calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-28 23:15:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

Split out the token header into a common middleware for efficiency

Browse Source
This commit is contained in:
Owen
2026-08-12 16:30:42 -04:00
parent cc58e28e54
commit 860fa47b7c
2 changed files with 58 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/lib/traefik/getTraefikConfig.ts
+19 -4
View File
@@ -752,6 +752,21 @@ export async function getTraefikConfig(
aiGatewayHost = undefined; aiGatewayHost = undefined;
} }
// The trust header is the same for every inference route on this
// exit node, so it's defined once here and attached to each router
// below instead of being duplicated into a per-resource middleware.
const aiGatewayTrustMiddlewareName = "ai-gateway-trust-headers";
if (!config_output.http.middlewares) {
config_output.http.middlewares = {};
}
config_output.http.middlewares[aiGatewayTrustMiddlewareName] = {
headers: {
customRequestHeaders: {
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken()
}
}
};
// Public inference resources: same TLS/cert-resolver handling as // Public inference resources: same TLS/cert-resolver handling as
// plain http-mode resources, but the service points at the AI // plain http-mode resources, but the service points at the AI
// gateway instead of any real backend targets. // gateway instead of any real backend targets.
@@ -812,8 +827,7 @@ export async function getTraefikConfig(
headers: { headers: {
customRequestHeaders: { customRequestHeaders: {
...(aiGatewayHost ? { Host: aiGatewayHost } : {}), ...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
"p-host": fullDomain, "p-host": fullDomain
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken()
} }
} }
}; };
@@ -822,6 +836,7 @@ export async function getTraefikConfig(
config.getRawConfig().traefik.additional_middlewares || []; config.getRawConfig().traefik.additional_middlewares || [];
const routerMiddlewares = [ const routerMiddlewares = [
badgerMiddlewareName, badgerMiddlewareName,
aiGatewayTrustMiddlewareName,
irHeadersMiddlewareName, irHeadersMiddlewareName,
...additionalMiddlewares ...additionalMiddlewares
]; ];
@@ -916,8 +931,7 @@ export async function getTraefikConfig(
headers: { headers: {
customRequestHeaders: { customRequestHeaders: {
...(aiGatewayHost ? { Host: aiGatewayHost } : {}), ...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
"p-host": fullDomain, "p-host": fullDomain
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken()
} }
} }
}; };
@@ -925,6 +939,7 @@ export async function getTraefikConfig(
const additionalMiddlewares = const additionalMiddlewares =
config.getRawConfig().traefik.additional_middlewares || []; config.getRawConfig().traefik.additional_middlewares || [];
const routerMiddlewares = [ const routerMiddlewares = [
aiGatewayTrustMiddlewareName,
srHeadersMiddlewareName, srHeadersMiddlewareName,
...additionalMiddlewares ...additionalMiddlewares
]; ];
server/private/lib/traefik/getTraefikConfig.ts
+39 -26
View File
@@ -1569,6 +1569,18 @@ export async function getTraefikConfig(
const aiGatewayOverride = const aiGatewayOverride =
config.getRawConfig().server.ai_gateway_override; config.getRawConfig().server.ai_gateway_override;
// The trust header is the same for every inference route on this
// exit node, so it's defined once here and attached to each router
// below instead of being duplicated into a per-resource middleware.
const aiGatewayTrustMiddlewareName = "ai-gateway-trust-headers";
config_output.http.middlewares[aiGatewayTrustMiddlewareName] = {
headers: {
customRequestHeaders: {
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken()
}
}
};
// Public inference resources: same TLS/cert-resolver handling as // Public inference resources: same TLS/cert-resolver handling as
// plain http-mode resources, but the service points at the AI // plain http-mode resources, but the service points at the AI
// gateway instead of any real backend targets. // gateway instead of any real backend targets.
@@ -1636,21 +1648,23 @@ export async function getTraefikConfig(
const additionalMiddlewares = const additionalMiddlewares =
config.getRawConfig().traefik.additional_middlewares || []; config.getRawConfig().traefik.additional_middlewares || [];
const routerMiddlewares = [badgerMiddlewareName]; const routerMiddlewares = [
badgerMiddlewareName,
aiGatewayTrustMiddlewareName
];
const irHeadersMiddlewareName = `${irKey}-headers-middleware`; if (aiGatewayOverride) {
config_output.http.middlewares[irHeadersMiddlewareName] = { const irHeadersMiddlewareName = `${irKey}-headers-middleware`;
headers: { config_output.http.middlewares[irHeadersMiddlewareName] = {
customRequestHeaders: { headers: {
...(aiGatewayOverride && aiGatewayHost customRequestHeaders: {
? { Host: aiGatewayHost } ...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
: {}), "p-host": fullDomain
...(aiGatewayOverride ? { "p-host": fullDomain } : {}), }
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken()
} }
} };
}; routerMiddlewares.push(irHeadersMiddlewareName);
routerMiddlewares.push(irHeadersMiddlewareName); }
routerMiddlewares.push(...additionalMiddlewares); routerMiddlewares.push(...additionalMiddlewares);
@@ -1736,21 +1750,20 @@ export async function getTraefikConfig(
const additionalMiddlewares = const additionalMiddlewares =
config.getRawConfig().traefik.additional_middlewares || []; config.getRawConfig().traefik.additional_middlewares || [];
const routerMiddlewares: string[] = []; const routerMiddlewares: string[] = [aiGatewayTrustMiddlewareName];
const srHeadersMiddlewareName = `${srKey}-headers-middleware`; if (aiGatewayOverride) {
config_output.http.middlewares[srHeadersMiddlewareName] = { const srHeadersMiddlewareName = `${srKey}-headers-middleware`;
headers: { config_output.http.middlewares[srHeadersMiddlewareName] = {
customRequestHeaders: { headers: {
...(aiGatewayOverride && aiGatewayHost customRequestHeaders: {
? { Host: aiGatewayHost } ...(aiGatewayHost ? { Host: aiGatewayHost } : {}),
: {}), "p-host": fullDomain
...(aiGatewayOverride ? { "p-host": fullDomain } : {}), }
[AI_GATEWAY_TRUST_HEADER]: getAiGatewayTrustToken()
} }
} };
}; routerMiddlewares.push(srHeadersMiddlewareName);
routerMiddlewares.push(srHeadersMiddlewareName); }
routerMiddlewares.push(...additionalMiddlewares); routerMiddlewares.push(...additionalMiddlewares);