calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-18 18:23:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use fulldoman instead of the alias for the site resources

Browse Source
This commit is contained in:
Owen
2026-08-06 13:45:51 -04:00
parent b4d2974e19
commit 6cca5e0472
4 changed files with 30 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/lib/rebuildClientAssociations.ts
+10 -8
View File
@@ -1117,7 +1117,8 @@ async function syncClientExitNodeConnections(
const requiresExitNodeRows = await trx const requiresExitNodeRows = await trx
.select({ .select({
clientId: clientSiteResourcesAssociationsCache.clientId, clientId: clientSiteResourcesAssociationsCache.clientId,
alias: siteResources.alias alias: siteResources.alias,
fullDomain: siteResources.fullDomain
}) })
.from(clientSiteResourcesAssociationsCache) .from(clientSiteResourcesAssociationsCache)
.innerJoin( .innerJoin(
@@ -1145,14 +1146,16 @@ async function syncClientExitNodeConnections(
// Aliases for every exit-node-backed resource this client can reach, so // Aliases for every exit-node-backed resource this client can reach, so
// the live connect push carries the same alias list the register/reconnect // the live connect push carries the same alias list the register/reconnect
// path (buildSiteConfigurationForOlmClient) would compute. // path (buildSiteConfigurationForOlmClient) would compute.
const exitNodeAliasesByClientId = new Map<number, string[]>(); const exitNodeAliasesByClientId = new Map<number, (string | null)[]>();
for (const row of requiresExitNodeRows) { for (const row of requiresExitNodeRows) {
if (row.alias == null) continue; if (row.alias == null && row.fullDomain == null) continue;
const existing = exitNodeAliasesByClientId.get(row.clientId); const existing = exitNodeAliasesByClientId.get(row.clientId);
if (existing) { if (existing) {
existing.push(row.alias); existing.push(row.fullDomain || row.alias); // accept both for now in case we have other resource types that dont use the full domain
} else { } else {
exitNodeAliasesByClientId.set(row.clientId, [row.alias]); exitNodeAliasesByClientId.set(row.clientId, [
row.fullDomain || row.alias
]);
} }
} }
@@ -1231,9 +1234,8 @@ async function syncClientExitNodeConnections(
publicKey: exitNode.publicKey, publicKey: exitNode.publicKey,
serverIP: exitNode.address.split("/")[0], serverIP: exitNode.address.split("/")[0],
tunnelIP: client.exitNodeSubnet.split("/")[0], tunnelIP: client.exitNodeSubnet.split("/")[0],
aliases: exitNodeAliasesByClientId.get( aliases:
client.clientId exitNodeAliasesByClientId.get(client.clientId) ?? []
) ?? []
} }
}, },
options: { options: {
server/lib/traefik/getTraefikConfig.ts
+7 -7
View File
@@ -860,7 +860,7 @@ export async function getTraefikConfig(
const siteResourcesInference = await db const siteResourcesInference = await db
.selectDistinct({ .selectDistinct({
siteResourceId: siteResources.siteResourceId, siteResourceId: siteResources.siteResourceId,
alias: siteResources.alias, fullDomain: siteResources.fullDomain,
ssl: siteResources.ssl, ssl: siteResources.ssl,
enabled: siteResources.enabled enabled: siteResources.enabled
}) })
@@ -869,23 +869,23 @@ export async function getTraefikConfig(
and( and(
eq(siteResources.mode, "inference"), eq(siteResources.mode, "inference"),
eq(siteResources.enabled, true), eq(siteResources.enabled, true),
isNotNull(siteResources.alias) isNotNull(siteResources.fullDomain)
) )
); );
for (const sr of siteResourcesInference) { for (const sr of siteResourcesInference) {
if (!sr.enabled || !sr.alias) continue; if (!sr.enabled || !sr.fullDomain) continue;
if (!config_output.http.routers) config_output.http.routers = {}; if (!config_output.http.routers) config_output.http.routers = {};
if (!config_output.http.services) config_output.http.services = {}; if (!config_output.http.services) config_output.http.services = {};
const alias = sr.alias; const fullDomain = sr.fullDomain;
const srKey = `inference-sr${sr.siteResourceId}`; const srKey = `inference-sr${sr.siteResourceId}`;
const routerName = `${srKey}-router`; const routerName = `${srKey}-router`;
const serviceName = `${srKey}-service`; const serviceName = `${srKey}-service`;
const rule = `Host(\`${alias}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to const rule = `Host(\`${fullDomain}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to
const domainParts = alias.split("."); const domainParts = fullDomain.split(".");
const wildCard = const wildCard =
domainParts.length <= 2 domainParts.length <= 2
? `*.${domainParts.join(".")}` ? `*.${domainParts.join(".")}`
@@ -911,7 +911,7 @@ export async function getTraefikConfig(
headers: { headers: {
customRequestHeaders: { customRequestHeaders: {
...(aiGatewayHost ? { Host: aiGatewayHost } : {}), ...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
"p-host": alias "p-host": fullDomain
} }
} }
}; };
server/private/lib/traefik/getTraefikConfig.ts
+12 -12
View File
@@ -407,7 +407,7 @@ export async function getTraefikConfig(
and( and(
eq(siteResources.enabled, true), eq(siteResources.enabled, true),
isNotNull(siteResources.fullDomain), isNotNull(siteResources.fullDomain),
eq(siteResources.mode, "http"), eq(siteResources.mode, "http"), // important so we dont double get the inference siteResources below
eq(siteResources.ssl, true), eq(siteResources.ssl, true),
eq(sites.exitNodeId, exitNodeId), eq(sites.exitNodeId, exitNodeId),
inArray(sites.type, siteTypes) inArray(sites.type, siteTypes)
@@ -452,7 +452,7 @@ export async function getTraefikConfig(
const siteResourcesInference = await db const siteResourcesInference = await db
.selectDistinct({ .selectDistinct({
siteResourceId: siteResources.siteResourceId, siteResourceId: siteResources.siteResourceId,
alias: siteResources.alias, fullDomain: siteResources.fullDomain,
ssl: siteResources.ssl, ssl: siteResources.ssl,
enabled: siteResources.enabled enabled: siteResources.enabled
}) })
@@ -461,7 +461,7 @@ export async function getTraefikConfig(
and( and(
eq(siteResources.mode, "inference"), eq(siteResources.mode, "inference"),
eq(siteResources.enabled, true), eq(siteResources.enabled, true),
isNotNull(siteResources.alias) isNotNull(siteResources.fullDomain)
) )
); );
@@ -493,8 +493,8 @@ export async function getTraefikConfig(
} }
} }
for (const sr of siteResourcesInference) { for (const sr of siteResourcesInference) {
if (sr.enabled && sr.ssl && sr.alias) { if (sr.enabled && sr.ssl && sr.fullDomain) {
domains.add(sr.alias); domains.add(sr.fullDomain);
} }
} }
// get the valid certs for these domains // get the valid certs for these domains
@@ -1687,20 +1687,20 @@ export async function getTraefikConfig(
// siteResources today (see plan doc), so gating here is // siteResources today (see plan doc), so gating here is
// reachability-only for now. // reachability-only for now.
for (const sr of siteResourcesInference) { for (const sr of siteResourcesInference) {
if (!sr.enabled || !sr.alias) continue; if (!sr.enabled || !sr.fullDomain) continue;
if (!config_output.http.routers) config_output.http.routers = {}; if (!config_output.http.routers) config_output.http.routers = {};
if (!config_output.http.services) config_output.http.services = {}; if (!config_output.http.services) config_output.http.services = {};
const alias = sr.alias; const fullDomain = sr.fullDomain;
const srKey = `inference-sr${sr.siteResourceId}`; const srKey = `inference-sr${sr.siteResourceId}`;
const routerName = `${srKey}-router`; const routerName = `${srKey}-router`;
const serviceName = `${srKey}-service`; const serviceName = `${srKey}-service`;
const rule = `Host(\`${alias}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to const rule = `Host(\`${fullDomain}\`) && ClientIP(${exitNode.address})`; // restrict to coming from the exit node ip range that the client is connected to
let tls: any = {}; let tls: any = {};
if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) { if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
const domainParts = alias.split("."); const domainParts = fullDomain.split(".");
const wildCard = const wildCard =
domainParts.length <= 2 domainParts.length <= 2
? `*.${domainParts.join(".")}` ? `*.${domainParts.join(".")}`
@@ -1719,11 +1719,11 @@ export async function getTraefikConfig(
}; };
} else { } else {
const matchingCert = validCerts.find( const matchingCert = validCerts.find(
(cert) => cert.queriedDomain === alias (cert) => cert.queriedDomain === fullDomain
); );
if (!matchingCert) { if (!matchingCert) {
logger.debug( logger.debug(
`No matching certificate found for inference siteResource alias: ${alias}` `No matching certificate found for inference siteResource fullDomain: ${fullDomain}`
); );
continue; continue;
} }
@@ -1739,7 +1739,7 @@ export async function getTraefikConfig(
headers: { headers: {
customRequestHeaders: { customRequestHeaders: {
...(aiGatewayHost ? { Host: aiGatewayHost } : {}), ...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
"p-host": alias "p-host": fullDomain
} }
} }
}; };
server/routers/olm/buildConfiguration.ts
+1 -1
View File
@@ -98,7 +98,7 @@ export async function buildSiteConfigurationForOlmClient(
} }
exitNodeAliases = siteResourcesForExitNode exitNodeAliases = siteResourcesForExitNode
.map((sr) => sr.alias) .map((sr) => sr.fullDomain || sr.alias) // take either in case we introduce different resource types that don't have a fullDomain
.filter((a) => a != null); .filter((a) => a != null);
if (sitesData.length == 0) { if (sitesData.length == 0) {