Member Portal — membership middleware for the Inference Cooperative

Reconciles three systems into one membership lifecycle:

System	Role	Source of truth for
Open Collective	Billing	Who is a paying member
Cloudron	Identity/SSO	Who can log in
LiteLLM	Inference	Who can use models, and how much

Architecture

Open Collective (billing)
        │ webhook
        ▼
┌─────────────────────────────┐
│  Member Portal (this app)   │
│  - OC webhook handler       │
│  - Cloudron user management │
│  - LiteLLM key management   │
│  - key-injection proxy      │
└─────────────────────────────┘
        ▲
        │ X-User-Email header (LibreChat forwards identity)
        │
LibreChat ──→ Member Portal ──→ LiteLLM ──→ backend

The three responsibilities

Webhook handler (POST /webhook/opencollective) — listens for Open Collective membership events and activates/deactivates members.
Key injector (/v1/*) — reads the member's email from the X-User-Email header, looks up their LiteLLM key, and forwards the request to the gateway with that key.
Admin (/health, /) — health and status.

Configuration (environment variables)

Variable	Purpose
`CLOUDRON_API`	Cloudron API origin (auto-set by Cloudron)
`CLOUDRON_TOKEN`	Cloudron API token (Read+Write)
`MEMBERS_GROUP_ID`	Cloudron group ID for members (grants chat access)
`LITELLM_BASE`	LiteLLM gateway URL
`LITELLM_MASTER_KEY`	LiteLLM master key
`OPENCOLLECTIVE_WEBHOOK_SECRET`	Optional webhook signature secret

Tier budgets

Governance decision (set in Loomio). Defaults:

free — $2/month of tokens
member — $15/month
supporter — $30/month

LibreChat wiring

Point LibreChat's custom endpoint at this portal (not directly at LiteLLM), and add the identity header:

endpoints:
  custom:
    - name: "Inference Cooperative"
      apiKey: "${LITELLM_KEY}"
      baseURL: "https://portal.inference.coop/v1"
      headers:
        X-User-Email: "{{LIBRECHAT_USER_EMAIL}}"
      models:
        default: ["deepseek-v4-flash", "gpt-oss-120b"]
        fetch: true

Status

Scaffold — the three handlers are stubbed with the correct integration points. Remaining work before production:

Verify Open Collective webhook event names + payload shape → order.processed (every payment), new member (first only), firstPayment flag
Verify Cloudron user-creation API payload (role/group assignment) → POST /api/v1/users with {username, email, displayName, role, active} → group assignment via PUT /api/v1/users/:userId/groups with {groupIds: [...]}
Add a persistent store (SQLite) for email→key mapping → key/list returns token strings (not objects), so we store email→token locally
Verify LiteLLM key/generate + key/list payload shapes against live gateway → key/generate returns {key: "sk-..."}; key/list returns {keys: ["<token>", ...]}
Add HMAC signature verification for the OC webhook (if OC supports it)
Wire the OIDC addon for admin access

Scheduled tasks (scheduler addon)

Two jobs run inside the container via CloudronManifest.json → addons.scheduler:

membership_sweep (nightly 3am) — sweep.sh calls the portal's own /admin/sweep (auth: X-Admin-Token = WEBHOOK_TOKEN) to reconcile members against the live Open Collective list: provisions missed signups, deactivates lapsed members, syncs Loomio + Matrix. Idempotent; a missed webhook self-heals within 24 hours.
rag_refresh (nightly 3:30am) — rag_refresh.py pulls this repo's sibling docs from the Gitea raw API (public, no credentials), uploads changed files to Open WebUI (OWUI_API_KEY), attaches them to the shared knowledge collection (DOCS_KNOWLEDGE_ID), reindexes, and re-grants the members group. State persists in /app/data/rag_refresh_state.json.

Verify after any manifest change: the deploy log must show setupAddons: ... scheduler ... listing both tasks, and each script must succeed when run manually inside the container.

4.3 KiB Raw Blame History