Ragmux

Ragmux is an open-source Go gateway I built to move the work that surrounds retrieval — where the provider key sits, which application uses which model, where spend is cut off — out of the application. The application talks to one OpenAI-compatible endpoint (/v1/chat/completions and /v1/models, with JSON and SSE streaming); in the official SDKs the only things that change are base_url and api_key. Which provider a request reaches, which system prompt it carries and which document store it draws context from is decided by the project’s connection — the model field the client sends does no routing; it is only echoed back unchanged in the response and in every stream chunk, so SDKs that compare that field keep working.

On the RAG side, PDF, DOCX, HTML, Markdown and plain text are parsed; chunks respect section and page boundaries, so a chunk never spans two sections or two pages and every chunk carries exactly one heading path. Retrieval is hybrid: vector and full-text rankings are fused with reciprocal rank fusion, so a product name, an error code or an identifier the embedding model has never seen still surfaces through the lexical side. On top of that there is a ParadeDB BM25 backend, reranking with your own model or the Cohere / Voyage APIs, and a distance threshold — all optional, and a retrieval failure never drops the request: it is logged and the request continues without context. On the provider side, Anthropic and Gemini requests, streams and tool calls are translated into the OpenAI schema; because Gemini’s parameters field does not accept JSON Schema, tool schemas are sanitised deliberately and lossily — keys like additionalProperties are dropped, $ref is inlined up to a depth of eight, and a recursive reference collapses to a description.

Security and operations make up half the product. Provider credentials are stored sealed with AES-256-GCM, with the connection id as associated data; a wrong SECRET_KEY is caught at boot rather than on the first request, the moment a canary sealed into the database fails to decrypt. Provider URLs are treated as untrusted destinations and reaching private networks is refused by default — but the exemption that lifts this for a provider base_url does not extend to image fetching, because a base_url is typed by an editor while an image URL arrives from whoever holds an API key. There are three key kinds: sk-proj- is a project’s own key, while sk-user- and sk-mgmt- are user keys that carry scopes. On the management surface a key can never exceed its owner — effective permission is the intersection of its scopes with the owner’s live role, read from the database on every request; /v1 does not read the role at all, it checks only that the account is active and that the key is granted the project. Cost is estimated for every request but is informational; spend is capped not in money but with token ceilings and daily or monthly token budgets. Because a counter is a row rather than a process variable, several replicas against one PostgreSQL share the same budget. Document ingestion is distributed across replicas under a lease, the retention pass falls to a single leader elected with an advisory lock, and streaming needs no session affinity. The licence is AGPL-3.0-or-later.