build: Check in some dev server files

[grahamking]

• README explaining it all
• switchyard-server TOML config
• systemd unit

Later we'll want some automation.

Signed-off-by: Graham King grahamk@nvidia.com

Summary by CodeRabbit

• New Features

  • Added a development server configuration with multiple AI model targets, routing strategies, capability-based selection, and session affinity.
  • Added a system service configuration for secure HTTPS operation, automatic restarts, and startup at boot.

• Documentation

  • Added setup and operations guidance covering endpoints, backend routes, access controls, deployment, configuration, logging, updates, and TLS certificate management.

[coderabbitai]

Walkthrough

Adds a Switchyard development-server configuration, a hardened systemd service for TLS deployment, and documentation for setup, operation, updates, logging, and certificate regeneration.

Changes

Development server deployment

Layer / File(s)	Summary
Model clients and routing configuration dev-server/config.toml	Adds Inference Hub and Anthropic-compatible clients, model targets, staged routing, and capability-based classification.
Hardened systemd deployment dev-server/switchyard.service	Adds TLS startup settings, restart behavior, API-key environment configuration, port-binding capability, and privilege restrictions.
Operational setup and maintenance dev-server/README	Documents endpoints, installation files, systemd commands, binary updates, configuration deployment, logging, and TLS certificate regeneration.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

I’m a rabbit with configs tucked tight,
Routing models through day and night.
TLS keys shine, services start,
Logs and updates map each part.
Hop, hop—the server plays its part!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies the addition of development server files, which is the main change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@dev-server/README`:
- Line 27: Update the README references around the systemd setup to distinguish
the systemd unit at /etc/systemd/system/switchyard.service from the server
configuration file. Use config.toml consistently, including the copy
instruction, and reference the deployed /etc/switchyard/config.toml path rather
than switchyard.toml.
- Around line 5-10: Remove switchyard/noop from the Inference Hub endpoint list
in the README and describe it separately as a local noop route without a
provider target. Keep the provider-backed routes and their listed model mappings
unchanged.
- Around line 42-49: Update the installation instructions following the binary
copy command in the README to restart the switchyard service with sudo systemctl
restart switchyard, then verify it with sudo systemctl status switchyard.
- Around line 60-61: Update the TLS regeneration commands in the README to write
key.pem and cert.pem under /etc/switchyard/, matching the paths consumed by
switchyard.service. Preserve the existing certificate options and instruct users
to restart switchyard after regenerating the files.
- Around line 60-61: Update the openssl req certificate-generation command in
the README to include the requested subjectAltName extension for
DNS:switchyard-dev.nvidia.com, while preserving the existing key, validity,
output, and subject arguments.

In `@dev-server/switchyard.service`:
- Line 7: Replace the NVIDIA_API_KEY Environment entry in the switchyard service
unit with EnvironmentFile=/etc/switchyard/switchyard.env, and create that
deployment file outside Git with root ownership and 0600 permissions containing
the protected key.
- Around line 8-25: Update the service identity from User=root and Group=root to
the dedicated switchyard user and group. Preserve CAP_NET_BIND_SERVICE (unless
socket activation is already used), and ensure the switchyard account or group
can read config.toml, cert.pem, and key.pem while restricting the private key to
that account or group.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cd248712-8abd-44d3-ab75-fd4dc147e164

📥 Commits

Reviewing files that changed from the base of the PR and between eea4e01 and 1dc2308.

📒 Files selected for processing (3)

• dev-server/README
• dev-server/config.toml
• dev-server/switchyard.service