config: [serve] section for the OpenAI-compatible front door

listen (default :8090, own port so it coexists with [events]), vkey_ref
(the bearer key OpenWebUI connections present; refs only, resolved at
startup), and an optional enabled_models subset of the catalog. Entries
must name a real servable model (mopac-<class> from [models.classes]) so
a typo fails at config load, not mid-request. Example file extended;
once/loop configs without [serve] stay valid.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

internal/config/config_test.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -430,3 +431,75 @@ func TestCheckKeyRefMPK(t *testing.T) {
 		t.Errorf("local ResolveKeyRef on mpk: should name [keyproxy], got %v", err)
 	}
 }
+
+const serveCfg = testCfg + `
+[serve]
+listen = "127.0.0.1:9099"
+vkey_ref = "file:/run/secrets/owui-vkey"
+enabled_models = ["mopac-study", "mopac-primary"]
+`
+
+func TestServeSectionParsed(t *testing.T) {
+	cfg, err := Load(writeTemp(t, serveCfg))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Serve.Listen != "127.0.0.1:9099" {
+		t.Errorf("serve listen = %q", cfg.Serve.Listen)
+	}
+	if cfg.Serve.VKeyRef != "file:/run/secrets/owui-vkey" {
+		t.Errorf("serve vkey_ref = %q", cfg.Serve.VKeyRef)
+	}
+	if fmt.Sprint(cfg.Serve.EnabledModels) != "[mopac-study mopac-primary]" {
+		t.Errorf("serve enabled_models = %v", cfg.Serve.EnabledModels)
+	}
+}
+
+func TestServeDefaults(t *testing.T) {
+	// No [serve] section: once/loop configs stay valid, default port 8090.
+	cfg, err := Load(writeTemp(t, testCfg))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.Serve.Listen != ":8090" {
+		t.Errorf("default serve listen = %q, want :8090", cfg.Serve.Listen)
+	}
+	if cfg.Serve.VKeyRef != "" || len(cfg.Serve.EnabledModels) != 0 {
+		t.Errorf("serve must default empty: %+v", cfg.Serve)
+	}
+}
+
+func TestServeValidation(t *testing.T) {
+	cases := []struct {
+		name string
+		mut  func(string) string
+		want string
+	}{
+		{
+			name: "bare vkey value",
+			mut:  func(s string) string { return strings.Replace(s, `vkey_ref = "file:/run/secrets/owui-vkey"`, `vkey_ref = "sk-owui"`, 1) },
+			want: "[serve]:",
+		},
+		{
+			name: "enabled model not mopac-prefixed",
+			mut:  func(s string) string { return strings.Replace(s, `"mopac-study", "mopac-primary"`, `"glm-5.2", "mopac-primary"`, 1) },
+			want: `enabled_models entry "glm-5.2" is not servable`,
+		},
+		{
+			name: "enabled model names no class",
+			mut:  func(s string) string { return strings.Replace(s, `"mopac-study", "mopac-primary"`, `"mopac-urgent", "mopac-primary"`, 1) },
+			want: `enabled_models entry "mopac-urgent" is not servable`,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := Load(writeTemp(t, tc.mut(serveCfg)))
+			if err == nil {
+				t.Fatalf("expected error containing %q, got nil", tc.want)
+			}
+			if !strings.Contains(err.Error(), tc.want) {
+				t.Fatalf("error %q does not contain %q", err, tc.want)
+			}
+		})
+	}
+}