Architecture
ZeaLLM splits control plane and data plane. The portal writes configuration and keys to Postgres. The gateway reads that configuration (cached in memory, invalidated over Redis) and enforces it on every request.
Data plane — gateway
Every /v1/… call is authenticated, budget-checked and rate-limited before a provider token is spent. Responses stream back over SSE while spend is recorded off the hot path.
See Gateway request lifecycle and error codes.
Control plane — portal
The portal is invite-only. Sign-in is Microsoft Entra ID in production, or a password-less form when AUTH_DEV_BYPASS=true and NODE_ENV is not production. Production builds ignore the bypass flag. Bootstrap admins listed in ZEALLM_ADMIN_EMAILS are auto-provisioned as platform ADMIN.
Portal mutations write to Postgres. The gateway picks them up via Redis pub/sub invalidation, with an in-memory TTL fallback if Redis is down.
Shared state
| Store | Used for |
|---|---|
| Postgres | Users, keys (hashed), credentials, deployments, budgets, spend logs, audit |
| Redis | Shared rate-limit counters and instant cache invalidation |
| Azure Key Vault (optional) | Provider secrets and the master encryption key (akv:<secret-name>) |
What ships in the box
| Piece | Role |
|---|---|
| Gateway | Enforces keys, budgets, limits and guardrails on every LLM call |
| Portal | Admin and developer UI |
| Documentation | This site |
| Postgres + Redis | Shared database and cache |