Autograph | Corporate proxy

Configure

Set these variables in env/.env.augr. Leave them commented or empty for direct internet access.

Variable	Purpose	Example
`AUGR_NET_PROXY_URL`	Corporate HTTP(S) proxy URL (used for both http and https)	`http://corporate-proxy.example.com:8080`
`AUGR_NET_NO_PROXY`	Comma-separated hosts, domains, or IPv4 networks reached without the corporate proxy	`localhost,127.0.0.1,.internal.corp`

env/.env.augr

AUGR_NET_PROXY_URL=http://corporate-proxy.example.com:8080
AUGR_NET_NO_PROXY=.internal.corp,10.0.0.0/8

When it creates this file, task admin:setup pre-fills the proxy URL from https_proxy or http_proxy, and the bypass list from no_proxy. It does not print the proxy URL, which may contain credentials. Keep that URL out of logs and shared diagnostics.

Squid uses the URL as its upstream and the bypass list for direct access. Names are matched as requested, without DNS lookup; entries containing ports or IPv6 are ignored with a warning. West and image builds use the corporate proxy directly, before or outside the running stack. Stack containers keep using http://augr-proxy:3128.

Host prerequisites are separate

Host tools such as Git and curl use your shell proxy settings. Image pulls use the Docker daemon's proxy or registry mirror. Autograph does not use the Docker client proxy configuration in ~/.docker/config.json.

Apply

Configure this block before task augr:install on a fresh install, because West needs it too. For an existing stack, regenerate configuration and recreate containers:

terminal

task augr:build
task augr:reup

If a corporate CA is also needed, follow the CA rebuild steps.

Verify

Check that the stack proxy picked up the corporate proxy when it started:

terminal

task augr:pkg:proxy:logs

Expected near the top: [proxy] Upstream corporate proxy configured: host:port, followed by [proxy] Direct access (no upstream): ... when a bypass list is set. Credentials in the URL are not printed. If the logs show [proxy] No upstream proxy configured, run the Apply steps again. Stop following the logs with Ctrl+C.

Then check that the dev agent reaches the internet through the proxy chain:

terminal

task security-audit:check:isolation

Expected: PASS: Agent has internet connectivity. The agent network has no direct route out, so this request can only succeed through augr-proxy.

Proxy performs TLS inspection?

If your proxy re-signs HTTPS, you also need to trust its CA - see the Custom CA certificates page.

Learn more

How the stack reaches the internet is described in Architecture, and why corporate settings stay out of the agents in Security.