dstack 0.0.9__py3-none-any.whl → 0.20.7__py3-none-any.whl

dstack/_internal/core/services/ssh/key_manager.py

@@ -0,0 +1,53 @@
+import os
+from dataclasses import dataclass
+from datetime import datetime, timedelta
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from dstack._internal.core.errors import ClientError
+
+if TYPE_CHECKING:
+    from dstack.api.server import APIClient
+
+KEY_REFRESH_RATE = timedelta(minutes=10)  # redownload the key periodically in case it was rotated
+
+
+@dataclass
+class UserSSHKey:
+    public_key: str
+    private_key_path: Path
+
+
+class UserSSHKeyManager:
+    def __init__(self, api_client: "APIClient", ssh_keys_dir: Path) -> None:
+        self._api_client = api_client
+        self._key_path = ssh_keys_dir / api_client.get_token_hash()
+        self._pub_key_path = self._key_path.with_suffix(".pub")
+
+    def get_user_key(self) -> UserSSHKey:
+        """
+        Return the up-to-date user key
+        """
+        if (
+            not self._key_path.exists()
+            or not self._pub_key_path.exists()
+            or datetime.now() - datetime.fromtimestamp(self._key_path.stat().st_mtime)
+            > KEY_REFRESH_RATE
+        ):
+            self._download_user_key()
+        return UserSSHKey(
+            public_key=self._pub_key_path.read_text(), private_key_path=self._key_path
+        )
+
+    def _download_user_key(self) -> None:
+        user = self._api_client.users.get_my_user()
+        if user.ssh_private_key is None or user.ssh_public_key is None:
+            raise ClientError("Server response does not contain user SSH key")
+
+        def key_opener(path, flags):
+            return os.open(path, flags, 0o600)
+
+        with open(self._key_path, "w", opener=key_opener) as f:
+            f.write(user.ssh_private_key)
+        with open(self._pub_key_path, "w") as f:
+            f.write(user.ssh_public_key)

dstack/_internal/core/services/ssh/ports.py

@@ -0,0 +1,89 @@
+import errno
+import socket
+from typing import Dict, List, Optional
+
+from dstack._internal.compat import IS_WINDOWS
+from dstack._internal.core.errors import DstackError
+from dstack._internal.core.models.configurations import PortMapping
+
+RESERVED_PORTS_START = 10000
+RESERVED_PORTS_END = 10999
+
+
+class PortUsedError(DstackError):
+    pass
+
+
+class PortsLock:
+    def __init__(self, restrictions: Optional[Dict[int, int]] = None):
+        self.restrictions = restrictions or {}
+        self.sockets: Dict[int, socket.socket] = {}
+
+    def acquire(self) -> "PortsLock":
+        assert not self.sockets
+        assigned_ports = set()
+
+        # mapped by user
+        for remote_port, local_port in self.restrictions.items():
+            if not local_port:  # None or 0
+                continue
+            if local_port in assigned_ports:
+                raise PortUsedError(f"Port {local_port} is already in use")
+            sock = self._listen(local_port)
+            if sock is None:
+                raise PortUsedError(f"Port {local_port} is already in use")
+            self.sockets[remote_port] = sock
+            assigned_ports.add(local_port)
+
+        # mapped automatically
+        for remote_port, local_port in self.restrictions.items():
+            if local_port:
+                continue
+            local_port = remote_port
+            while True:
+                if local_port not in assigned_ports:
+                    sock = self._listen(local_port)
+                    if sock is not None:
+                        break
+                local_port += 1
+            self.sockets[remote_port] = sock
+            assigned_ports.add(local_port)
+        return self
+
+    def release(self) -> Dict[int, int]:
+        mapping = self.dict()
+        for sock in self.sockets.values():
+            sock.close()
+        self.sockets = {}
+        return mapping
+
+    def dict(self) -> Dict[int, int]:
+        d = {}
+        for remote_port, local_port in self.restrictions.items():
+            if local_port:
+                d[remote_port] = local_port
+            else:
+                d[remote_port] = self.sockets[remote_port].getsockname()[1]
+        return d
+
+    def __str__(self) -> str:
+        return f"<PortsLock: {self.dict()}>"
+
+    @staticmethod
+    def _listen(port: int) -> Optional[socket.socket]:
+        try:
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            if IS_WINDOWS:
+                sock.setsockopt(socket.SOL_SOCKET, socket.SO_EXCLUSIVEADDRUSE, 1)  # type: ignore[attr-defined]
+            sock.bind(("", port))
+            return sock
+        except socket.error as e:
+            if e.errno == errno.EADDRINUSE:
+                return None
+            raise
+
+
+def filter_reserved_ports(ports: List[PortMapping]) -> List[PortMapping]:
+    return [
+        pm for pm in ports if not (RESERVED_PORTS_START <= pm.container_port <= RESERVED_PORTS_END)
+    ]

dstack/_internal/core/services/ssh/tunnel.py

@@ -0,0 +1,337 @@
+import abc
+import asyncio
+import os
+import shlex
+import subprocess
+import tempfile
+from dataclasses import dataclass
+from typing import Dict, Iterable, List, Literal, Optional, Union
+
+from dstack._internal.core.errors import SSHError
+from dstack._internal.core.models.instances import SSHConnectionParams
+from dstack._internal.core.services.ssh import get_ssh_error
+from dstack._internal.core.services.ssh.client import get_ssh_client_info
+from dstack._internal.utils.common import run_async
+from dstack._internal.utils.logging import get_logger
+from dstack._internal.utils.path import FilePath, FilePathOrContent, PathLike
+from dstack._internal.utils.ssh import normalize_path
+
+logger = get_logger(__name__)
+SSH_TIMEOUT = 15
+SSH_DEFAULT_OPTIONS = {
+    "StrictHostKeyChecking": "no",
+    "UserKnownHostsFile": "/dev/null",
+    "ExitOnForwardFailure": "yes",
+    "StreamLocalBindUnlink": "yes",
+    "ConnectTimeout": "3",
+}
+
+
+class Socket(abc.ABC):
+    @abc.abstractmethod
+    def render(self) -> str:
+        pass
+
+
+@dataclass
+class UnixSocket(Socket):
+    path: PathLike
+
+    def render(self) -> str:
+        return str(self.path)
+
+
+@dataclass
+class IPSocket(Socket):
+    host: str
+    port: int
+
+    def render(self) -> str:
+        if ":" in self.host:  # assuming IPv6
+            return f"[{self.host}]:{self.port}"
+        return f"{self.host}:{self.port}"
+
+
+@dataclass
+class SocketPair:
+    local: Socket
+    remote: Socket
+
+
+class SSHTunnel:
+    def __init__(
+        self,
+        destination: str,
+        identity: FilePathOrContent,
+        forwarded_sockets: Iterable[SocketPair] = (),
+        reverse_forwarded_sockets: Iterable[SocketPair] = (),
+        control_sock_path: Optional[PathLike] = None,
+        options: Dict[str, str] = SSH_DEFAULT_OPTIONS,
+        ssh_config_path: Union[PathLike, Literal["none"]] = "none",
+        port: Optional[int] = None,
+        ssh_proxies: Iterable[tuple[SSHConnectionParams, Optional[FilePathOrContent]]] = (),
+    ):
+        """
+        :param forwarded_sockets: Connections to the specified local sockets will be
+            forwarded to their corresponding remote sockets
+        :param reverse_forwarded_sockets: Connections to the specified remote sockets
+            will be forwarded to their corresponding local sockets
+        :param ssh_proxies: pairs of SSH connections params and optional identities,
+            in order from outer to inner. If an identity is `None`, the `identity` param
+            is used instead.
+        """
+        self.destination = destination
+        self.forwarded_sockets = list(forwarded_sockets)
+        self.reverse_forwarded_sockets = list(reverse_forwarded_sockets)
+        self.options = options
+        self.port = port
+        self.ssh_config_path = normalize_path(ssh_config_path)
+        temp_dir = tempfile.TemporaryDirectory()
+        self.temp_dir = temp_dir
+        if control_sock_path is None:
+            control_sock_path = os.path.join(temp_dir.name, "control.sock")
+        self.control_sock_path = normalize_path(control_sock_path)
+        self.identity_path = normalize_path(self._get_identity_path(identity, "identity"))
+        self.ssh_proxies: list[tuple[SSHConnectionParams, PathLike]] = []
+        for proxy_index, (proxy_params, proxy_identity) in enumerate(ssh_proxies):
+            if proxy_identity is None:
+                proxy_identity_path = self.identity_path
+            else:
+                proxy_identity_path = self._get_identity_path(
+                    proxy_identity, f"proxy_identity_{proxy_index}"
+                )
+            self.ssh_proxies.append((proxy_params, proxy_identity_path))
+        self.log_path = normalize_path(os.path.join(temp_dir.name, "tunnel.log"))
+        self.ssh_client_info = get_ssh_client_info()
+        self.ssh_exec_path = str(self.ssh_client_info.path)
+
+    def open_command(self) -> List[str]:
+        # Some information about how `ssh(1)` handles options:
+        # 1. Command-line options override config options regardless of the order of the arguments:
+        #   `ssh -S sock2 -F config` with `ControlPath sock1` in the config -> the control socket
+        #   path is `sock2`.
+        # 2. First argument wins:
+        #   `ssh -S sock2 -S sock1` -> the control socket path is `sock2`.
+        # 3. `~` is not expanded in the arguments, but expanded in the config file.
+        command = [
+            self.ssh_exec_path,
+            "-F",
+            self.ssh_config_path,
+            "-i",
+            self.identity_path,
+            "-E",
+            self.log_path,
+            "-N",  # do not run commands on remote
+        ]
+        if self.ssh_client_info.supports_background_mode:
+            command += ["-f"]  # go to background after successful authentication
+        else:
+            raise SSHError("Unsupported SSH client")
+        if self.ssh_client_info.supports_control_socket:
+            # It's safe to use ControlMaster even if the ssh client does not support multiplexing
+            # as long as we don't allow more than one tunnel to the specific host to be running.
+            # We use this feature for control only (see :meth:`close_command`).
+            command += [
+                # Not `-M`, which means `ControlMaster=yes`, to avoid spawning uncontrollable
+                # ssh instances if more than one tunnel is started (precaution).
+                "-o",
+                "ControlMaster=auto",
+                "-S",
+                self.control_sock_path,
+            ]
+        else:
+            raise SSHError("Unsupported SSH client")
+        if self.port is not None:
+            command += ["-p", str(self.port)]
+        for k, v in self.options.items():
+            command += ["-o", f"{k}={v}"]
+        if proxy_command := self._get_proxy_command():
+            command += ["-o", proxy_command]
+        for socket_pair in self.forwarded_sockets:
+            command += ["-L", f"{socket_pair.local.render()}:{socket_pair.remote.render()}"]
+        for socket_pair in self.reverse_forwarded_sockets:
+            command += ["-R", f"{socket_pair.remote.render()}:{socket_pair.local.render()}"]
+        command += [self.destination]
+        return command
+
+    def close_command(self) -> List[str]:
+        return [self.ssh_exec_path, "-S", self.control_sock_path, "-O", "exit", self.destination]
+
+    def check_command(self) -> List[str]:
+        return [self.ssh_exec_path, "-S", self.control_sock_path, "-O", "check", self.destination]
+
+    def exec_command(self) -> List[str]:
+        return [self.ssh_exec_path, "-S", self.control_sock_path, self.destination]
+
+    def open(self) -> None:
+        # We cannot use `stderr=subprocess.PIPE` here since the forked process (daemon) does not
+        # close standard streams if ProxyJump is used, therefore we will wait EOF from the pipe
+        # as long as the daemon exists.
+        self._remove_log_file()
+        try:
+            r = subprocess.run(
+                self.open_command(),
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+                timeout=SSH_TIMEOUT,
+            )
+        except subprocess.TimeoutExpired as e:
+            msg = f"SSH tunnel to {self.destination} did not open in {SSH_TIMEOUT} seconds"
+            logger.debug(msg)
+            raise SSHError(msg) from e
+        if r.returncode == 0:
+            return
+        stderr = self._read_log_file()
+        logger.debug("SSH tunnel failed: %s", stderr)
+        raise get_ssh_error(stderr)
+
+    async def aopen(self) -> None:
+        await run_async(self._remove_log_file)
+        proc = await asyncio.create_subprocess_exec(
+            *self.open_command(), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
+        )
+        try:
+            await asyncio.wait_for(proc.communicate(), SSH_TIMEOUT)
+        except asyncio.TimeoutError as e:
+            proc.kill()
+            msg = f"SSH tunnel to {self.destination} did not open in {SSH_TIMEOUT} seconds"
+            logger.debug(msg)
+            raise SSHError(msg) from e
+        if proc.returncode == 0:
+            return
+        stderr = await run_async(self._read_log_file)
+        logger.debug("SSH tunnel failed: %s", stderr)
+        raise get_ssh_error(stderr)
+
+    def close(self) -> None:
+        if not os.path.exists(self.control_sock_path):
+            logger.debug(
+                "Control socket does not exist, it seems that ssh process has already exited"
+            )
+            return
+        proc = subprocess.run(
+            self.close_command(), stdout=subprocess.PIPE, stderr=subprocess.STDOUT
+        )
+        if proc.returncode:
+            logger.error(
+                "Failed to close SSH tunnel, exit status: %d, output: %s",
+                proc.returncode,
+                proc.stdout,
+            )
+
+    async def aclose(self) -> None:
+        if not os.path.exists(self.control_sock_path):
+            logger.debug(
+                "Control socket does not exist, it seems that ssh process has already exited"
+            )
+            return
+        proc = await asyncio.create_subprocess_exec(
+            *self.close_command(), stdout=subprocess.PIPE, stderr=subprocess.STDOUT
+        )
+        await proc.wait()
+        if proc.returncode:
+            logger.error(
+                "Failed to close SSH tunnel, exit status: %d, output: %s",
+                proc.returncode,
+                proc.stdout,
+            )
+
+    async def acheck(self) -> bool:
+        proc = await asyncio.create_subprocess_exec(
+            *self.check_command(), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
+        )
+        await proc.wait()
+        ok = proc.returncode == 0
+        return ok
+
+    async def aexec(self, command: str) -> str:
+        proc = await asyncio.create_subprocess_exec(
+            *self.exec_command(), command, stdout=subprocess.PIPE, stderr=subprocess.PIPE
+        )
+        stdout, stderr = await proc.communicate()
+        if proc.returncode != 0:
+            raise SSHError(stderr.decode())
+        return stdout.decode()
+
+    def __enter__(self):
+        self.open()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        self.close()
+
+    async def __aenter__(self):
+        await self.aopen()
+        return self
+
+    async def __aexit__(self, exc_type, exc_val, exc_tb):
+        await self.aclose()
+
+    def _get_proxy_command(self) -> Optional[str]:
+        proxy_command: Optional[str] = None
+        for params, identity_path in self.ssh_proxies:
+            proxy_command = self._build_proxy_command(params, identity_path, proxy_command)
+        return proxy_command
+
+    def _build_proxy_command(
+        self,
+        params: SSHConnectionParams,
+        identity_path: PathLike,
+        prev_proxy_command: Optional[str],
+    ) -> Optional[str]:
+        command = [
+            self.ssh_exec_path,
+            "-i",
+            identity_path,
+            "-W",
+            "%h:%p",
+            "-o",
+            "StrictHostKeyChecking=no",
+            "-o",
+            "UserKnownHostsFile=/dev/null",
+        ]
+        if prev_proxy_command is not None:
+            command += ["-o", prev_proxy_command.replace("%", "%%")]
+        command += [
+            "-p",
+            str(params.port),
+            f"{params.username}@{params.hostname}",
+        ]
+        return "ProxyCommand=" + shlex.join(command)
+
+    def _read_log_file(self) -> bytes:
+        with open(self.log_path, "rb") as f:
+            return f.read()
+
+    def _remove_log_file(self) -> None:
+        try:
+            os.remove(self.log_path)
+        except FileNotFoundError:
+            pass
+        except OSError as e:
+            logger.debug("Failed to remove SSH tunnel log file %s: %s", self.log_path, e)
+
+    def _get_identity_path(self, identity: FilePathOrContent, tmp_filename: str) -> PathLike:
+        if isinstance(identity, FilePath):
+            return identity.path
+        identity_path = os.path.join(self.temp_dir.name, tmp_filename)
+        with open(
+            identity_path, opener=lambda path, flags: os.open(path, flags, 0o600), mode="w"
+        ) as f:
+            f.write(identity.content)
+        return identity_path
+
+
+def ports_to_forwarded_sockets(
+    ports: Dict[int, int], bind_local: str = "localhost"
+) -> List[SocketPair]:
+    """
+    Converts remote->local ports mapping to List[SocketPair] suitable for SSHTunnel
+    """
+    return [
+        SocketPair(
+            local=IPSocket(host=bind_local, port=port_local),
+            remote=IPSocket(host="localhost", port=port_remote),
+        )
+        for port_remote, port_local in ports.items()
+    ]

dstack/_internal/proxy/__init__.py

@@ -0,0 +1,8 @@
+"""
+dstack-proxy is a component responsible for proxying ingress HTTP traffic to
+services and models hosted by dstack. It can also perform load balancing,
+collect service usage stats, obtain SSL certificates, etc.
+
+This component can run as a standalone web application on a gateway instance or
+as part of the dstack-server web application.
+"""

dstack/_internal/proxy/gateway/app.py

@@ -0,0 +1,89 @@
+"""FastAPI app running on a gateway."""
+
+from contextlib import asynccontextmanager
+from pathlib import Path
+from typing import Optional
+
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+
+from dstack._internal.proxy.gateway.auth import GatewayProxyAuthProvider
+from dstack._internal.proxy.gateway.const import (
+    DSTACK_DIR_ON_GATEWAY,
+    SERVER_CONNECTIONS_DIR_ON_GATEWAY,
+)
+from dstack._internal.proxy.gateway.deps import (
+    GatewayDependencyInjector,
+    get_gateway_injector_from_app,
+    get_gateway_proxy_repo,
+)
+from dstack._internal.proxy.gateway.repo.repo import GatewayProxyRepo
+from dstack._internal.proxy.gateway.repo.state_v1 import migrate_from_state_v1
+from dstack._internal.proxy.gateway.routers.auth import router as auth_router
+from dstack._internal.proxy.gateway.routers.config import router as config_router
+from dstack._internal.proxy.gateway.routers.registry import router as registry_router
+from dstack._internal.proxy.gateway.routers.stats import router as stats_router
+from dstack._internal.proxy.gateway.services.nginx import Nginx
+from dstack._internal.proxy.gateway.services.registry import ACCESS_LOG_PATH, apply_all
+from dstack._internal.proxy.gateway.services.server_client import HTTPMultiClient
+from dstack._internal.proxy.gateway.services.stats import StatsCollector
+from dstack._internal.proxy.lib.routers.model_proxy import router as model_proxy_router
+from dstack._internal.utils.common import run_async
+from dstack.version import __version__
+
+STATE_FILE = DSTACK_DIR_ON_GATEWAY / "state-v2.json"
+LEGACY_STATE_FILE = DSTACK_DIR_ON_GATEWAY / "state.json"
+LEGACY_KEYS_DIR = Path("~/.ssh/projects").expanduser().resolve()
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    injector = get_gateway_injector_from_app(app)
+    repo = await get_gateway_proxy_repo(await injector.get_repo().__anext__())
+    nginx = injector.get_nginx()
+    service_conn_pool = await injector.get_service_connection_pool()
+    await run_async(nginx.write_global_conf)
+    await apply_all(repo, nginx, service_conn_pool)
+
+    yield
+
+    await service_conn_pool.remove_all()
+
+
+def make_app(repo: Optional[GatewayProxyRepo] = None, nginx: Optional[Nginx] = None) -> FastAPI:
+    if repo is None:
+        migrate_from_state_v1(
+            v1_file=LEGACY_STATE_FILE, v2_file=STATE_FILE, keys_dir=LEGACY_KEYS_DIR
+        )
+        repo = GatewayProxyRepo.load(STATE_FILE)
+
+    app = FastAPI(lifespan=lifespan)
+    app.state.proxy_dependency_injector = GatewayDependencyInjector(
+        repo=repo,
+        auth=GatewayProxyAuthProvider(
+            server_client=HTTPMultiClient(SERVER_CONNECTIONS_DIR_ON_GATEWAY)
+        ),
+        nginx=nginx or Nginx(),
+        stats_collector=StatsCollector(ACCESS_LOG_PATH),
+    )
+
+    # TODO: add CORS only to openai routers once fastapi supports it.
+    # See https://github.com/tiangolo/fastapi/pull/11010
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origin_regex=".*",
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+    app.include_router(auth_router, prefix="/api/auth")
+    app.include_router(config_router, prefix="/api/config")
+    app.include_router(model_proxy_router, prefix="/api/models")
+    app.include_router(registry_router, prefix="/api/registry")
+    app.include_router(stats_router, prefix="/api/stats")
+
+    @app.get("/")
+    def get_info():
+        return {"version": __version__}
+
+    return app

dstack/_internal/proxy/gateway/auth.py

@@ -0,0 +1,26 @@
+import httpx
+from aiocache import cached
+
+from dstack._internal.proxy.lib.auth import BaseProxyAuthProvider
+from dstack._internal.proxy.lib.errors import UnexpectedProxyError
+
+
+class GatewayProxyAuthProvider(BaseProxyAuthProvider):
+    def __init__(self, server_client: httpx.AsyncClient) -> None:
+        self._server_client = server_client
+
+    @cached(ttl=60, noself=True, skip_cache_func=lambda r: r is None)
+    async def is_project_member(self, project_name: str, token: str) -> bool:
+        try:
+            resp = await self._server_client.post(
+                f"/api/projects/{project_name}/get",
+                headers={"Authorization": f"Bearer {token}"},
+            )
+            if resp.status_code == httpx.codes.FORBIDDEN:
+                return False
+            resp.raise_for_status()
+        except httpx.HTTPError as e:
+            raise UnexpectedProxyError(
+                f"Failed requesting dstack-server to check access: {e!r}"
+            ) from e
+        return True

dstack/_internal/proxy/gateway/const.py

@@ -0,0 +1,7 @@
+"""Gateway-related constants useful in various dstack modules."""
+
+from pathlib import Path
+
+DSTACK_DIR_ON_GATEWAY = Path("/home/ubuntu/dstack")
+SERVER_CONNECTIONS_DIR_ON_GATEWAY = DSTACK_DIR_ON_GATEWAY / "server-connections"
+PROXY_PORT_ON_GATEWAY = 8000

dstack/_internal/proxy/gateway/deps.py

@@ -0,0 +1,73 @@
+from typing import Annotated, AsyncGenerator
+
+from fastapi import Depends, FastAPI, Request
+
+from dstack._internal.proxy.gateway.repo.repo import GatewayProxyRepo
+from dstack._internal.proxy.gateway.services.nginx import Nginx
+from dstack._internal.proxy.gateway.services.stats import StatsCollector
+from dstack._internal.proxy.lib.auth import BaseProxyAuthProvider
+from dstack._internal.proxy.lib.deps import (
+    ProxyDependencyInjector,
+    get_injector_from_app,
+    get_proxy_repo,
+)
+from dstack._internal.proxy.lib.errors import UnexpectedProxyError
+from dstack._internal.proxy.lib.repo import BaseProxyRepo
+
+
+class GatewayDependencyInjector(ProxyDependencyInjector):
+    def __init__(
+        self,
+        repo: GatewayProxyRepo,
+        auth: BaseProxyAuthProvider,
+        nginx: Nginx,
+        stats_collector: StatsCollector,
+    ) -> None:
+        super().__init__()
+        self._repo = repo
+        self._auth = auth
+        self._nginx = nginx
+        self._stats_collector = stats_collector
+
+    async def get_repo(self) -> AsyncGenerator[BaseProxyRepo, None]:
+        yield self._repo
+
+    async def get_auth_provider(self) -> AsyncGenerator[BaseProxyAuthProvider, None]:
+        yield self._auth
+
+    def get_nginx(self) -> Nginx:
+        return self._nginx
+
+    def get_stats_collector(self) -> StatsCollector:
+        return self._stats_collector
+
+
+def get_gateway_injector_from_app(app: FastAPI) -> GatewayDependencyInjector:
+    injector = get_injector_from_app(app)
+    if not isinstance(injector, GatewayDependencyInjector):
+        raise UnexpectedProxyError(f"Unexpected gateway injector type: {type(injector)}")
+    return injector
+
+
+async def get_gateway_injector(request: Request) -> GatewayDependencyInjector:
+    return get_gateway_injector_from_app(request.app)
+
+
+async def get_gateway_proxy_repo(
+    repo: Annotated[BaseProxyRepo, Depends(get_proxy_repo)],
+) -> GatewayProxyRepo:
+    if not isinstance(repo, GatewayProxyRepo):
+        raise UnexpectedProxyError(f"Unexpected gateway repo type: {type(repo)}")
+    return repo
+
+
+async def get_nginx(
+    injector: Annotated[GatewayDependencyInjector, Depends(get_gateway_injector)],
+) -> Nginx:
+    return injector.get_nginx()
+
+
+async def get_stats_collector(
+    injector: Annotated[GatewayDependencyInjector, Depends(get_gateway_injector)],
+) -> StatsCollector:
+    return injector.get_stats_collector()