Deploying Connectware Behind a Corporate Proxy

Configure system, Docker, and Connectware proxy settings for deployment behind corporate proxies.

Deploy Connectware on a host whose Internet access is routed through a corporate proxy. This guide walks through the host, Docker, and Connectware proxy settings needed to install and run Connectware in such an environment.

Prerequisites

• A valid Connectware license.

• Docker and Docker Compose installed on your system.

• The address and port of your corporate proxy.

The examples on this page use the following placeholders. Replace them with values from your environment:

• ${PROXY_HOST} — hostname or IP address of the corporate proxy.

• ${PROXY_PORT} — port the proxy listens on.

Proxy Behavior Across Applications

Proxy configuration across applications can vary:

• Some tools recognize http_proxy, https_proxy, and no_proxy (lowercase).

• Others may use HTTP_PROXY, HTTPS_PROXY, and NO_PROXY (uppercase).

• Some software may require both or use custom proxy settings.

General recommendations:

• Set both lowercase and uppercase variants of proxy variables.

• Avoid IP addresses unless known to be used directly by the application.

• Hostname resolution may fail under proxy settings unless explicitly configured.

Configuration

Verifying Host and Proxy Server Reachability

Confirm the host can reach the proxy server before configuring anything else:

uname -a
ping -c 1 ${PROXY_HOST}

The ping command should report a successful reply with no packet loss.

System-Wide Proxy Configuration

Apply proxy settings system-wide so every shell session inherits them:

1. Create a script in /etc/profile.d/. Shell scripts in this directory run at login for every user.

sudo nano /etc/profile.d/proxy.sh

1. Add the following content and save the file:

export http_proxy="http://${PROXY_HOST}:${PROXY_PORT}/"
export https_proxy="http://${PROXY_HOST}:${PROXY_PORT}/"
export no_proxy="127.0.0.1,localhost"
export HTTP_PROXY="http://${PROXY_HOST}:${PROXY_PORT}/"
export HTTPS_PROXY="http://${PROXY_HOST}:${PROXY_PORT}/"
export NO_PROXY="127.0.0.1,localhost"

1. Make the script executable:

sudo chmod +x /etc/profile.d/proxy.sh

1. Open a new shell session or log out and back in to apply the changes. Verify that the variables are set:

env | grep -i proxy

Preserving Proxy Settings for Sudo

By default, sudo strips environment variables. Preserve the proxy variables for sudo invocations:

1. Create a sudoers drop-in file:

sudo nano /etc/sudoers.d/env_keep_proxy

1. Add the following line and save the file:

Defaults env_keep += "http_proxy https_proxy no_proxy HTTP_PROXY HTTPS_PROXY NO_PROXY"

APT Proxy Configuration

On Debian-based systems, APT does not read the shell environment variables and needs its own proxy configuration. This step is not required to run Connectware, but without it APT cannot install software through the proxy.

1. Create an APT configuration file:

sudo nano /etc/apt/apt.conf.d/80proxy

1. Add the following lines and save the file:

Acquire::http::proxy "http://${PROXY_HOST}:${PROXY_PORT}/";
Acquire::https::proxy "http://${PROXY_HOST}:${PROXY_PORT}/";
Acquire::ftp::proxy "http://${PROXY_HOST}:${PROXY_PORT}/";

Docker Daemon Proxy Setup

The Docker daemon needs its own proxy configuration to pull images from the Internet:

1. Create the systemd drop-in directory for the Docker service:

sudo mkdir -p /etc/systemd/system/docker.service.d

1. Create the configuration file:

sudo nano /etc/systemd/system/docker.service.d/http-proxy.conf

1. Add the following content and save the file:

[Service]
Environment="HTTP_PROXY=http://${PROXY_HOST}:${PROXY_PORT}/"
Environment="HTTPS_PROXY=http://${PROXY_HOST}:${PROXY_PORT}/"
Environment="NO_PROXY=localhost,127.0.0.1"

1. Reload systemd and restart Docker:

sudo systemctl daemon-reload
sudo systemctl restart docker

1. Verify the configuration:

sudo systemctl show --property=Environment docker

The output should list the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY values you set.

1. Test that Docker can reach the Internet through the proxy:

docker pull hello-world

The command should complete with Status: Downloaded newer image for hello-world:latest.

Container-Level Internet Access

Containers do not inherit the Docker daemon proxy settings. Configure proxy settings for containers globally through the Docker client config, or per container through environment variables.

To define global proxy settings for every container started by this user:

1. Create the Docker client configuration directory and the configuration file:

mkdir -p ~/.docker
nano ~/.docker/config.json

1. Add the following content and save the file. Include the Connectware service names in noProxy so the containers can reach each other without going through the proxy:

{
  "proxies": {
    "default": {
      "httpProxy": "http://${PROXY_HOST}:${PROXY_PORT}/",
      "httpsProxy": "http://${PROXY_HOST}:${PROXY_PORT}/",
      "noProxy": "127.0.0.1,localhost,admin-web-app,auth-server,broker,container-manager,connectware,ingress-controller,nats,postgresql,protocol-mapper,service-manager,system-control-server,resource-status-tracking,topic-explorer,workbench"
    }
  }
}

Configuring the Connectware Environment File

Set the proxy in the Connectware environment file before launching the stack. The .env file is located in your installation directory, by default /opt/connectware/.

1. Open the environment file:

sudo nano /opt/connectware/.env

1. Add the following lines and save the file:

# Proxy Configuration
CYBUS_PROXY=http://${PROXY_HOST}:${PROXY_PORT}/
CYBUS_NO_PROXY=127.0.0.1,localhost,admin-web-app,auth-server,broker,container-manager,connectware,ingress-controller,nats,postgresql,protocol-mapper,service-manager,system-control-server,resource-status-tracking,topic-explorer,workbench

Verification

After applying the configuration, confirm that each layer can reach the Internet through the proxy:

• Run env | grep -i proxy and confirm the shell sees the proxy variables.

• Run docker pull hello-world and confirm the image pulls successfully.

• Start Connectware with docker compose up -d and confirm the auth-server logs show successful outbound calls when a feature that requires Internet access is exercised (for example, an SSO login).