From 0a484c048ff9a2a4323b5d5e7d89142ff802be29 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 15:53:04 -0600 Subject: [PATCH 1/5] Add outbound HTTP proxy example override Shows how to route outbound traffic (telemetry, pings, update checks, license verification, code hosts, auth providers) through an HTTP proxy with HTTP_PROXY / HTTPS_PROXY / NO_PROXY, matching the guidance at https://sourcegraph.com/docs/self-hosted/private-network#http-proxy-configuration Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- .../docker-compose.override.yaml | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml diff --git a/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml new file mode 100644 index 000000000..e3eabbd0d --- /dev/null +++ b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml @@ -0,0 +1,49 @@ +# Docker Compose override file for routing outbound HTTP(S) traffic through an HTTP proxy +# ex. telemetry, pings, update checks, and license verification to services.sourcegraph.com, +# and connections to code hosts, auth providers, and LLM providers outside your private network +# See https://sourcegraph.com/docs/self-hosted/private-network#http-proxy-configuration + + +## Reusable block of environment variables + +# For all containers which initiate outbound connections +x-proxy-env-vars: &proxy-env-vars + + HTTP_PROXY: http://proxy.example.com:8080 + HTTPS_PROXY: http://proxy.example.com:8080 + + # Bypass the proxy for traffic between Sourcegraph's own containers + # If a container fails its health check after adding the proxy, also add the Docker network's CIDR range, ex. 172.16.0.0/12 + NO_PROXY: blobstore,caddy,cadvisor,codeinsights-db,codeinsights-db-exporter,codeintel-db,codeintel-db-exporter,gitserver-0,grafana,migrator,node-exporter,otel-collector,pgsql,pgsql-exporter,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher-0,sourcegraph-frontend-0,sourcegraph-frontend-internal,syntactic-code-intel-worker,syntect-server,worker,zoekt-indexserver-0,zoekt-webserver-0,localhost,127.0.0.1 + + +services: + + migrator: + # Add / merge the env vars, to only overwrite the ones we need, and leave the others intact + environment: + <<: *proxy-env-vars + + sourcegraph-frontend-0: + environment: + <<: *proxy-env-vars + # To proxy only pings and update checks, instead of all outbound traffic, + # set this var alone, and drop the HTTP_PROXY / HTTPS_PROXY / NO_PROXY vars + # TELEMETRY_HTTP_PROXY: http://proxy.example.com:8080 + + sourcegraph-frontend-internal: + environment: + <<: *proxy-env-vars + + gitserver-0: + environment: + <<: *proxy-env-vars + + worker: + environment: + <<: *proxy-env-vars + + # If running executors from executors/executor.docker-compose.yaml + # executor: + # environment: + # <<: *proxy-env-vars From d64213408c03bd87de0edbcb5b8ed5c128d90c29 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:07:03 -0600 Subject: [PATCH 2/5] Drop migrator from outbound HTTP proxy example migrator only connects to Postgres, so the proxy env vars have no effect on it. Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- .../docker-compose.override.yaml | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml index e3eabbd0d..9b99eb8e7 100644 --- a/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml +++ b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml @@ -19,17 +19,10 @@ x-proxy-env-vars: &proxy-env-vars services: - migrator: - # Add / merge the env vars, to only overwrite the ones we need, and leave the others intact - environment: - <<: *proxy-env-vars - sourcegraph-frontend-0: + # Add / merge the env vars, to only overwrite the ones we need, and leave the others intact environment: <<: *proxy-env-vars - # To proxy only pings and update checks, instead of all outbound traffic, - # set this var alone, and drop the HTTP_PROXY / HTTPS_PROXY / NO_PROXY vars - # TELEMETRY_HTTP_PROXY: http://proxy.example.com:8080 sourcegraph-frontend-internal: environment: @@ -42,8 +35,3 @@ services: worker: environment: <<: *proxy-env-vars - - # If running executors from executors/executor.docker-compose.yaml - # executor: - # environment: - # <<: *proxy-env-vars From 26ceafe0f54ecb53a256783d58f290fc0d816af4 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:33:07 -0600 Subject: [PATCH 3/5] Tidy comments in outbound HTTP proxy example --- .../outbound-http-proxy/docker-compose.override.yaml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml index 9b99eb8e7..ef07608f5 100644 --- a/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml +++ b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml @@ -1,18 +1,16 @@ # Docker Compose override file for routing outbound HTTP(S) traffic through an HTTP proxy -# ex. telemetry, pings, update checks, and license verification to services.sourcegraph.com, +# ex. telemetry, update checks, and license verification to services.sourcegraph.com, # and connections to code hosts, auth providers, and LLM providers outside your private network # See https://sourcegraph.com/docs/self-hosted/private-network#http-proxy-configuration -## Reusable block of environment variables - -# For all containers which initiate outbound connections +# Reusable block of environment variables, for services which initiate outbound connections x-proxy-env-vars: &proxy-env-vars HTTP_PROXY: http://proxy.example.com:8080 HTTPS_PROXY: http://proxy.example.com:8080 - # Bypass the proxy for traffic between Sourcegraph's own containers + # Skip the proxy for local traffic # If a container fails its health check after adding the proxy, also add the Docker network's CIDR range, ex. 172.16.0.0/12 NO_PROXY: blobstore,caddy,cadvisor,codeinsights-db,codeinsights-db-exporter,codeintel-db,codeintel-db-exporter,gitserver-0,grafana,migrator,node-exporter,otel-collector,pgsql,pgsql-exporter,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher-0,sourcegraph-frontend-0,sourcegraph-frontend-internal,syntactic-code-intel-worker,syntect-server,worker,zoekt-indexserver-0,zoekt-webserver-0,localhost,127.0.0.1 @@ -20,7 +18,6 @@ x-proxy-env-vars: &proxy-env-vars services: sourcegraph-frontend-0: - # Add / merge the env vars, to only overwrite the ones we need, and leave the others intact environment: <<: *proxy-env-vars From c1e2c199296d73036162bb664514777b35772c46 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:40:17 -0600 Subject: [PATCH 4/5] Write NO_PROXY as a folded block, one entry per line YAML folds the lines into a single comma-and-space-separated value, which both Go's httpproxy and libcurl parse, and is easier to read. --- .../docker-compose.override.yaml | 31 ++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml index ef07608f5..f8873c36c 100644 --- a/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml +++ b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml @@ -12,7 +12,36 @@ x-proxy-env-vars: &proxy-env-vars # Skip the proxy for local traffic # If a container fails its health check after adding the proxy, also add the Docker network's CIDR range, ex. 172.16.0.0/12 - NO_PROXY: blobstore,caddy,cadvisor,codeinsights-db,codeinsights-db-exporter,codeintel-db,codeintel-db-exporter,gitserver-0,grafana,migrator,node-exporter,otel-collector,pgsql,pgsql-exporter,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher-0,sourcegraph-frontend-0,sourcegraph-frontend-internal,syntactic-code-intel-worker,syntect-server,worker,zoekt-indexserver-0,zoekt-webserver-0,localhost,127.0.0.1 + # Each line needs a trailing comma, as YAML folds these lines into one line, separated by spaces + NO_PROXY: >- + blobstore, + caddy, + cadvisor, + codeinsights-db, + codeinsights-db-exporter, + codeintel-db, + codeintel-db-exporter, + gitserver-0, + grafana, + migrator, + node-exporter, + otel-collector, + pgsql, + pgsql-exporter, + precise-code-intel-worker, + prometheus, + redis-cache, + redis-store, + searcher-0, + sourcegraph-frontend-0, + sourcegraph-frontend-internal, + syntactic-code-intel-worker, + syntect-server, + worker, + zoekt-indexserver-0, + zoekt-webserver-0, + localhost, + 127.0.0.1 services: From 8289a46b12a7afeac6b9795f7139d09f27b18731 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 17:08:16 -0600 Subject: [PATCH 5/5] Comment out gitserver, note NO_PROXY additions for internal hosts Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- .../outbound-http-proxy/docker-compose.override.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml index f8873c36c..f44001812 100644 --- a/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml +++ b/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml @@ -11,6 +11,7 @@ x-proxy-env-vars: &proxy-env-vars HTTPS_PROXY: http://proxy.example.com:8080 # Skip the proxy for local traffic + # Add your internal code hosts, auth providers, image registries, etc. which are reachable without the proxy # If a container fails its health check after adding the proxy, also add the Docker network's CIDR range, ex. 172.16.0.0/12 # Each line needs a trailing comma, as YAML folds these lines into one line, separated by spaces NO_PROXY: >- @@ -54,9 +55,10 @@ services: environment: <<: *proxy-env-vars - gitserver-0: - environment: - <<: *proxy-env-vars + # Uncomment if connections to code hosts outside your private network need to use the proxy + # gitserver-0: + # environment: + # <<: *proxy-env-vars worker: environment: