From 2bf426bc222aa41591eaab0edbbaf3d83a5d8c69 Mon Sep 17 00:00:00 2001 From: Owen Date: Tue, 4 Aug 2026 15:36:31 -0400 Subject: [PATCH 1/3] dont restrict to enterprise and dont link with providers yet --- .../private/lib/traefik/getTraefikConfig.ts | 50 ++++++++----------- 1 file changed, 20 insertions(+), 30 deletions(-) diff --git a/server/private/lib/traefik/getTraefikConfig.ts b/server/private/lib/traefik/getTraefikConfig.ts index 8e1b1eca2..3c8a1cab2 100644 --- a/server/private/lib/traefik/getTraefikConfig.ts +++ b/server/private/lib/traefik/getTraefikConfig.ts @@ -427,34 +427,26 @@ export async function getTraefikConfig( ) ); - let siteResourcesInference: { - siteResourceId: number; - alias: string | null; - ssl: boolean | null; - enabled: boolean | null; - }[] = []; - if (build == "enterprise") { - siteResourcesInference = await db - .select({ - siteResourceId: siteResources.siteResourceId, - alias: siteResources.alias, - ssl: siteResources.ssl, - enabled: siteResources.enabled - }) - .from(siteResources) - .innerJoin( - aiProviders, - eq(siteResources.aiProviderId, aiProviders.providerId) + const siteResourcesInference = await db + .select({ + siteResourceId: siteResources.siteResourceId, + alias: siteResources.alias, + ssl: siteResources.ssl, + enabled: siteResources.enabled + }) + .from(siteResources) + // .innerJoin( + // aiProviders, + // eq(siteResources.aiProviderId, aiProviders.providerId) + // ) + .where( + and( + eq(siteResources.mode, "inference"), + eq(siteResources.enabled, true), + // eq(aiProviders.enabled, true), + isNotNull(siteResources.alias) ) - .where( - and( - eq(siteResources.mode, "inference"), - eq(siteResources.enabled, true), - eq(aiProviders.enabled, true), - isNotNull(siteResources.alias) - ) - ); - } + ); let validCerts: CertificateResult[] = []; if (privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) { @@ -1586,9 +1578,7 @@ export async function getTraefikConfig( tls = { certResolver: resolverName, - ...(preferWildcard - ? { domains: [{ main: wildCard }] } - : {}) + ...(preferWildcard ? { domains: [{ main: wildCard }] } : {}) }; } else { const matchingCert = validCerts.find( From ec5a2b0cbe9841f60a7c3bf7c63b202d83f1830c Mon Sep 17 00:00:00 2001 From: Owen Date: Tue, 4 Aug 2026 15:36:40 -0400 Subject: [PATCH 2/3] add peers to exit node --- server/routers/olm/handleOlmRegisterMessage.ts | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/server/routers/olm/handleOlmRegisterMessage.ts b/server/routers/olm/handleOlmRegisterMessage.ts index 95c5e0d47..c0cee86d9 100644 --- a/server/routers/olm/handleOlmRegisterMessage.ts +++ b/server/routers/olm/handleOlmRegisterMessage.ts @@ -28,6 +28,7 @@ import { verifyExitNodeOrgAccess } from "#dynamic/lib/exitNodes"; import { getUniqueSubnetForExitNode } from "@server/lib/exitNodes"; +import { addPeer } from "../gerbil/peers"; const HOLEPUNCH_STALE_CHAIN_THRESHOLD = 18; const HOLEPUNCH_STALE_CHAIN_TTL_SECONDS = 1800; @@ -393,6 +394,18 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => { ); } + if (clientSubnet && exitNodeId) { + try { + // add the peer to the exit node so it can connect + await addPeer(exitNodeId, { + publicKey: publicKey, + allowedIps: [clientSubnet] + }); + } catch (error) { + logger.error(`Failed to add peer to exit node: ${error}`); + } + } + let staleHolePunchChainCount: number | undefined; const hasChainId = chainId !== undefined && chainId !== null && String(chainId) !== ""; @@ -490,7 +503,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => { endpoint: `${exitNode.endpoint}:${exitNode.listenPort}`, publicKey: exitNode.publicKey, serverIP: exitNode.address.split("/")[0], - tunnelIP: client.exitNodeSubnet.split("/")[0] + tunnelIP: `${client.exitNodeSubnet.split("/")[0]}/${exitNode.address.split("/")[1]}` // we need to use the exit node's subnet mask here because the client will be using the exit node's subnet mask for its routing table so we can address it } : undefined, chainId: chainId From 2cfd7e867beaa01ba02390ed781c8d9fbb4a0b8e Mon Sep 17 00:00:00 2001 From: Owen Date: Tue, 4 Aug 2026 15:45:44 -0400 Subject: [PATCH 3/3] delete the client peers from the exit nodes properly --- server/lib/deleteOrg.ts | 3 +++ server/routers/olm/handleOlmRegisterMessage.ts | 8 +++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/server/lib/deleteOrg.ts b/server/lib/deleteOrg.ts index 20c8a3e23..43921e41b 100644 --- a/server/lib/deleteOrg.ts +++ b/server/lib/deleteOrg.ts @@ -93,6 +93,9 @@ export async function deleteOrgById( await trx.delete(sites).where(eq(sites.siteId, site.siteId)); } for (const client of orgClients) { + if (client.exitNodeId && client.pubKey) { + await deletePeer(client.exitNodeId, client.pubKey); + } const [olm] = await trx .select() .from(olms) diff --git a/server/routers/olm/handleOlmRegisterMessage.ts b/server/routers/olm/handleOlmRegisterMessage.ts index c0cee86d9..5cd38dabe 100644 --- a/server/routers/olm/handleOlmRegisterMessage.ts +++ b/server/routers/olm/handleOlmRegisterMessage.ts @@ -28,7 +28,7 @@ import { verifyExitNodeOrgAccess } from "#dynamic/lib/exitNodes"; import { getUniqueSubnetForExitNode } from "@server/lib/exitNodes"; -import { addPeer } from "../gerbil/peers"; +import { addPeer, deletePeer } from "../gerbil/peers"; const HOLEPUNCH_STALE_CHAIN_THRESHOLD = 18; const HOLEPUNCH_STALE_CHAIN_TTL_SECONDS = 1800; @@ -394,6 +394,12 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => { ); } + if (client.pubKey && client.pubKey !== publicKey && client.exitNodeId) { + // test the old client to see if its different then remove + logger.info("Public key mismatch. Deleting old peer..."); + await deletePeer(client.exitNodeId, client.pubKey); + } + if (clientSubnet && exitNodeId) { try { // add the peer to the exit node so it can connect