From 6cca5e047228573fb1e9b4798d409443851fd1ed Mon Sep 17 00:00:00 2001 From: Owen Date: Thu, 6 Aug 2026 13:45:51 -0400 Subject: [PATCH] Use fulldoman instead of the alias for the site resources --- server/lib/rebuildClientAssociations.ts | 18 +++++++------- server/lib/traefik/getTraefikConfig.ts | 14 +++++------ .../private/lib/traefik/getTraefikConfig.ts | 24 +++++++++---------- server/routers/olm/buildConfiguration.ts | 2 +- 4 files changed, 30 insertions(+), 28 deletions(-) diff --git a/server/lib/rebuildClientAssociations.ts b/server/lib/rebuildClientAssociations.ts index fe1cdea6f..045ca3927 100644 --- a/server/lib/rebuildClientAssociations.ts +++ b/server/lib/rebuildClientAssociations.ts @@ -1117,7 +1117,8 @@ async function syncClientExitNodeConnections( const requiresExitNodeRows = await trx .select({ clientId: clientSiteResourcesAssociationsCache.clientId, - alias: siteResources.alias + alias: siteResources.alias, + fullDomain: siteResources.fullDomain }) .from(clientSiteResourcesAssociationsCache) .innerJoin( @@ -1145,14 +1146,16 @@ async function syncClientExitNodeConnections( // Aliases for every exit-node-backed resource this client can reach, so // the live connect push carries the same alias list the register/reconnect // path (buildSiteConfigurationForOlmClient) would compute. - const exitNodeAliasesByClientId = new Map(); + const exitNodeAliasesByClientId = new Map(); for (const row of requiresExitNodeRows) { - if (row.alias == null) continue; + if (row.alias == null && row.fullDomain == null) continue; const existing = exitNodeAliasesByClientId.get(row.clientId); if (existing) { - existing.push(row.alias); + existing.push(row.fullDomain || row.alias); // accept both for now in case we have other resource types that dont use the full domain } else { - exitNodeAliasesByClientId.set(row.clientId, [row.alias]); + exitNodeAliasesByClientId.set(row.clientId, [ + row.fullDomain || row.alias + ]); } } @@ -1231,9 +1234,8 @@ async function syncClientExitNodeConnections( publicKey: exitNode.publicKey, serverIP: exitNode.address.split("/")[0], tunnelIP: client.exitNodeSubnet.split("/")[0], - aliases: exitNodeAliasesByClientId.get( - client.clientId - ) ?? [] + aliases: + exitNodeAliasesByClientId.get(client.clientId) ?? [] } }, options: { diff --git a/server/lib/traefik/getTraefikConfig.ts b/server/lib/traefik/getTraefikConfig.ts index 4df621684..a6535c766 100644 --- a/server/lib/traefik/getTraefikConfig.ts +++ b/server/lib/traefik/getTraefikConfig.ts @@ -860,7 +860,7 @@ export async function getTraefikConfig( const siteResourcesInference = await db .selectDistinct({ siteResourceId: siteResources.siteResourceId, - alias: siteResources.alias, + fullDomain: siteResources.fullDomain, ssl: siteResources.ssl, enabled: siteResources.enabled }) @@ -869,23 +869,23 @@ export async function getTraefikConfig( and( eq(siteResources.mode, "inference"), eq(siteResources.enabled, true), - isNotNull(siteResources.alias) + isNotNull(siteResources.fullDomain) ) ); for (const sr of siteResourcesInference) { - if (!sr.enabled || !sr.alias) continue; + if (!sr.enabled || !sr.fullDomain) continue; if (!config_output.http.routers) config_output.http.routers = {}; if (!config_output.http.services) config_output.http.services = {}; - const alias = sr.alias; + const fullDomain = sr.fullDomain; const srKey = `inference-sr${sr.siteResourceId}`; const routerName = `${srKey}-router`; const serviceName = `${srKey}-service`; - const rule = `Host(\`${alias}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to + const rule = `Host(\`${fullDomain}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to - const domainParts = alias.split("."); + const domainParts = fullDomain.split("."); const wildCard = domainParts.length <= 2 ? `*.${domainParts.join(".")}` @@ -911,7 +911,7 @@ export async function getTraefikConfig( headers: { customRequestHeaders: { ...(aiGatewayHost ? { Host: aiGatewayHost } : {}), - "p-host": alias + "p-host": fullDomain } } }; diff --git a/server/private/lib/traefik/getTraefikConfig.ts b/server/private/lib/traefik/getTraefikConfig.ts index 5cd5549c8..b00dbd7c8 100644 --- a/server/private/lib/traefik/getTraefikConfig.ts +++ b/server/private/lib/traefik/getTraefikConfig.ts @@ -407,7 +407,7 @@ export async function getTraefikConfig( and( eq(siteResources.enabled, true), isNotNull(siteResources.fullDomain), - eq(siteResources.mode, "http"), + eq(siteResources.mode, "http"), // important so we dont double get the inference siteResources below eq(siteResources.ssl, true), eq(sites.exitNodeId, exitNodeId), inArray(sites.type, siteTypes) @@ -452,7 +452,7 @@ export async function getTraefikConfig( const siteResourcesInference = await db .selectDistinct({ siteResourceId: siteResources.siteResourceId, - alias: siteResources.alias, + fullDomain: siteResources.fullDomain, ssl: siteResources.ssl, enabled: siteResources.enabled }) @@ -461,7 +461,7 @@ export async function getTraefikConfig( and( eq(siteResources.mode, "inference"), eq(siteResources.enabled, true), - isNotNull(siteResources.alias) + isNotNull(siteResources.fullDomain) ) ); @@ -493,8 +493,8 @@ export async function getTraefikConfig( } } for (const sr of siteResourcesInference) { - if (sr.enabled && sr.ssl && sr.alias) { - domains.add(sr.alias); + if (sr.enabled && sr.ssl && sr.fullDomain) { + domains.add(sr.fullDomain); } } // get the valid certs for these domains @@ -1687,20 +1687,20 @@ export async function getTraefikConfig( // siteResources today (see plan doc), so gating here is // reachability-only for now. for (const sr of siteResourcesInference) { - if (!sr.enabled || !sr.alias) continue; + if (!sr.enabled || !sr.fullDomain) continue; if (!config_output.http.routers) config_output.http.routers = {}; if (!config_output.http.services) config_output.http.services = {}; - const alias = sr.alias; + const fullDomain = sr.fullDomain; const srKey = `inference-sr${sr.siteResourceId}`; const routerName = `${srKey}-router`; const serviceName = `${srKey}-service`; - const rule = `Host(\`${alias}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to + const rule = `Host(\`${fullDomain}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to let tls: any = {}; if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) { - const domainParts = alias.split("."); + const domainParts = fullDomain.split("."); const wildCard = domainParts.length <= 2 ? `*.${domainParts.join(".")}` @@ -1719,11 +1719,11 @@ export async function getTraefikConfig( }; } else { const matchingCert = validCerts.find( - (cert) => cert.queriedDomain === alias + (cert) => cert.queriedDomain === fullDomain ); if (!matchingCert) { logger.debug( - `No matching certificate found for inference siteResource alias: ${alias}` + `No matching certificate found for inference siteResource fullDomain: ${fullDomain}` ); continue; } @@ -1739,7 +1739,7 @@ export async function getTraefikConfig( headers: { customRequestHeaders: { ...(aiGatewayHost ? { Host: aiGatewayHost } : {}), - "p-host": alias + "p-host": fullDomain } } }; diff --git a/server/routers/olm/buildConfiguration.ts b/server/routers/olm/buildConfiguration.ts index af309f89a..1eb2cfa91 100644 --- a/server/routers/olm/buildConfiguration.ts +++ b/server/routers/olm/buildConfiguration.ts @@ -98,7 +98,7 @@ export async function buildSiteConfigurationForOlmClient( } exitNodeAliases = siteResourcesForExitNode - .map((sr) => sr.alias) + .map((sr) => sr.fullDomain || sr.alias) // take either in case we introduce different resource types that don't have a fullDomain .filter((a) => a != null); if (sitesData.length == 0) {