Push client identities to newt

server/routers/newt/buildConfiguration.ts

@@ -24,6 +24,10 @@ import {
     generateSubnetProxyTargetV2,
     SubnetProxyTargetV2
 } from "@server/lib/ip";
+import {
+    ClientIdentity,
+    getClientIdentities
+} from "@server/lib/clientIdentities";
 
 export async function buildClientConfigurationForNewtClient(
     site: Site,
@@ -166,7 +170,8 @@ export async function buildClientConfigurationForNewtClient(
     if (allSiteResources.length === 0) {
         return {
             peers: validPeers,
-            targets: targetsToSend
+            targets: targetsToSend,
+            clientIdentities: [] as ClientIdentity[]
         };
     }
 
@@ -234,9 +239,26 @@ export async function buildClientConfigurationForNewtClient(
         }
     }
 
+    // Only clients that can reach an HTTP resource ever hit newt's HTTP proxy,
+    // so those are the only identities it needs to set Remote-* headers.
+    const httpClientIds = new Set<number>();
+    for (const resource of allSiteResources) {
+        if (resource.mode !== "http") {
+            continue;
+        }
+        for (const c of clientsByResourceId.get(resource.siteResourceId) ??
+            []) {
+            httpClientIds.add(c.clientId);
+        }
+    }
+    const clientIdentities = Array.from(
+        (await getClientIdentities(httpClientIds)).values()
+    );
+
     return {
         peers: validPeers,
-        targets: targetsToSend
+        targets: targetsToSend,
+        clientIdentities
     };
 }