ai gateway override only required sometimes

server/private/lib/traefik/getTraefikConfig.ts

@@ -1542,6 +1542,12 @@ export async function getTraefikConfig(
             aiGatewayHost = undefined;
         }
 
+        // The p-host smuggling above is only necessary when the AI gateway
+        // is overridden to a different host than the resource's own. In the
+        // default case, leave the Host header untouched so it's visible on
+        // the other end.
+        const aiGatewayOverride = config.getRawConfig().server.ai_gateway_override;
+
         // Public inference resources: same TLS/cert-resolver handling as
         // plain http-mode resources, but the service points at the AI
         // gateway instead of any real backend targets.
@@ -1607,6 +1613,11 @@ export async function getTraefikConfig(
                 }
             }
 
+            const additionalMiddlewares =
+                config.getRawConfig().traefik.additional_middlewares || [];
+            const routerMiddlewares = [badgerMiddlewareName];
+
+            if (aiGatewayOverride) {
                 const irHeadersMiddlewareName = `${irKey}-headers-middleware`;
                 config_output.http.middlewares[irHeadersMiddlewareName] = {
                     headers: {
@@ -1616,14 +1627,10 @@ export async function getTraefikConfig(
                         }
                     }
                 };
+                routerMiddlewares.push(irHeadersMiddlewareName);
+            }
 
-            const additionalMiddlewares =
+            routerMiddlewares.push(...additionalMiddlewares);
-                config.getRawConfig().traefik.additional_middlewares || [];
-            const routerMiddlewares = [
-                badgerMiddlewareName,
-                irHeadersMiddlewareName,
-                ...additionalMiddlewares
-            ];
 
             if (ir.ssl) {
                 config_output.http.routers[routerName + "-redirect"] = {
@@ -1705,6 +1712,11 @@ export async function getTraefikConfig(
                 }
             }
 
+            const additionalMiddlewares =
+                config.getRawConfig().traefik.additional_middlewares || [];
+            const routerMiddlewares: string[] = [];
+
+            if (aiGatewayOverride) {
                 const srHeadersMiddlewareName = `${srKey}-headers-middleware`;
                 config_output.http.middlewares[srHeadersMiddlewareName] = {
                     headers: {
@@ -1714,13 +1726,10 @@ export async function getTraefikConfig(
                         }
                     }
                 };
+                routerMiddlewares.push(srHeadersMiddlewareName);
+            }
 
-            const additionalMiddlewares =
+            routerMiddlewares.push(...additionalMiddlewares);
-                config.getRawConfig().traefik.additional_middlewares || [];
-            const routerMiddlewares = [
-                srHeadersMiddlewareName,
-                ...additionalMiddlewares
-            ];
 
             if (sr.ssl) {
                 config_output.http.routers[routerName + "-redirect"] = {