Switch to Tinfoil (TEE): add tinfoil-proxy sidecar for EHBP encryption, point LiteLLM at local proxy

config.yaml

@@ -1,22 +1,24 @@
 # LiteLLM config for inference.coop
-# TEST config: Ollama Cloud (existing subscription) — plumbing smoke test
-# Uses Ollama Cloud's OpenAI-compatible endpoint (/v1) via LiteLLM's openai/ provider.
-# Provider key set via environment variable OLLAMA_API_KEY.
+# PRODUCTION config: Tinfoil (TEE-protected inference)
+# LiteLLM talks plaintext OpenAI to a local Tinfoil proxy (127.0.0.1:3301),
+# which verifies the enclave attestation and encrypts request/response bodies
+# with EHBP (HPKE) before forwarding to the Tinfoil enclave. Provider key set
+# via environment variable TINFOIL_API_KEY.
 
 model_list:
-  # DeepSeek V4 Flash — default model
+  # DeepSeek V4 Flash — default model (1M context, tool calling)
   - model_name: deepseek-v4-flash
     litellm_params:
-      model: openai/deepseek-v4-flash:0731
-      api_base: https://ollama.com/v1
-      api_key: os.environ/OLLAMA_API_KEY
+      model: openai/deepseek-v4-flash
+      api_base: http://127.0.0.1:3301/v1
+      api_key: os.environ/TINFOIL_API_KEY
 
   # GPT-OSS 120B — lightweight fallback
   - model_name: gpt-oss-120b
     litellm_params:
-      model: openai/gpt-oss:120b
-      api_base: https://ollama.com/v1
-      api_key: os.environ/OLLAMA_API_KEY
+      model: openai/gpt-oss-120b
+      api_base: http://127.0.0.1:3301/v1
+      api_key: os.environ/TINFOIL_API_KEY
 
 # Fallback: if DeepSeek is down, use GPT-OSS
 router_settings: