Allow overlapping domains on public inference resources

server/routers/resource/createResource.ts

@@ -18,7 +18,7 @@ import {
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { eq, and } from "drizzle-orm";
+import { eq, and, ne } from "drizzle-orm";
 import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { subdomainSchema, wildcardSubdomainSchema } from "@server/lib/schemas";
@@ -484,11 +484,22 @@ async function createHttpResource(
 
     logger.debug(`Full domain: ${fullDomain}`);
 
-    // make sure the full domain is unique
+    // make sure the full domain is unique. Inference resources are routed
+    // through the central AI gateway rather than normal target-based
+    // proxying, so they're allowed to share a full-domain with a
+    // non-inference resource (and vice versa) - only conflicts within the
+    // same routing category are rejected.
     const existingResource = await db
         .select()
         .from(resources)
-        .where(eq(resources.fullDomain, fullDomain));
+        .where(
+            and(
+                eq(resources.fullDomain, fullDomain),
+                effectiveMode === "inference"
+                    ? eq(resources.mode, "inference")
+                    : ne(resources.mode, "inference")
+            )
+        );
 
     if (existingResource.length > 0) {
         return next(

server/routers/resource/updateResource.ts

@@ -596,10 +596,23 @@ async function updateHttpResource(
         logger.debug(`Full domain: ${fullDomain}`);
 
         if (fullDomain) {
+            // Inference resources route through the central AI gateway
+            // rather than normal target-based proxying, so they're allowed
+            // to share a full-domain with a non-inference resource (and
+            // vice versa) - only conflicts within the same routing category
+            // are rejected. mode isn't updatable here, so `resource.mode`
+            // reflects the resource's actual (unchanging) routing category.
             const [existingDomain] = await db
                 .select()
                 .from(resources)
-                .where(eq(resources.fullDomain, fullDomain));
+                .where(
+                    and(
+                        eq(resources.fullDomain, fullDomain),
+                        resource.mode === "inference"
+                            ? eq(resources.mode, "inference")
+                            : ne(resources.mode, "inference")
+                    )
+                );
 
             if (
                 existingDomain &&

server/routers/siteResource/listAllSiteResourcesByOrg.ts

@@ -55,12 +55,12 @@ const listAllSiteResourcesByOrgQuerySchema = z.strictObject({
         }),
     query: z.string().optional(),
     mode: z
-        .enum(["host", "cidr", "http"])
+        .enum(["host", "cidr", "http", "ssh", "inference"])
         .optional()
         .catch(undefined)
         .openapi({
             type: "string",
-            enum: ["host", "cidr", "http"],
+            enum: ["host", "cidr", "http", "ssh", "inference"],
             description: "Filter site resources by mode"
         }),
     sort_by: z