LLM providers

The same agent runs on local Ollama (default model qwen3.6:latest) or on Anthropic, OpenAI, Gemini, vLLM or a LiteLLM gateway.

Deployment defaults, then yours

The operator sets defaults and guards in the environment: LLM_PROVIDER, LLM_MODEL, OLLAMA_BASE_URL, *_API_KEY, LLM_REQUEST_LIMIT, AGENT_RUN_MAX_TOKENS and EMBEDDING_*.

Settings → LLM is personal. Every signed-in user (an anonymous user when auth is disabled) picks their own default provider and model, stores their own Anthropic / OpenAI / Gemini / Ollama / vLLM keys (bring your own key, encrypted at rest, write-only), points Ollama or vLLM at their own server, and tunes the context window, the per-run token budget and the maximum number of model requests per run. The environment values are only the defaults.

• A personal key wins over a shared one and is only used for that user's jobs, chats and embeddings.
• Nothing of the deployment's configuration is shown to users.
• A personal Ollama / vLLM URL must be a public address (same SSRF policy as pull-by-URL, see URL_FETCH_ALLOWED_HOSTS).
• A job can pin its own provider and model at creation (provider + model form fields, or llm_provider / llm_model on the MCP submit_* tools).

OIDC-authenticated gateway (LiteLLM) and credit wallet

Set OIDC_GATEWAY_RESOURCE and LITELLM_BASE_URL to offer the litellm provider. Calls then carry the user's own access token (audience = the gateway), minted from a per-user server-side grant, so the gateway identifies and bills that user — no API key needed.

• Every job, chat turn and MCP / A2A call has an initiator. The MCP tools submit_binary, submit_compare and ask_about_job require an authenticated caller, and a gateway run is refused up front with a stable code (llm_grant_required, insufficient_credit, …) when it cannot be served.
• The user must have signed in to RE:GINE at least once; the grant survives logout while a job is running, then is revoked.
• With OIDC_WALLET_RESOURCE + WALLET_API_URL, RE:GINE reads the user's credit from the identity provider and blocks runs when it is exhausted.

The OIDC login requests every audience it may need (OIDC_AUDIENCE, the gateway, the wallet), so the application must list them in the identity provider. With Auth Service: the RE:GINE application is confidential, has url = OIDC_AUDIENCE, lists the gateway URL and the Auth Service URL in allowedResources, allows the offline_access, roles, permissions, features, org and wallet:self:read scopes, and defines the admin and superadmin roles.