calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-19 10:42:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

Dont load private resource inference without a exit node loaded

Browse Source
This commit is contained in:
Owen
2026-08-14 11:53:10 -04:00
parent b34a8d116b
commit 234819f8f2
2 changed files with 196 additions and 188 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/lib/traefik/getTraefikConfig.ts
+8 -6
View File
@@ -767,8 +767,7 @@ export async function getTraefikConfig(
if (!config_output.http.middlewares) { if (!config_output.http.middlewares) {
config_output.http.middlewares = {}; config_output.http.middlewares = {};
} }
config_output.http.middlewares[aiGatewayTrustMiddlewareNameResource] = config_output.http.middlewares[aiGatewayTrustMiddlewareNameResource] = {
{
headers: { headers: {
customRequestHeaders: { customRequestHeaders: {
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken(), [AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken(),
@@ -798,8 +797,7 @@ export async function getTraefikConfig(
const enableAiGatewayClientIpHeader = const enableAiGatewayClientIpHeader =
config.getRawConfig().server.enable_ai_gateway_client_ip_header; config.getRawConfig().server.enable_ai_gateway_client_ip_header;
if (enableAiGatewayClientIpHeader) { if (enableAiGatewayClientIpHeader) {
config_output.http.middlewares[aiGatewayClientIpMiddlewareName] = config_output.http.middlewares[aiGatewayClientIpMiddlewareName] = {
{
plugin: { plugin: {
badger: { badger: {
disableForwardAuth: true, disableForwardAuth: true,
@@ -935,11 +933,14 @@ export async function getTraefikConfig(
) )
); );
if (exitNode) {
for (const sr of siteResourcesInference) { for (const sr of siteResourcesInference) {
if (!sr.enabled || !sr.fullDomain) continue; if (!sr.enabled || !sr.fullDomain) continue;
if (!config_output.http.routers) config_output.http.routers = {}; if (!config_output.http.routers)
if (!config_output.http.services) config_output.http.services = {}; config_output.http.routers = {};
if (!config_output.http.services)
config_output.http.services = {};
const fullDomain = sr.fullDomain; const fullDomain = sr.fullDomain;
const srKey = `inference-sr${sr.siteResourceId}`; const srKey = `inference-sr${sr.siteResourceId}`;
@@ -1021,6 +1022,7 @@ export async function getTraefikConfig(
}; };
} }
} }
}
return config_output; return config_output;
} }
server/private/lib/traefik/getTraefikConfig.ts
+14 -8
View File
@@ -1581,8 +1581,7 @@ export async function getTraefikConfig(
"ai-gateway-trust-headers-resource"; "ai-gateway-trust-headers-resource";
const aiGatewayTrustMiddlewareNameSiteResource = const aiGatewayTrustMiddlewareNameSiteResource =
"ai-gateway-trust-headers-site-resource"; "ai-gateway-trust-headers-site-resource";
config_output.http.middlewares[aiGatewayTrustMiddlewareNameResource] = config_output.http.middlewares[aiGatewayTrustMiddlewareNameResource] = {
{
headers: { headers: {
customRequestHeaders: { customRequestHeaders: {
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken(), [AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken(),
@@ -1612,8 +1611,7 @@ export async function getTraefikConfig(
const enableAiGatewayClientIpHeader = const enableAiGatewayClientIpHeader =
config.getRawConfig().server.enable_ai_gateway_client_ip_header; config.getRawConfig().server.enable_ai_gateway_client_ip_header;
if (enableAiGatewayClientIpHeader) { if (enableAiGatewayClientIpHeader) {
config_output.http.middlewares[aiGatewayClientIpMiddlewareName] = config_output.http.middlewares[aiGatewayClientIpMiddlewareName] = {
{
plugin: { plugin: {
badger: { badger: {
disableForwardAuth: true, disableForwardAuth: true,
@@ -1742,6 +1740,7 @@ export async function getTraefikConfig(
}; };
} }
if (exitNode) {
// Private (siteResource) inference resources: routed by their alias // Private (siteResource) inference resources: routed by their alias
// instead of a public fullDomain, and deliberately WITHOUT the // instead of a public fullDomain, and deliberately WITHOUT the
// badger middleware - no per-user auth/policy stack exists for // badger middleware - no per-user auth/policy stack exists for
@@ -1750,8 +1749,10 @@ export async function getTraefikConfig(
for (const sr of siteResourcesInference) { for (const sr of siteResourcesInference) {
if (!sr.enabled || !sr.fullDomain) continue; if (!sr.enabled || !sr.fullDomain) continue;
if (!config_output.http.routers) config_output.http.routers = {}; if (!config_output.http.routers)
if (!config_output.http.services) config_output.http.services = {}; config_output.http.routers = {};
if (!config_output.http.services)
config_output.http.services = {};
const fullDomain = sr.fullDomain; const fullDomain = sr.fullDomain;
const srKey = `inference-sr${sr.siteResourceId}`; const srKey = `inference-sr${sr.siteResourceId}`;
@@ -1760,7 +1761,9 @@ export async function getTraefikConfig(
const rule = `Host(\`${fullDomain}\`) && ClientIP(\`${exitNode.address}\`)`; // restrict to coming from the exit node ip range that the client is connected to const rule = `Host(\`${fullDomain}\`) && ClientIP(\`${exitNode.address}\`)`; // restrict to coming from the exit node ip range that the client is connected to
let tls: any = {}; let tls: any = {};
if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) { if (
!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
) {
const domainParts = fullDomain.split("."); const domainParts = fullDomain.split(".");
const wildCard = const wildCard =
domainParts.length <= 2 domainParts.length <= 2
@@ -1804,7 +1807,9 @@ export async function getTraefikConfig(
config_output.http.middlewares[srHeadersMiddlewareName] = { config_output.http.middlewares[srHeadersMiddlewareName] = {
headers: { headers: {
customRequestHeaders: { customRequestHeaders: {
...(aiGatewayHost ? { Host: aiGatewayHost } : {}), ...(aiGatewayHost
? { Host: aiGatewayHost }
: {}),
"p-host": fullDomain "p-host": fullDomain
} }
} }
@@ -1846,6 +1851,7 @@ export async function getTraefikConfig(
}; };
} }
} }
}
if (generateLoginPageRouters) { if (generateLoginPageRouters) {
const exitNodeLoginPages = await db const exitNodeLoginPages = await db