misc: addressed comments

backend/src/db/migrations/20250825131627_add-gateway-v2-pki-and-ssh-configs.ts

@@ -98,8 +98,10 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("identityId");
       t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
 
-      t.string("name").notNullable().unique();
-      t.string("ip").notNullable();
+      t.string("name").notNullable();
+      t.string("host").notNullable();
+
+      t.unique(["orgId", "name"]);
     });
 
     await createOnUpdateTrigger(knex, TableName.Relay);
@@ -119,7 +121,9 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("relayId");
       t.foreign("relayId").references("id").inTable(TableName.Relay).onDelete("SET NULL");
 
-      t.string("name").notNullable().unique();
+      t.string("name").notNullable();
+
+      t.unique(["orgId", "name"]);
 
       t.dateTime("heartbeat");
     });

backend/src/db/schemas/relays.ts

@@ -14,7 +14,7 @@ export const RelaysSchema = z.object({
   orgId: z.string().uuid().nullable().optional(),
   identityId: z.string().uuid().nullable().optional(),
   name: z.string(),
-  ip: z.string()
+  host: z.string()
 });
 
 export type TRelays = z.infer<typeof RelaysSchema>;

backend/src/ee/routes/v1/relay-router.ts

@@ -18,7 +18,7 @@ export const registerRelayRouter = async (server: FastifyZodProvider) => {
     },
     schema: {
       body: z.object({
-        ip: z.string(),
+        host: z.string(),
         name: z.string()
       }),
       response: {
@@ -68,7 +68,7 @@ export const registerRelayRouter = async (server: FastifyZodProvider) => {
     },
     schema: {
       body: z.object({
-        ip: z.string(),
+        host: z.string(),
         name: z.string()
       }),
       response: {

backend/src/ee/services/dynamic-secret/providers/kubernetes.ts

@@ -79,7 +79,7 @@ export const KubernetesProvider = ({
           );
         },
         {
-          relayIp: gatewayV2ConnectionDetails.relayIp,
+          relayHost: gatewayV2ConnectionDetails.relayHost,
           gateway: gatewayV2ConnectionDetails.gateway,
           relay: gatewayV2ConnectionDetails.relay,
           protocol: inputs.reviewTokenThroughGateway ? GatewayProxyProtocol.Http : GatewayProxyProtocol.Tcp,

backend/src/ee/services/dynamic-secret/providers/sql-database.ts

@@ -203,7 +203,7 @@ export const SqlDatabaseProvider = ({
           await gatewayCallback("localhost", port);
         },
         {
-          relayIp: gatewayV2ConnectionDetails.relayIp,
+          relayHost: gatewayV2ConnectionDetails.relayHost,
           gateway: gatewayV2ConnectionDetails.gateway,
           relay: gatewayV2ConnectionDetails.relay,
           protocol: GatewayProxyProtocol.Tcp

backend/src/ee/services/gateway-v2/gateway-v2-service.ts

@@ -25,7 +25,6 @@ import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionGatewayActions, OrgPermissionSubjects } from "../permission/org-permission";
 import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TRelayDALFactory } from "../relay/relay-dal";
-import { isInstanceRelay } from "../relay/relay-fns";
 import { TRelayServiceFactory } from "../relay/relay-service";
 import { GATEWAY_ACTOR_OID, GATEWAY_ROUTING_INFO_OID } from "./gateway-v2-constants";
 import { TGatewayV2DALFactory } from "./gateway-v2-dal";
@@ -399,7 +398,7 @@ export const gatewayV2ServiceFactory = ({
     });
 
     return {
-      relayIp: relayCredentials.relayIp,
+      relayHost: relayCredentials.relayHost,
       gateway: {
         clientCertificate: clientCert.toString("pem"),
         clientPrivateKey: gatewayClientCertPrivateKey.export({ format: "pem", type: "pkcs8" }).toString(),
@@ -429,11 +428,9 @@ export const gatewayV2ServiceFactory = ({
     await $validateIdentityAccessToGateway(orgId, actorId, actorAuthMethod);
     const orgCAs = await $getOrgCAs(orgId);
 
-    let relay: TRelays;
-    if (isInstanceRelay(relayName)) {
-      relay = await relayDAL.findOne({ name: relayName });
-    } else {
-      relay = await relayDAL.findOne({ orgId, name: relayName });
+    let relay: TRelays = await relayDAL.findOne({ orgId, name: relayName });
+    if (!relay) {
+      relay = await relayDAL.findOne({ name: relayName, orgId: null });
     }
 
     if (!relay) {
@@ -515,7 +512,7 @@ export const gatewayV2ServiceFactory = ({
 
       return {
         gatewayId: gateway.id,
-        relayIp: relayCredentials.relayIp,
+        relayHost: relayCredentials.relayHost,
         pki: {
           serverCertificate: gatewayServerCertificate.toString("pem"),
           serverPrivateKey: gatewayServerCertPrivateKey.export({ format: "pem", type: "pkcs8" }).toString(),
@@ -613,7 +610,7 @@ export const gatewayV2ServiceFactory = ({
       },
       {
         protocol: GatewayProxyProtocol.Ping,
-        relayIp: gatewayV2ConnectionDetails.relayIp,
+        relayHost: gatewayV2ConnectionDetails.relayHost,
         gateway: gatewayV2ConnectionDetails.gateway,
         relay: gatewayV2ConnectionDetails.relay
       }

backend/src/ee/services/relay/relay-fns.ts

@@ -1,5 +0,0 @@
-export const INSTANCE_RELAY_PREFIX = "infisical-";
-
-export const isInstanceRelay = (relayName: string) => {
-  return relayName.startsWith(INSTANCE_RELAY_PREFIX);
-};

backend/src/ee/services/relay/relay-service.ts

@@ -19,7 +19,6 @@ import { SshCertKeyAlgorithm } from "../ssh-certificate/ssh-certificate-types";
 import { TInstanceRelayConfigDALFactory } from "./instance-relay-config-dal";
 import { TOrgRelayConfigDALFactory } from "./org-relay-config-dal";
 import { TRelayDALFactory } from "./relay-dal";
-import { isInstanceRelay } from "./relay-fns";
 
 export type TRelayServiceFactory = ReturnType<typeof relayServiceFactory>;
 
@@ -588,7 +587,7 @@ export const relayServiceFactory = ({
   };
 
   const $generateRelayServerCredentials = async ({
-    ip,
+    host,
     orgId,
     relayPkiServerCaCertificate,
     relayPkiServerCaPrivateKey,
@@ -597,7 +596,7 @@ export const relayServiceFactory = ({
     relaySshClientCaPublicKey,
     relaySshServerCaPrivateKey
   }: {
-    ip: string;
+    host: string;
     relayPkiServerCaCertificate: Buffer;
     relayPkiServerCaPrivateKey: Buffer;
     relayPkiClientCaCertificateChain: Buffer;
@@ -640,13 +639,13 @@ export const relayServiceFactory = ({
       ),
       new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.SERVER_AUTH]], true),
       // san
-      new x509.SubjectAlternativeNameExtension([{ type: "ip", value: ip }], false)
+      new x509.SubjectAlternativeNameExtension([{ type: "ip", value: host }], false)
     ];
 
     const relayServerSerialNumber = createSerialNumber();
     const relayServerCertificate = await x509.X509CertificateGenerator.create({
       serialNumber: relayServerSerialNumber,
-      subject: `CN=${ip},O=${orgId ?? "Infisical"},OU=Relay`,
+      subject: `CN=${host},O=${orgId ?? "Infisical"},OU=Relay`,
       issuer: relayServerCaCert.subject,
       notBefore: relayServerCertIssuedAt,
       notAfter: relayServerCertExpireAt,
@@ -665,7 +664,7 @@ export const relayServiceFactory = ({
       caPrivateKey: relaySshServerCaPrivateKey.toString("utf8"),
       clientPublicKey: relayServerSshPublicKey,
       keyId: "relay-server",
-      principals: [`${ip}:2222`],
+      principals: [`${host}:2222`],
       certType: SshCertType.HOST,
       requestedTtl: "30d"
     });
@@ -772,15 +771,15 @@ export const relayServiceFactory = ({
     orgId: string;
     gatewayId: string;
   }) => {
-    let relay: TRelays | null;
-    if (isInstanceRelay(relayName)) {
+    let relay: TRelays | null = await relayDAL.findOne({
+      orgId,
+      name: relayName
+    });
+
+    if (!relay) {
       relay = await relayDAL.findOne({
-        name: relayName
-      });
-    } else {
-      relay = await relayDAL.findOne({
-        orgId,
-        name: relayName
+        name: relayName,
+        orgId: null
       });
     }
 
@@ -794,7 +793,7 @@ export const relayServiceFactory = ({
     const { publicKey: relayClientSshPublicKey, privateKey: relayClientSshPrivateKey } =
       await createSshKeyPair(keyAlgorithm);
 
-    if (isInstanceRelay(relayName)) {
+    if (relay.orgId === null) {
       const instanceCAs = await $getInstanceCAs();
       const relayClientSshCert = await createSshCert({
         caPrivateKey: instanceCAs.instanceRelaySshClientCaPrivateKey.toString("utf8"),
@@ -806,7 +805,7 @@ export const relayServiceFactory = ({
       });
 
       return {
-        relayIp: relay.ip,
+        relayHost: relay.host,
         clientSshCert: relayClientSshCert.signedPublicKey,
         clientSshPrivateKey: relayClientSshPrivateKey,
         serverCAPublicKey: instanceCAs.instanceRelaySshServerCaPublicKey.toString("utf8")
@@ -824,7 +823,7 @@ export const relayServiceFactory = ({
     });
 
     return {
-      relayIp: relay.ip,
+      relayHost: relay.host,
       clientSshCert: relayClientSshCert.signedPublicKey,
       clientSshPrivateKey: relayClientSshPrivateKey,
       serverCAPublicKey: orgCAs.relaySshServerCaPublicKey.toString("utf8")
@@ -850,7 +849,7 @@ export const relayServiceFactory = ({
       });
     }
 
-    if (isInstanceRelay(relay.name)) {
+    if (relay.orgId === null) {
       const instanceCAs = await $getInstanceCAs();
       const relayCertificateCredentials = await $generateRelayClientCredentials({
         gatewayId,
@@ -863,7 +862,7 @@ export const relayServiceFactory = ({
 
       return {
         ...relayCertificateCredentials,
-        relayIp: relay.ip
+        relayHost: relay.host
       };
     }
 
@@ -879,17 +878,17 @@ export const relayServiceFactory = ({
 
     return {
       ...relayCertificateCredentials,
-      relayIp: relay.ip
+      relayHost: relay.host
     };
   };
 
   const registerRelay = async ({
-    ip,
+    host,
     name,
     identityId,
     orgId
   }: {
-    ip: string;
+    host: string;
     name: string;
     identityId?: string;
     orgId?: string;
@@ -898,12 +897,6 @@ export const relayServiceFactory = ({
     const isOrgRelay = identityId && orgId;
 
     if (isOrgRelay) {
-      if (isInstanceRelay(name)) {
-        throw new BadRequestError({
-          message: "Org relay name cannot start with 'infisical-'. This is reserved for internal use."
-        });
-      }
-
       relay = await relayDAL.transaction(async (tx) => {
         const existingRelay = await relayDAL.findOne(
           {
@@ -913,7 +906,7 @@ export const relayServiceFactory = ({
           tx
         );
 
-        if (existingRelay && (existingRelay.ip !== ip || existingRelay.name !== name)) {
+        if (existingRelay && (existingRelay.host !== host || existingRelay.name !== name)) {
           throw new BadRequestError({
             message: "Org relay with this machine identity already exists."
           });
@@ -922,7 +915,7 @@ export const relayServiceFactory = ({
         if (!existingRelay) {
           return relayDAL.create(
             {
-              ip,
+              host,
               name,
               identityId,
               orgId
@@ -934,30 +927,25 @@ export const relayServiceFactory = ({
         return existingRelay;
       });
     } else {
-      if (!isInstanceRelay(name)) {
-        throw new BadRequestError({
-          message: "Instance relay name must start with 'infisical-'."
-        });
-      }
-
       relay = await relayDAL.transaction(async (tx) => {
         const existingRelay = await relayDAL.findOne(
           {
-            name
+            name,
+            orgId: null
           },
           tx
         );
 
-        if (existingRelay && existingRelay.ip !== ip) {
+        if (existingRelay && existingRelay.host !== host) {
           throw new BadRequestError({
-            message: "Instance relay with this name already exists with a different IP address"
+            message: "Instance relay with this name already exists with a different host"
           });
         }
 
         if (!existingRelay) {
           return relayDAL.create(
             {
-              ip,
+              host,
               name
             },
             tx
@@ -968,10 +956,10 @@ export const relayServiceFactory = ({
       });
     }
 
-    if (isInstanceRelay(name)) {
+    if (relay.orgId === null) {
       const instanceCAs = await $getInstanceCAs();
       return $generateRelayServerCredentials({
-        ip,
+        host,
         relayPkiServerCaCertificate: instanceCAs.instanceRelayPkiServerCaCertificate,
         relayPkiServerCaPrivateKey: instanceCAs.instanceRelayPkiServerCaPrivateKey,
         relayPkiClientCaCertificate: instanceCAs.instanceRelayPkiClientCaCertificate,
@@ -984,7 +972,7 @@ export const relayServiceFactory = ({
     if (relay.orgId) {
       const orgCAs = await $getOrgCAs(relay.orgId);
       return $generateRelayServerCredentials({
-        ip,
+        host,
         orgId: relay.orgId,
         relayPkiServerCaCertificate: orgCAs.relayPkiServerCaCertificate,
         relayPkiServerCaPrivateKey: orgCAs.relayPkiServerCaPrivateKey,

backend/src/lib/gateway-v2/gateway-v2.ts

@@ -19,23 +19,24 @@ interface IGatewayRelayServer {
 }
 
 const createRelayConnection = async ({
-  relayIp,
+  relayHost,
   clientCertificate,
   clientPrivateKey,
   serverCertificateChain
 }: {
-  relayIp: string;
+  relayHost: string;
   clientCertificate: string;
   clientPrivateKey: string;
   serverCertificateChain: string;
 }): Promise<net.Socket> => {
-  const [targetHost] = await verifyHostInputValidity(relayIp);
-  const [, portStr] = relayIp.split(":");
+  const [targetHost] = await verifyHostInputValidity(relayHost);
+  const [, portStr] = relayHost.split(":");
   const port = parseInt(portStr, 10) || 8443;
 
   const serverCAs = splitPemChain(serverCertificateChain);
   const tlsOptions: tls.ConnectionOptions = {
     host: targetHost,
+    servername: relayHost,
     port,
     cert: clientCertificate,
     key: clientPrivateKey,
@@ -121,13 +122,13 @@ const createGatewayConnection = async (
 
 const setupRelayServer = async ({
   protocol,
-  relayIp,
+  relayHost,
   gateway,
   relay,
   httpsAgent
 }: {
   protocol: GatewayProxyProtocol;
-  relayIp: string;
+  relayHost: string;
   gateway: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string };
   relay: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string };
   httpsAgent?: https.Agent;
@@ -145,7 +146,7 @@ const setupRelayServer = async ({
 
           // Stage 1: Connect to relay with TLS
           const relayConn = await createRelayConnection({
-            relayIp,
+            relayHost,
             clientCertificate: relay.clientCertificate,
             clientPrivateKey: relay.clientPrivateKey,
             serverCertificateChain: relay.serverCertificateChain
@@ -244,17 +245,17 @@ export const withGatewayV2Proxy = async <T>(
   callback: (port: number) => Promise<T>,
   options: {
     protocol: GatewayProxyProtocol;
-    relayIp: string;
+    relayHost: string;
     gateway: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string };
     relay: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string };
     httpsAgent?: https.Agent;
   }
 ): Promise<T> => {
-  const { protocol, relayIp, gateway, relay, httpsAgent } = options;
+  const { protocol, relayHost, gateway, relay, httpsAgent } = options;
 
   const { port, cleanup, getRelayError } = await setupRelayServer({
     protocol,
-    relayIp,
+    relayHost,
     gateway,
     relay,
     httpsAgent

backend/src/services/app-connection/github/github-connection-fns.ts

@@ -105,7 +105,7 @@ export const requestWithGitHubGateway = async <T>(
       },
       {
         protocol: GatewayProxyProtocol.Tcp,
-        relayIp: gatewayConnectionDetails.relayIp,
+        relayHost: gatewayConnectionDetails.relayHost,
         gateway: gatewayConnectionDetails.gateway,
         relay: gatewayConnectionDetails.relay
       }

backend/src/services/app-connection/shared/sql/sql-connection-fns.ts

@@ -142,7 +142,7 @@ export const executeWithPotentialGateway = async <T>(
         },
         {
           protocol: GatewayProxyProtocol.Tcp,
-          relayIp: platformConnectionDetails.relayIp,
+          relayHost: platformConnectionDetails.relayHost,
           gateway: platformConnectionDetails.gateway,
           relay: platformConnectionDetails.relay
         }

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -114,7 +114,7 @@ export const identityKubernetesAuthServiceFactory = ({
         },
         {
           protocol: inputs.reviewTokenThroughGateway ? GatewayProxyProtocol.Http : GatewayProxyProtocol.Tcp,
-          relayIp: gatewayV2ConnectionDetails.relayIp,
+          relayHost: gatewayV2ConnectionDetails.relayHost,
           gateway: gatewayV2ConnectionDetails.gateway,
           relay: gatewayV2ConnectionDetails.relay,
           httpsAgent