calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-07 13:08:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use fulldoman instead of the alias for the site resources

Browse Source
This commit is contained in:
Owen
2026-08-06 13:45:51 -04:00
parent b4d2974e19
commit 6cca5e0472
4 changed files with 30 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/lib/rebuildClientAssociations.ts
+10 -8
View File
@@ -1117,7 +1117,8 @@ async function syncClientExitNodeConnections(
const requiresExitNodeRows = await trx
.select({
clientId: clientSiteResourcesAssociationsCache.clientId,
alias: siteResources.alias
alias: siteResources.alias,
fullDomain: siteResources.fullDomain
})
.from(clientSiteResourcesAssociationsCache)
.innerJoin(
@@ -1145,14 +1146,16 @@ async function syncClientExitNodeConnections(
// Aliases for every exit-node-backed resource this client can reach, so
// the live connect push carries the same alias list the register/reconnect
// path (buildSiteConfigurationForOlmClient) would compute.
const exitNodeAliasesByClientId = new Map<number, string[]>();
const exitNodeAliasesByClientId = new Map<number, (string | null)[]>();
for (const row of requiresExitNodeRows) {
if (row.alias == null) continue;
if (row.alias == null && row.fullDomain == null) continue;
const existing = exitNodeAliasesByClientId.get(row.clientId);
if (existing) {
existing.push(row.alias);
existing.push(row.fullDomain || row.alias); // accept both for now in case we have other resource types that dont use the full domain
} else {
exitNodeAliasesByClientId.set(row.clientId, [row.alias]);
exitNodeAliasesByClientId.set(row.clientId, [
row.fullDomain || row.alias
]);
}
}
@@ -1231,9 +1234,8 @@ async function syncClientExitNodeConnections(
publicKey: exitNode.publicKey,
serverIP: exitNode.address.split("/")[0],
tunnelIP: client.exitNodeSubnet.split("/")[0],
aliases: exitNodeAliasesByClientId.get(
client.clientId
) ?? []
aliases:
exitNodeAliasesByClientId.get(client.clientId) ?? []
}
},
options: {
server/lib/traefik/getTraefikConfig.ts
+7 -7
View File
@@ -860,7 +860,7 @@ export async function getTraefikConfig(
const siteResourcesInference = await db
.selectDistinct({
siteResourceId: siteResources.siteResourceId,
alias: siteResources.alias,
fullDomain: siteResources.fullDomain,
ssl: siteResources.ssl,
enabled: siteResources.enabled
})
@@ -869,23 +869,23 @@ export async function getTraefikConfig(
and(
eq(siteResources.mode, "inference"),
eq(siteResources.enabled, true),
isNotNull(siteResources.alias)
isNotNull(siteResources.fullDomain)
)
);
for (const sr of siteResourcesInference) {
if (!sr.enabled || !sr.alias) continue;
if (!sr.enabled || !sr.fullDomain) continue;
if (!config_output.http.routers) config_output.http.routers = {};
if (!config_output.http.services) config_output.http.services = {};
const alias = sr.alias;
const fullDomain = sr.fullDomain;
const srKey = `inference-sr${sr.siteResourceId}`;
const routerName = `${srKey}-router`;
const serviceName = `${srKey}-service`;
const rule = `Host(\`${alias}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to
const rule = `Host(\`${fullDomain}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to
const domainParts = alias.split(".");
const domainParts = fullDomain.split(".");
const wildCard =
domainParts.length <= 2
? `*.${domainParts.join(".")}`
@@ -911,7 +911,7 @@ export async function getTraefikConfig(
headers: {
customRequestHeaders: {
...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
"p-host": alias
"p-host": fullDomain
}
}
};
server/private/lib/traefik/getTraefikConfig.ts
+12 -12
View File
@@ -407,7 +407,7 @@ export async function getTraefikConfig(
and(
eq(siteResources.enabled, true),
isNotNull(siteResources.fullDomain),
eq(siteResources.mode, "http"),
eq(siteResources.mode, "http"), // important so we dont double get the inference siteResources below
eq(siteResources.ssl, true),
eq(sites.exitNodeId, exitNodeId),
inArray(sites.type, siteTypes)
@@ -452,7 +452,7 @@ export async function getTraefikConfig(
const siteResourcesInference = await db
.selectDistinct({
siteResourceId: siteResources.siteResourceId,
alias: siteResources.alias,
fullDomain: siteResources.fullDomain,
ssl: siteResources.ssl,
enabled: siteResources.enabled
})
@@ -461,7 +461,7 @@ export async function getTraefikConfig(
and(
eq(siteResources.mode, "inference"),
eq(siteResources.enabled, true),
isNotNull(siteResources.alias)
isNotNull(siteResources.fullDomain)
)
);
@@ -493,8 +493,8 @@ export async function getTraefikConfig(
}
}
for (const sr of siteResourcesInference) {
if (sr.enabled && sr.ssl && sr.alias) {
domains.add(sr.alias);
if (sr.enabled && sr.ssl && sr.fullDomain) {
domains.add(sr.fullDomain);
}
}
// get the valid certs for these domains
@@ -1687,20 +1687,20 @@ export async function getTraefikConfig(
// siteResources today (see plan doc), so gating here is
// reachability-only for now.
for (const sr of siteResourcesInference) {
if (!sr.enabled || !sr.alias) continue;
if (!sr.enabled || !sr.fullDomain) continue;
if (!config_output.http.routers) config_output.http.routers = {};
if (!config_output.http.services) config_output.http.services = {};
const alias = sr.alias;
const fullDomain = sr.fullDomain;
const srKey = `inference-sr${sr.siteResourceId}`;
const routerName = `${srKey}-router`;
const serviceName = `${srKey}-service`;
const rule = `Host(\`${alias}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to
const rule = `Host(\`${fullDomain}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to
let tls: any = {};
if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
const domainParts = alias.split(".");
const domainParts = fullDomain.split(".");
const wildCard =
domainParts.length <= 2
? `*.${domainParts.join(".")}`
@@ -1719,11 +1719,11 @@ export async function getTraefikConfig(
};
} else {
const matchingCert = validCerts.find(
(cert) => cert.queriedDomain === alias
(cert) => cert.queriedDomain === fullDomain
);
if (!matchingCert) {
logger.debug(
`No matching certificate found for inference siteResource alias: ${alias}`
`No matching certificate found for inference siteResource fullDomain: ${fullDomain}`
);
continue;
}
@@ -1739,7 +1739,7 @@ export async function getTraefikConfig(
headers: {
customRequestHeaders: {
...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
"p-host": alias
"p-host": fullDomain
}
}
};
server/routers/olm/buildConfiguration.ts
+1 -1
View File
@@ -98,7 +98,7 @@ export async function buildSiteConfigurationForOlmClient(
}
exitNodeAliases = siteResourcesForExitNode
.map((sr) => sr.alias)
.map((sr) => sr.fullDomain || sr.alias) // take either in case we introduce different resource types that don't have a fullDomain
.filter((a) => a != null);
if (sitesData.length == 0) {