1-10 replicas, target 70% CPU + 80% memory
 #   backend: 1-4 replicas,  target 70% CPU