[{"data":1,"prerenderedAt":201},["ShallowReactive",2],{"seo-verification":3,"blog-self-host-litellm-on-a-vps-your-private-llm-api-gateway-ma-en":6,"promo-bar-likely":200},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-self-host-litellm-on-a-vps-your-private-llm-api-gateway-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":133,"ctaBody":134,"ctaButton":135,"ctaUrl":136,"relatedPosts":137},156,"self-host-litellm-on-a-vps-your-private-llm-api-gateway",{"fr":12,"en":10,"ar":13,"es":14},"self-host-litellm-vps","استضف-litellm-ذاتيا-على-vps-بوابة-api-خاصة-لنماذج-llm","alojar-litellm-en-un-vps-pasarela-llm-privada","Self-Host LiteLLM on a VPS: Your Private LLM API Gateway","Deploy LiteLLM on a ServOrbit VPS — a self-hosted, OpenAI-compatible gateway to Ollama, Anthropic, Azure and 100+ LLM providers, with spend tracking and rate limits.",9,3,false,"2026-01-21T00:00:00+00:00","2026-11-09T20:55:12+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-litellm-vps-poster.svg",{"categorySlug":34,"appSlug":35},"artificial-intelligence","litellm","Your application calls one endpoint. LiteLLM decides which model handles the request — your local Ollama, Anthropic Claude, GPT-4, or any of 100+ other providers. It speaks OpenAI's API so no SDK change is ever needed. Self-hosted on a VPS, it adds rate limiting, budget caps per API key, and a built-in analytics dashboard — so you can give multiple teams access to AI without worrying about runaway costs.",[38,42,52,55,83,86,101,104,112,115,124,128,130],{"type":39,"title":40,"body":41},"h2","Why LiteLLM is the missing layer for self-hosted AI stacks","Ollama is great for running local models. Open WebUI wraps it in a chat interface. But the moment you start building applications — not just chatting — you need something in between: a proxy that normalises the API surface, tracks costs per project, and lets you swap models without touching app code. That is exactly what LiteLLM does. It sits between your application and any LLM backend, exposing a single OpenAI-compatible endpoint. Your code stays the same whether you route to Llama 3.1 on Ollama, Claude 3.5 Haiku, or GPT-4o.",{"type":43,"title":44,"items":45},"ul","What LiteLLM gives you out of the box",[46,47,48,49,50,51],"Unified OpenAI-compatible API — works with every SDK, library and tool that targets the OpenAI API.","100+ provider integrations: Ollama, Anthropic, OpenAI, Azure OpenAI, Mistral, Cohere, Bedrock and more.","Virtual API keys with per-key spend limits and rate limits — issue keys to teams and cap monthly costs.","Built-in dashboard at \u002Fui with real-time spend analytics, per-model breakdowns and request logs.","Load balancing and automatic failover across multiple provider endpoints or model replicas.","Apache 2.0 licence — no telemetry, no phoning home, fully air-gap capable when paired with Ollama.",{"type":39,"title":53,"body":54},"Requirements","At least 1 GB of RAM and Ubuntu 22.04. Docker and the Compose plugin installed. Port 4000 open, or a Caddy\u002FNginx reverse proxy for HTTPS. That is everything — LiteLLM itself is a Python proxy and needs around 256 MB; PostgreSQL takes most of the remaining RAM budget. For teams with concurrent traffic, 2 GB is more comfortable.",{"type":56,"title":57,"steps":58},"steps","Deploy LiteLLM on a VPS",[59,62,65,68,71,74,77,80],{"title":60,"body":61},"Provision the VPS","Order a VPS Solo (2 vCPU, 4 GB, Ubuntu 22.04): LiteLLM needs only 1 GB, and the smallest plan in the catalogue serves twice that. SSH in and install Docker: `curl -fsSL https:\u002F\u002Fget.docker.com | sh`. The Compose plugin is included.",{"title":63,"body":64},"Generate secrets","Run `openssl rand -hex 32` to generate LITELLM_MASTER_KEY — this unlocks the dashboard and all admin API endpoints. Create `\u002Fopt\u002Flitellm\u002F.env` with: `LITELLM_MASTER_KEY`, `UI_USERNAME`, `UI_PASSWORD`, `DB_NAME=litellm`, `DB_USER=litellm`, `DB_PASSWORD=\u003Cstrong-password>`.",{"title":66,"body":67},"Write docker-compose.yml","Create `\u002Fopt\u002Flitellm\u002Fdocker-compose.yml` with two services: `db` (postgres:16-alpine, env vars from .env, volume litellm_db) and `litellm` (image ghcr.io\u002Fberriai\u002Flitellm pinned to an explicit version and its `@sha256:` digest, never `main-latest` — see \"Supply chain\" below —, port 4000:4000, depends_on db, DATABASE_URL + LITELLM_MASTER_KEY + UI_USERNAME + UI_PASSWORD, volume litellm_config:\u002Fapp\u002Fdata). Run `docker compose up -d`.",{"title":69,"body":70},"Open the dashboard","Navigate to `http:\u002F\u002F\u003Cvps-ip>:4000\u002Fui` and log in with your UI_USERNAME \u002F UI_PASSWORD. You will land on the LiteLLM dashboard. Go to Models to add your first provider. For a local Ollama instance on the same VPS, set model name to `ollama\u002Fllama3.1` and API base to `http:\u002F\u002Fhost.docker.internal:11434`. For Anthropic, paste your API key and add `anthropic\u002Fclaude-3-5-haiku-20241022`.",{"title":72,"body":73},"Test the gateway","From your workstation, test: `curl http:\u002F\u002F\u003Cvps-ip>:4000\u002Fv1\u002Fchat\u002Fcompletions -H \"Authorization: Bearer \u003CLITELLM_MASTER_KEY>\" -H 'Content-Type: application\u002Fjson' -d '{\"model\": \"ollama\u002Fllama3.1\", \"messages\": [{\"role\": \"user\", \"content\": \"Hello\"}]}'`. You should get a streamed response back — routed through LiteLLM to your Ollama.",{"title":75,"body":76},"Issue team API keys","In the dashboard under API Keys, click New Key. Give it a description (e.g. 'frontend-team'), set `max_budget: 50` (USD\u002Fmonth) and an optional `tpm_limit`. Share this key with the team — they point their OpenAI SDK at `http:\u002F\u002F\u003Cvps-ip>:4000` and use this key. Spend is tracked per key in the dashboard.",{"title":78,"body":79},"Add HTTPS with Caddy","Install Caddy: `apt install -y caddy`. Edit `\u002Fetc\u002Fcaddy\u002FCaddyfile`: `llm.yourdomain.com { reverse_proxy localhost:4000 }`. Reload: `systemctl reload caddy`. Close port 4000 in your firewall — all traffic now flows through 443 with automatic TLS.",{"title":81,"body":82},"Logging in for the first time","Open the admin interface at \u002Fui: LiteLLM displays a username\u002Fpassword form. Enter admin and the password provided, then create your virtual keys from the dashboard.",{"type":39,"title":84,"body":85},"Supply chain: pin, verify, rotate keys","An LLM gateway holds the keys of all your providers, which is exactly what a credential stealer is after. The report thread opened on the LiteLLM repository (issue 47826) states that the version 1.107.0 wheels published on PyPI carried three files foreign to the project, `cook.pth`, `cook.py` and `sitecustomize.py`, dropped at the root of `site-packages`: a credential stealer and a code-execution loader, started on every Python launch. PyPI quarantined that version. The maintainers say they removed the malicious Docker images, and their incident write-up describes a hijack of their release pipeline using developer tokens. The original report said it had not inspected the images; a later update in the same thread found the three files in the main image it checked and recommends treating every image of that version as compromised. This guide cannot know what you pulled on a given day: the four checks below settle it on your own host.",{"type":56,"title":87,"steps":88},"Know what is really running on your host",[89,92,95,98],{"title":90,"body":91},"Read the image digest","A tag such as `main-latest` says nothing about what executes. Run `docker compose images` then `docker image inspect --format '{{index .RepoDigests 0}}' ghcr.io\u002Fberriai\u002Flitellm:main-latest` (replace it with the reference from your compose file). Note the `sha256:` you get and compare it with the one of a version whose provenance you have verified.",{"title":93,"body":94},"Look for the named files, without starting Python","In a suspect environment every Python start replays the malicious code, `pip` included. Search with a tool that does not launch it: `docker compose exec litellm find \u002F -name 'cook.pth' -o -name 'cook.py' -o -name 'sitecustomize.py' -o -name 'litellm-1.107.0.dist-info' 2>\u002Fdev\u002Fnull` (if the image ships `find`). A lone `sitecustomize.py` elsewhere on the system can be legitimate; what should alarm you is a `cook.pth` beside it in `site-packages`, or a `litellm-1.107.0.dist-info` folder. Finding these files confirms exposure; finding nothing does not prove the environment is clean.",{"title":96,"body":97},"Read the installed version","Once nothing looks suspicious, `pip show litellm` (inside the virtualenv of a direct install) or `docker compose exec litellm pip show litellm` reports the version. If it is 1.107.0, or if you doubt an image pulled around that time, go straight to key rotation below.",{"title":99,"body":100},"Look for execution traces","The report lists a lock file `\u002Ftmp\u002Fremote_code_loader.lock`, an orphaned `python` process whose working directory is `\u002F`, and a marker file `\u002Ftmp\u002F.pc_once_*` written only after a successful upload. Its absence proves nothing: a recreated container wipes `\u002Ftmp`. Use it as a hint, not a verdict.",{"type":39,"title":102,"body":103},"Pin by digest rather than by tag","A tag is a pointer the publisher can move; the `@sha256:` digest names exact bytes. In your `docker-compose.yml`, write `image: ghcr.io\u002Fberriai\u002Flitellm:\u003Cversion>@sha256:\u003Cdigest>` with an explicit version published before the incident or verified since, never `latest`, `main-latest` or `main-stable`. The maintainers recommend pinning an explicit version, and the issue thread advises the digest. Keep the limit in mind: a digest proves you always pull the same bytes, not who built them. The 1.107.0 images could have been pinned without any alarm. Pinning therefore freezes a decision you made; it does not replace making it.",{"type":43,"title":105,"items":106},"Update without surprises",[107,108,109,110,111],"Read the release notes and the security thread before changing version, instead of letting `docker compose pull` follow a tag.","Fetch the new digest from a test machine, start the gateway without real keys, check its behaviour, and only then carry the digest to production.","When the publisher ships provenance attestations, verify them: they say where an image comes from, which a bare digest does not.","Keep the previous digest in your configuration repository: rolling back becomes a one-line change.","After any security alert, rebuild containers and virtual environments from scratch rather than cleaning in place.",{"type":39,"title":113,"body":114},"If 1.107.0 ever ran on your host: rotate every key","According to the report, if that version started on a host that reaches the Internet, assume the upload succeeded. The code it describes reads the environment variables of readable processes and, when `DATABASE_URL` is set, extracts the tables where the gateway stores its providers' credentials and models, that is every upstream key it holds. The rotation therefore covers every secret the host could reach, not only the master key. Revoke at the provider first, then generate the replacement key, then review the last month of consumption for usage you do not recognise.",{"type":43,"title":116,"items":117},"What to renew",[118,119,120,121,122,123],"Every provider key stored in the gateway: Anthropic, OpenAI, Azure, Mistral, Bedrock and each of the others.","`LITELLM_MASTER_KEY` and every virtual key handed to teams.","The database password (`DB_PASSWORD` and the `DATABASE_URL` that embeds it), as well as `UI_PASSWORD`.","Any secret in the environment of a process on the host: API tokens, passwords of neighbouring services, `.env` files.","The SSH keys, Git tokens and cloud credentials reachable from the VPS, if the host carried any.","After rotation, rebuild the VPS or at least the containers from a verified image: copying fresh secrets into a compromised host exposes them again.",{"type":125,"title":126,"body":127},"tip","Watch outbound traffic","The report describes an upload to `www.litellm.dev`, a domain that is not the project's own, and an hourly read of a third-party GitHub repository used as a mailbox for new instructions. The maintainers themselves judge that a network-level restriction is the one that counts, since malicious code ignores application configuration. On a VPS, deny outbound traffic by default and allow only your providers' endpoints; if your firewall filters by address rather than by name, put an outbound proxy with an allowlist in front. Failing that, log the host's DNS lookups and alert on any name the gateway has no reason to call.",{"type":125,"body":129},"Pair LiteLLM with Ollama on the same VPS for a fully air-gapped AI stack. Ollama handles model inference; LiteLLM adds the gateway layer — routing, rate limiting and usage tracking. For privacy-sensitive workloads (legal, finance, medical), this means zero data leaves your infrastructure.",{"type":125,"title":131,"body":132},"The official documentation","For advanced configuration and options specific to the tool, refer to the \u003Ca href=\"https:\u002F\u002Fdocs.litellm.ai\" target=\"_blank\" rel=\"noopener noreferrer\">official LiteLLM documentation\u003C\u002Fa>. This guide covers going live on a VPS; the vendor's documentation remains the reference for fine-tuning, major updates and specific use cases.","Deploy your private LLM gateway","Self-host LiteLLM on a ServOrbit VPS — route between Ollama, Anthropic and 100+ providers from a single OpenAI-compatible endpoint, with per-key budget controls.","Deploy LiteLLM","\u002Fapplications\u002Fartificial-intelligence\u002Flitellm",[138,160,178],{"id":139,"slug":140,"slugs":141,"title":145,"excerpt":146,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":147,"updatedAt":148,"category":149,"categories":155,"featuredImage":30,"bgImage":31,"posterImage":157,"relatedSolution":158},11,"how-to-host-ollama-on-a-vps",{"fr":142,"en":140,"ar":143,"es":144},"heberger-ollama-vps","كيفية-استضافة-ollama-على-خادم-vps","como-alojar-ollama-en-un-vps","Hosting Ollama on a VPS: advanced operational guide","Advanced Ollama VPS setup: model management, nginx reverse proxy, API security, Q4_K_M\u002FQ8 quantization, CVE-2026-45672 Open WebUI and secure coupling.","2026-06-09T00:00:00+00:00","2026-11-04T16:30:24+00:00",{"id":150,"name":151,"slug":152,"color":153,"icon":154},1,"Artificial Intelligence","intelligence-artificielle","bg-purple-500\u002F10 text-purple-400","ia",[156],{"id":150,"name":151,"slug":152,"color":153,"icon":154},"\u002Fblog\u002Fcovers\u002Fheberger-ollama-vps-poster.svg",{"categorySlug":34,"appSlug":159},"ollama",{"id":161,"slug":162,"slugs":163,"title":167,"excerpt":168,"readTime":169,"views":150,"isPinned":19,"noindex":19,"publishedAt":170,"updatedAt":171,"category":172,"categories":173,"featuredImage":30,"bgImage":31,"posterImage":175,"relatedSolution":176},2,"deploying-dify-on-a-vps-ai-workflows-under-control",{"fr":164,"en":162,"ar":165,"es":166},"deployer-dify-vps","نشر-dify-على-vps-سير-عمل-الذكاء-الاصطناعي-تحت-السيطرة","desplegar-dify-en-un-vps","Deploy Dify on a VPS: Complete Guide from Installation to Plugins","Install Dify on a ServOrbit VPS: requirements, Docker Compose, offline plugins, known Docker limits, backup before upgrading, and troubleshooting.",15,"2026-02-11T00:00:00+00:00","2026-10-29T03:10:23+00:00",{"id":150,"name":151,"slug":152,"color":153,"icon":154},[174],{"id":150,"name":151,"slug":152,"color":153,"icon":154},"\u002Fblog\u002Fcovers\u002Fdeployer-dify-vps-poster.svg",{"categorySlug":152,"appSlug":177},"dify",{"id":18,"slug":179,"slugs":180,"title":184,"excerpt":185,"readTime":186,"views":187,"isPinned":19,"noindex":19,"publishedAt":188,"updatedAt":189,"category":190,"categories":194,"featuredImage":30,"bgImage":31,"posterImage":196,"relatedSolution":197},"install-n8n-on-vps-with-docker-complete-2026-guide",{"fr":181,"en":179,"ar":182,"es":183},"installer-n8n-vps","تثبيت-n8n-على-vps-مع-docker-دليل-شامل-2026","instalar-n8n-en-vps-con-docker","Install n8n on VPS with Docker: complete 2026 guide","Deploy n8n on VPS with Docker, reverse proxy and HTTPS. Covers V8 crash, 502 nginx, npm migration and execution security (GHSA-vrv8-j27g-g7cr advisory, August 2026).",19,4,"2026-06-05T00:00:00+00:00","2026-11-09T20:55:18+00:00",{"id":161,"name":191,"slug":192,"color":193,"icon":192},"Automation","automatisation","bg-brand-action\u002F10 text-brand-action",[195],{"id":161,"name":191,"slug":192,"color":193,"icon":192},"\u002Fblog\u002Fcovers\u002Finstaller-n8n-vps-poster.svg",{"categorySlug":198,"appSlug":199},"automation-workflows","n8n",true,1794270489454]