refactor(http): hand out an owned Client and route all providers through the pool

litellm-rust/clippy.toml

@@ -7,4 +7,16 @@ disallowed-methods = [
     { path = "pyo3_async_runtimes::tokio::local_future_into_py", reason = "use litellm_host_python::run_async / run_async_value" },
     { path = "pyo3_async_runtimes::tokio::run", reason = "use litellm_host_python::run_sync / run_sync_value" },
     { path = "pyo3_async_runtimes::tokio::run_until_complete", reason = "use litellm_host_python::run_sync / run_sync_value" },
+    { path = "reqwest::Client::new", reason = "take litellm_http::Client from HttpClientPool" },
+    { path = "reqwest::Client::builder", reason = "HttpClientConfig owns client construction" },
+    { path = "reqwest::ClientBuilder::danger_accept_invalid_certs", reason = "set HttpClientConfig::verify instead" },
+    { path = "reqwest::ClientBuilder::identity", reason = "set HttpClientConfig::client_certificate instead" },
+    { path = "reqwest::ClientBuilder::use_preconfigured_tls", reason = "HttpClientConfig owns the TLS configuration" },
+]
+
+# Every outbound client comes from litellm_http::HttpClientPool so it honors the host's TLS,
+# proxy and timeout settings. Only crates/http builds one.
+disallowed-types = [
+    { path = "reqwest::Client", reason = "take litellm_http::Client from HttpClientPool; only crates/http builds one" },
+    { path = "reqwest::ClientBuilder", reason = "HttpClientConfig owns client construction" },
 ]

litellm-rust/crates/auth-aws/Cargo.toml

@@ -22,5 +22,6 @@ aws-types = "1.4.0"
 aws-smithy-runtime-api = "1.13.0"
 
 [dev-dependencies]
+litellm-http = { workspace = true, features = ["test-support"] }
 reqwest.workspace = true
 tokio.workspace = true

litellm-rust/crates/auth-aws/src/aws.rs

@@ -962,7 +962,7 @@ mod tests {
             &no_env,
         )
         .await?;
-        let client = reqwest::Client::new();
+        let client = litellm_http::Client::plain_for_test();
         let mut failures = Vec::new();
 
         for region in ["us-west-2", "us-east-1"] {

litellm-rust/crates/cache-azure-blob/Cargo.toml

@@ -6,6 +6,7 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
+litellm-http.workspace = true
 litellm-auth-azure.workspace = true
 litellm-auth-types.workspace = true
 litellm-cache.workspace = true
@@ -19,6 +20,7 @@ tokio.workspace = true
 url.workspace = true
 
 [dev-dependencies]
+litellm-http = { workspace = true, features = ["test-support"] }
 litellm-cache-response.workspace = true
 litellm-cache-testing.workspace = true
 rstest.workspace = true

litellm-rust/crates/cache-azure-blob/src/cache.rs

@@ -31,7 +31,7 @@ impl<C: CacheCodec> AzureBlobCache<C> {
     pub async fn connect(
         account_url: &str,
         container: &str,
-        http: reqwest::Client,
+        http: litellm_http::Client,
         codec: C,
         runtime: Handle,
     ) -> Result<Self, Error> {

litellm-rust/crates/cache-azure-blob/src/transport.rs

@@ -8,7 +8,7 @@ use azure_core::{
 use futures_util::TryStreamExt;
 
 #[derive(Debug)]
-pub struct ReqwestTransport(pub reqwest::Client);
+pub struct ReqwestTransport(pub litellm_http::Client);
 
 #[async_trait::async_trait]
 impl HttpClient for ReqwestTransport {

litellm-rust/crates/cache-azure-blob/tests/transport.rs

@@ -31,7 +31,7 @@ async fn connect(server: &MockServer) -> AzureBlobCache<JsonCodec<Value>> {
         None,
         ClientOptions {
             transport: Some(Transport::new(Arc::new(ReqwestTransport(
-                reqwest::Client::new(),
+                litellm_http::Client::plain_for_test(),
             )))),
             ..ClientOptions::default()
         },

litellm-rust/crates/cache-gcs/Cargo.toml

@@ -6,6 +6,7 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
+litellm-http.workspace = true
 futures-util.workspace = true
 litellm-auth-gcp.workspace = true
 litellm-auth-types.workspace = true
@@ -15,6 +16,7 @@ reqwest.workspace = true
 tokio.workspace = true
 
 [dev-dependencies]
+litellm-http = { workspace = true, features = ["test-support"] }
 litellm-cache-testing.workspace = true
 rstest.workspace = true
 serde_json.workspace = true

litellm-rust/crates/cache-gcs/src/cache.rs

@@ -5,8 +5,8 @@ use litellm_cache::{
     BaseCache, BatchCache, BatchEntry, CacheCodec, DisconnectCache, Error, ExactCacheContext,
     FlushCache,
 };
+use litellm_http::Client;
 use percent_encoding::{AsciiSet, NON_ALPHANUMERIC, percent_encode};
-use reqwest::Client;
 
 use crate::{GcpTokenSource, TokenSource};
 

litellm-rust/crates/cache-gcs/tests/cache.rs

@@ -96,7 +96,7 @@ async fn cache_exposes_its_configuration(#[future(awt)] server: MockServer) {
             path_service_account: Some("/secrets/sa.json".into()),
             ..support::config(&server, Some("folder"))
         },
-        reqwest::Client::new(),
+        litellm_http::Client::plain_for_test(),
         litellm_cache::JsonCodec::<Value>::new(),
     );
     assert_eq!(cache.bucket_name(), "bucket");

litellm-rust/crates/cache-gcs/tests/support/mod.rs

@@ -29,7 +29,7 @@ pub fn cache_with_token(
 ) -> JsonGcsCache {
     GcsCache::with_token_source(
         config(server, gcs_path),
-        reqwest::Client::new(),
+        litellm_http::Client::plain_for_test(),
         JsonCodec::new(),
         token,
     )

litellm-rust/crates/cache-qdrant-semantic/Cargo.toml

@@ -6,6 +6,7 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
+litellm-http.workspace = true
 futures-util.workspace = true
 litellm-cache.workspace = true
 qdrant-client = { workspace = true, features = ["serde"] }
@@ -17,6 +18,7 @@ tokio.workspace = true
 uuid.workspace = true
 
 [dev-dependencies]
+litellm-http = { workspace = true, features = ["test-support"] }
 futures-executor = "0.3"
 litellm-cache-testing.workspace = true
 rstest.workspace = true

litellm-rust/crates/cache-qdrant-semantic/src/embedder.rs

@@ -1,7 +1,7 @@
 use std::time::Duration;
 
 use litellm_cache::{Error, semantic::Embedder};
-use reqwest::Client;
+use litellm_http::Client;
 use serde_json::Value;
 
 pub struct OpenAiEmbedder {

litellm-rust/crates/cache-qdrant-semantic/tests/embedder.rs

@@ -5,6 +5,10 @@ use std::{
 
 use litellm_cache::{Error, semantic::Embedder};
 use litellm_cache_qdrant_semantic::{OpenAiEmbedder, OpenAiEmbedderConfig};
+use litellm_http::{
+    ClientVariant, HttpClientConfig, HttpClientPool, HttpSettings, Resolution,
+    media::PublicDnsResolver,
+};
 use rstest::rstest;
 use serde_json::{Value, json};
 use tokio::{
@@ -104,7 +108,7 @@ fn config(base: String, timeout: Option<Duration>) -> OpenAiEmbedderConfig {
 async fn posts_embeddings_request_and_parses_vector() {
     let server = TestHttpServer::response("200 OK", r#"{"data":[{"embedding":[0.1,0.2]}]}"#).await;
     let embedder = OpenAiEmbedder::new(
-        reqwest::Client::new(),
+        litellm_http::Client::plain_for_test(),
         config(
             format!("{}/", server.base_url()),
             Some(Duration::from_secs(1)),
@@ -156,14 +160,17 @@ async fn status_timeout_and_body_errors_are_unavailable(
 ) {
     let server =
         TestHttpServer::response_after(status, body, Duration::from_millis(delay_ms)).await;
-    let embedder = OpenAiEmbedder::new(reqwest::Client::new(), config(server.base_url(), timeout));
+    let embedder = OpenAiEmbedder::new(
+        litellm_http::Client::plain_for_test(),
+        config(server.base_url(), timeout),
+    );
     assert_eq!(embedder.async_embed("hello", None).await, expected);
 }
 
 #[rstest]
 fn sync_embedding_is_unsupported() {
     let embedder = OpenAiEmbedder::new(
-        reqwest::Client::new(),
+        litellm_http::Client::plain_for_test(),
         config("http://127.0.0.1:9".to_owned(), None),
     );
     assert_eq!(
@@ -176,9 +183,12 @@ fn sync_embedding_is_unsupported() {
 #[tokio::test]
 async fn uses_the_injected_client() {
     let server = TestHttpServer::response("200 OK", r#"{"data":[{"embedding":[0.1,0.2]}]}"#).await;
-    let client = reqwest::Client::builder()
-        .user_agent("litellm-embedder-test")
-        .build()
+    let config_with_agent = HttpClientConfig {
+        user_agent: Some("litellm-embedder-test".into()),
+        ..Resolution::from(&HttpSettings::default()).config
+    };
+    let client = HttpClientPool::new(Arc::new(PublicDnsResolver))
+        .client(&config_with_agent, ClientVariant::Provider)
         .unwrap();
     let embedder = OpenAiEmbedder::new(client, config(server.base_url(), None));
     assert_eq!(

litellm-rust/crates/cache-s3/Cargo.toml

@@ -6,6 +6,7 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
+litellm-http.workspace = true
 litellm-cache.workspace = true
 litellm-auth-aws.workspace = true
 aws-sdk-s3 = { version = "1.146.1", default-features = false, features = ["rustls", "rt-tokio"] }
@@ -19,6 +20,7 @@ reqwest.workspace = true
 tokio.workspace = true
 
 [dev-dependencies]
+litellm-http = { workspace = true, features = ["test-support"] }
 litellm-cache-testing.workspace = true
 rstest.workspace = true
 wiremock = "0.6.5"

litellm-rust/crates/cache-s3/src/cache.rs

@@ -42,7 +42,12 @@ pub struct S3Cache<C: CacheCodec> {
 }
 
 impl<C: CacheCodec> S3Cache<C> {
-    pub fn new(config: S3CacheConfig, http: reqwest::Client, codec: C, runtime: Handle) -> Self {
+    pub fn new(
+        config: S3CacheConfig,
+        http: litellm_http::Client,
+        codec: C,
+        runtime: Handle,
+    ) -> Self {
         let endpoint_url: Option<String> = config.endpoint.map(|endpoint| endpoint.url);
         let base = aws_sdk_s3::Config::builder()
             .behavior_version(BehaviorVersion::latest())

litellm-rust/crates/cache-s3/src/transport.rs

@@ -9,7 +9,7 @@ use aws_smithy_runtime_api::client::{
 use aws_smithy_types::body::SdkBody;
 
 #[derive(Clone, Debug)]
-pub(crate) struct ReqwestHttpClient(pub(crate) reqwest::Client);
+pub(crate) struct ReqwestHttpClient(pub(crate) litellm_http::Client);
 
 impl HttpClient for ReqwestHttpClient {
     fn http_connector(

litellm-rust/crates/cache-s3/tests/support/mod.rs

@@ -32,7 +32,12 @@ pub fn config(endpoint: &str) -> S3CacheConfig {
 }
 
 pub fn cache_with(config: S3CacheConfig, runtime: Handle) -> JsonS3Cache {
-    S3Cache::new(config, reqwest::Client::new(), JsonCodec::new(), runtime)
+    S3Cache::new(
+        config,
+        litellm_http::Client::plain_for_test(),
+        JsonCodec::new(),
+        runtime,
+    )
 }
 
 pub fn cache(endpoint: &str) -> JsonS3Cache {

litellm-rust/crates/core/Cargo.toml

@@ -36,6 +36,7 @@ url.workspace = true
 veil.workspace = true
 
 [dev-dependencies]
+litellm-http = { workspace = true, features = ["test-support"] }
 litellm-auth-gcp.workspace = true
 litellm-llms = { workspace = true, features = ["test-support"] }
 rstest.workspace = true

litellm-rust/crates/core/src/audio_transcription/handler.rs

@@ -1,22 +1,32 @@
-use litellm_http::request::truncate_error_body;
+use std::time::Duration;
+
+use litellm_http::{Client, request::truncate_error_body};
 use serde_json::Value;
 
-use super::{Error, client::http_client};
-use crate::audio_transcription::types::ProviderAudioTranscriptionRequest;
+use super::Error;
+use crate::{
+    audio_transcription::types::ProviderAudioTranscriptionRequest,
+    constants::AUDIO_TRANSCRIPTION_TIMEOUT_SECS,
+};
 
 pub async fn execute_audio_transcription_provider_call(
+    http: &Client,
     request: ProviderAudioTranscriptionRequest,
 ) -> Result<Value, Error> {
     let response = crate::outbound::outbound_request::<Error>(
         &request.auth,
         request.url.clone(),
         request.upstream_headers.clone(),
         &request.body,
-        request.timeout,
+        Some(
+            request
+                .timeout
+                .unwrap_or(Duration::from_secs(AUDIO_TRANSCRIPTION_TIMEOUT_SECS)),
+        ),
         &request.optional_params,
     )
     .await?
-    .send(http_client())
+    .send(http)
     .await
     .map_err(|error| {
         Error::Transport(litellm_http::transport::Error::Network(error.to_string()))