Use p host to pass the host header

server/private/lib/traefik/getTraefikConfig.ts

@@ -1548,6 +1548,20 @@ export async function getTraefikConfig(
     }
 
     if (aiGatewayUrl) {
+        // The AI gateway may live on a different host than the inference
+        // resource itself (e.g. a remote exit node forwarding to the
+        // central dashboard over a tunnel). passHostHeader would forward
+        // the resource's own Host, which that external host won't
+        // recognize, so we pin the Host header to the gateway's own host
+        // and smuggle the original resource host through in "p-host"
+        // instead (same pattern as the maintenance-page routes above).
+        let aiGatewayHost: string | undefined;
+        try {
+            aiGatewayHost = new URL(aiGatewayUrl).host;
+        } catch {
+            aiGatewayHost = undefined;
+        }
+
         // Public inference resources: same TLS/cert-resolver handling as
         // plain http-mode resources, but the service points at the AI
         // gateway instead of any real backend targets.
@@ -1613,10 +1627,21 @@ export async function getTraefikConfig(
                 }
             }
 
+            const irHeadersMiddlewareName = `${irKey}-headers-middleware`;
+            config_output.http.middlewares[irHeadersMiddlewareName] = {
+                headers: {
+                    customRequestHeaders: {
+                        ...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
+                        "p-host": fullDomain
+                    }
+                }
+            };
+
             const additionalMiddlewares =
                 config.getRawConfig().traefik.additional_middlewares || [];
             const routerMiddlewares = [
                 badgerMiddlewareName,
+                irHeadersMiddlewareName,
                 ...additionalMiddlewares
             ];
 
@@ -1647,8 +1672,7 @@ export async function getTraefikConfig(
 
             config_output.http.services[serviceName] = {
                 loadBalancer: {
-                    servers: [{ url: `${aiGatewayUrl}/chat/completions` }],
-                    passHostHeader: true
+                    servers: [{ url: `${aiGatewayUrl}/chat/completions` }]
                 }
             };
         }
@@ -1701,8 +1725,22 @@ export async function getTraefikConfig(
                 }
             }
 
+            const srHeadersMiddlewareName = `${srKey}-headers-middleware`;
+            config_output.http.middlewares[srHeadersMiddlewareName] = {
+                headers: {
+                    customRequestHeaders: {
+                        ...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
+                        "p-host": alias
+                    }
+                }
+            };
+
             const additionalMiddlewares =
                 config.getRawConfig().traefik.additional_middlewares || [];
+            const routerMiddlewares = [
+                srHeadersMiddlewareName,
+                ...additionalMiddlewares
+            ];
 
             if (sr.ssl) {
                 config_output.http.routers[routerName + "-redirect"] = {
@@ -1722,7 +1760,7 @@ export async function getTraefikConfig(
                         ? config.getRawConfig().traefik.https_entrypoint
                         : config.getRawConfig().traefik.http_entrypoint
                 ],
-                middlewares: additionalMiddlewares,
+                middlewares: routerMiddlewares,
                 service: serviceName,
                 rule,
                 priority: 100,
@@ -1731,8 +1769,7 @@ export async function getTraefikConfig(
 
             config_output.http.services[serviceName] = {
                 loadBalancer: {
-                    servers: [{ url: `${aiGatewayUrl}/chat/completions` }],
-                    passHostHeader: true
+                    servers: [{ url: `${aiGatewayUrl}/chat/completions` }]
                 }
             };
         }