feat: Publish a proxy-only image and support a remote upstream

[harshaneel]

Summary

• New :proxy image variant, 41 MB. Alpine plus pdftoppm plus the Go binary, with no inference engine and no model. For anyone who already runs an OpenAI-compatible server and wants only the translation layer instead of pulling 3.16 GB and running a second model they will never call. Added as a middle Dockerfile stage so the llama.cpp stage stays last and a bare docker build . keeps producing the full image.
• Configuration by environment. LK_UPSTREAM and LK_UPSTREAM_AUTH_HEADER, with flag beating environment beating default, so the existing entrypoint keeps working unchanged. LK_UPSTREAM_AUTH_HEADER takes a complete header line (Authorization: Bearer abc123) rather than a bare token, which covers Bearer, llama.cpp's --api-key, and custom schemes without the proxy needing to know which is in use.
• Upstream credential injected once, in the transport. All six upstream call sites already flow through one http.Client, so a RoundTripper wrapper covers every route including streaming and cannot be forgotten when a seventh path is added. Credentials that clients send to localaik are still stripped and never forwarded; the two properties are asserted together across 11 routes.
• Published from CI as proxy and vX.Y.Z-proxy, never latest. Anyone pulling latest today gets a self-contained container, and silently turning that into one requiring an external server would break them. The existing gemma3-4b and gemma3-12b entries are unchanged apart from an added empty target, which docker/build-push-action omits when falsy.

Security fix found during review

Three independent pre-PR reviews ran over this branch. Two of them separately reproduced a credential-exfiltration path in the first version of the transport, which is fixed in d28e31d:

RoundTrip set the header on every request it saw. An http.Client re-enters its RoundTripper for each redirect hop, and the standard library strips Authorization only from the request it built itself, so setting the header per-request re-added it after that strip. A 302 from the upstream handed the credential to whatever host the Location named, over cleartext by default.

The fix pins the header to the configured upstream hostname, and the credentialed client no longer follows redirects at all, since a followed redirect would also send prompt content to the target. Redirect handling stays at the standard library default when no credential is configured, so the model-bundled images are unaffected. A follow-up review confirmed the fix holds under adversarial probing (redirect chains, case and trailing-dot hostname variants, port and scheme changes, IPv6 literals, userinfo spoofing) and that each of the three new tests fails when the specific change it pins is reverted.

One residual note is recorded in a comment at the CheckRedirect site: the pin is on hostname only, so relaxing redirect handling later would reopen cross-port and scheme-downgrade leakage.

Reviewer-flagged follow-ups, deliberately not in this PR

• The proxy image runs as root with no USER directive.
• entrypoint.sh has a pre-existing bug, present on main and untouched here: a hardcoded 120s model-load timeout whose cleanup() then blocks forever in wait, because the kill does not terminate llama-server. Under host load the container wedges with llama.cpp healthy on 8080 and nothing listening on 8090.
• integration/proxy_image_test.go builds an image inside the test and hardcodes its container name and host port, so two concurrent local runs collide.

Test Plan

• make lint clean.
• go test ./cmd/... ./internal/... all pass.
• go test -tags=docker_integration ./integration -run ProxyImage passes: the built proxy image round-trips an OpenAI, a Gemini and an Anthropic request, and renders a PDF to PNG using alpine's poppler-utils.
• The default image still builds and serves {"status":"ok"}, confirming the added stage did not displace the llama.cpp stage.
• git diff main -- Dockerfile is the inserted stage only.
• The credential never appears in container output: docker run -e LK_UPSTREAM_AUTH_HEADER=... 2>&1 | grep -c <sentinel> returns 0, for both the sentinel and Bearer.
• Redirect behaviour: a redirect target on a different host receives no credential, the credentialed client surfaces the 3xx rather than following it, and a client with no credential still follows redirects.
• Header validation is exercised at the predicate rather than only through a capturing transport, since a capturing transport bypasses Go's wire-level checks. Values containing further colons (Bearer a:b) are accepted; names and values that net/http would reject at the wire are rejected at startup instead.

To try it:

docker build --target proxy -t localaik:proxy .
docker run -d -p 127.0.0.1:8090:8090 \
  -e LK_UPSTREAM=http://your-server:8080/v1 \
  -e LK_UPSTREAM_AUTH_HEADER="Authorization: Bearer your-key" \
  localaik:proxy
curl -s http://127.0.0.1:8090/health

/health returns 503 until the configured upstream answers, 200 once it does.

⚠️ :proxy has a different risk profile from the bundled tags: it is a network hop into infrastructure you care about, and localaik authenticates none of its own callers by design. Anyone who can reach the port can drive your model server. Bind to localhost and do not publish it on a shared network.

🤖 Generated with Claude Code