# Discourse AI causing new SSL and Connection Reset by Peer errors

**URL:** https://meta.discourse.org/t/discourse-ai-causing-new-ssl-and-connection-reset-by-peer-errors/353600
**Category:** Bug
**Tags:** ai
**Created:** [February 21, 2025, 1:21pm UTC](https://meta.discourse.org/t/discourse-ai-causing-new-ssl-and-connection-reset-by-peer-errors/353600 "2025-02-21T13:21:26Z")
**Posts on this page:** 1
**Showing post:** 9

<div class="post-metadata">

### Author: ![oznyet](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/oznyet/32/489947_2.png) [@oznyet](https://meta.discourse.org/u/oznyet)
#### Post date: [February 26, 2025, 6:45am UTC](https://meta.discourse.org/t/discourse-ai-causing-new-ssl-and-connection-reset-by-peer-errors/353600/9 "2025-02-26T06:45:43Z")

</div>

Okay, bit of an update - we were unable to get direct OpenAI API connection to work on the corporate IP range. Cloudflare would send RST packets about 1ms after TLS.

So we set up a [Cloudflare AI Gateway](https://developers.cloudflare.com/ai-gateway/) as a URL drop-in replacement for the OpenAI API endpoint and it works flawlessly with the LLM configuration.

 ![The image shows a service hosting the GPT-4 OpenAI model, including its name, model ID, provider, URL, and API key, for use by the Persona (Discourse Helper). (Captioned by AI)](https://global.discourse-cdn.com/meta/original/4X/8/4/d/84ddb7b1b7db9bcea964b2aaaaa11c865965f4d9.png)

Looks like Cloudflare has an undocumented rate limit policy for unknown IP ranges (i.e., not Azure, AWS, GCP, etc) that kicks in. The 100 connection pool for Embeddings would trip that limit.

As an aside, Cloudflare has an [Authenticated Gateway](https://developers.cloudflare.com/ai-gateway/configuration/authentication/) feature that adds a special header token.

From their doco:

```bash
curl https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/openai/chat/completions \
  --header 'cf-aig-authorization: Bearer {CF_AIG_TOKEN}' \
  --header 'Authorization: Bearer OPENAI_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{"model": "gpt-4o" ........

```

It would be awesome if there was a feature to add per-LLM headers in the LLM configuration screen.

That way we could add the `cf-aig-authorization` key and value to the LLM for every call we make.

---

_[View the full topic](https://meta.discourse.org/t/discourse-ai-causing-new-ssl-and-connection-reset-by-peer-errors/353600)._