calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-14 08:19:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

search the right resource

Browse Source
This commit is contained in:
Owen
2026-08-12 17:52:39 -04:00
parent 02ab24d01e
commit 5fbb205044
5 changed files with 170 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/private/lib/traefik/getTraefikConfig.ts
+31 -10
View File
@@ -61,6 +61,7 @@ import { build } from "@server/build";
import regionalCache from "#private/lib/cache";
import {
AI_GATEWAY_TRUST_HEADER,
AI_GATEWAY_RESOURCE_TYPE_HEADER,
getAiGatewayTrustToken
} from "@server/lib/aiGatewayTrust";
@@ -1569,14 +1570,32 @@ export async function getTraefikConfig(
const aiGatewayOverride =
config.getRawConfig().server.ai_gateway_override;
// The trust header is the same for every inference route on this
// exit node, so it's defined once here and attached to each router
// below instead of being duplicated into a per-resource middleware.
const aiGatewayTrustMiddlewareName = "ai-gateway-trust-headers";
config_output.http.middlewares[aiGatewayTrustMiddlewareName] = {
// The trust token is the same for every inference route on this exit
// node, so it's defined once here and attached to each router below
// instead of being duplicated into a per-resource middleware. Two
// variants exist (public resource vs. siteResource) so the resource
// type header lets the gateway know which kind of router the
// request came through without re-deriving it from resourceId.
const aiGatewayTrustMiddlewareNameResource =
"ai-gateway-trust-headers-resource";
const aiGatewayTrustMiddlewareNameSiteResource =
"ai-gateway-trust-headers-site-resource";
config_output.http.middlewares[aiGatewayTrustMiddlewareNameResource] =
{
headers: {
customRequestHeaders: {
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken(),
[AI_GATEWAY_RESOURCE_TYPE_HEADER]: "resource"
}
}
};
config_output.http.middlewares[
aiGatewayTrustMiddlewareNameSiteResource
] = {
headers: {
customRequestHeaders: {
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken()
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken(),
[AI_GATEWAY_RESOURCE_TYPE_HEADER]: "site-resource"
}
}
};
@@ -1650,7 +1669,7 @@ export async function getTraefikConfig(
config.getRawConfig().traefik.additional_middlewares || [];
const routerMiddlewares = [
badgerMiddlewareName,
aiGatewayTrustMiddlewareName
aiGatewayTrustMiddlewareNameResource
];
if (aiGatewayOverride) {
@@ -1750,7 +1769,9 @@ export async function getTraefikConfig(
const additionalMiddlewares =
config.getRawConfig().traefik.additional_middlewares || [];
const routerMiddlewares: string[] = [aiGatewayTrustMiddlewareName];
const routerMiddlewares: string[] = [
aiGatewayTrustMiddlewareNameSiteResource
];
if (aiGatewayOverride) {
const srHeadersMiddlewareName = `${srKey}-headers-middleware`;
@@ -1775,7 +1796,7 @@ export async function getTraefikConfig(
middlewares: [redirectHttpsMiddlewareName],
service: serviceName,
rule,
priority: 100
priority: 200 // we want to match on the site resource first because the clientIP rule is more specific than the public inference resource rule, which is just the exit node IP range. so we give it a higher priority to ensure it matches first.
};
}
@@ -1788,7 +1809,7 @@ export async function getTraefikConfig(
middlewares: routerMiddlewares,
service: serviceName,
rule,
priority: 100,
priority: 200, // we want to match on the site resource first because the clientIP rule is more specific than the public inference resource rule, which is just the exit node IP range. so we give it a higher priority to ensure it matches first.
...(sr.ssl ? { tls } : {})
};