From f2d59745e1c330d7a70794be925ea5015e05aee8 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:07:11 -0600 Subject: [PATCH 1/6] docs: Fix HTTP proxy configuration for private networks - Drop migrator and executor from the services needing proxy env vars: migrator only connects to Postgres, and executor only connects to the frontend and does not pass the vars to its jobs - Fix the Docker Compose example, which wrapped the NO_PROXY value in literal quotes, and name the services instead of - Add syntactic-code-intel-worker to the Docker Compose NO_PROXY list - Link to the outbound-http-proxy examples in the deploy repos Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- docs/self-hosted/private-network.mdx | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index f7431f9cc..8b895c3e8 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -36,12 +36,14 @@ All Sourcegraph services respect the conventional `HTTP_PROXY`, `HTTPS_PROXY`, a routing Sourcegraph client application HTTP traffic through a proxy server. The steps for configuring proxy environment variables will depend on your Sourcegraph deployment method. +Set them on `frontend`, `gitserver`, and `worker`, the services which make outbound HTTP requests. `migrator` only connects to Postgres, and `executor` only connects to the frontend and does not pass these variables to its jobs, so neither needs them. + ### Kubernetes Helm -Add the proxy environment variables to your Sourcegraph Helm chart [override file](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/values.yaml): +Add the proxy environment variables to your Sourcegraph Helm chart [override file](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/values.yaml). See the [outbound-http-proxy example](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/examples/outbound-http-proxy/override.yaml) for a complete override file. ```yaml -executor|frontend|gitserver|migrator|worker: +frontend|gitserver|worker: env: HTTP_PROXY: value: http://proxy.example.com:8080 @@ -55,7 +57,7 @@ executor|frontend|gitserver|migrator|worker: If the updated Sourcegraph pods fail to pass their readiness or health checks after configuring the HTTP proxy environment variables, you may also need to add your k8s cluster pod & service CIDR ranges to the `NO_PROXY` environment variable. For example, if the k8s cluster pod & service CIDR ranges are `10.10.0.0/16` and `10.20.0.0/16`, configure the `NO_PROXY` environment variable as: ```yaml -executor|frontend|gitserver|migrator|worker: +frontend|gitserver|worker: env: NO_PROXY: value: 'blobstore,codeinsights-db,codeintel-db,sourcegraph-frontend-internal,sourcegraph-frontend,gitserver,grafana,indexed-search-indexer,indexed-search,jaeger-query,pgsql,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher,syntect-server,worker-executors,worker,cloud-sql-proxy,localhost,127.0.0.1,.svc,.svc.cluster.local,kubernetes.default.svc,10.10.0.0/16,10.20.0.0/16' @@ -65,15 +67,15 @@ executor|frontend|gitserver|migrator|worker: ### Docker Compose -Add the proxy environment variables your docker compose override file. +Add the proxy environment variables to your docker compose override file. See the [outbound-http-proxy example](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/main/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml) for a complete override file. ```yaml services: - : + sourcegraph-frontend-0|sourcegraph-frontend-internal|gitserver-0|worker: environment: - - HTTP_PROXY=http://proxy.example.com:8080 - - HTTPS_PROXY=http://proxy.example.com:8080 - - NO_PROXY='blobstore,caddy,cadvisor,codeintel-db,codeintel-db-exporter,codeinsights-db,codeinsights-db-exporter,sourcegraph-frontend-0,sourcegraph-frontend-internal,gitserver-0,grafana,migrator,node-exporter,otel-collector,pgsql,pgsql-exporter,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher-0,syntect-server,worker,zoekt-indexserver-0,zoekt-webserver-0,localhost,127.0.0.1' + HTTP_PROXY: http://proxy.example.com:8080 + HTTPS_PROXY: http://proxy.example.com:8080 + NO_PROXY: blobstore,caddy,cadvisor,codeinsights-db,codeinsights-db-exporter,codeintel-db,codeintel-db-exporter,gitserver-0,grafana,migrator,node-exporter,otel-collector,pgsql,pgsql-exporter,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher-0,sourcegraph-frontend-0,sourcegraph-frontend-internal,syntactic-code-intel-worker,syntect-server,worker,zoekt-indexserver-0,zoekt-webserver-0,localhost,127.0.0.1 ``` From 2dd2b0778068721d804f4ce44dea216c8c4777ba Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:19:43 -0600 Subject: [PATCH 2/6] docs: Point pings proxy section at private network HTTP proxy configuration Drops the TELEMETRY_HTTP_PROXY instructions, which duplicated the HTTPS_PROXY guidance with a narrower, frontend-only variable. Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- docs/admin/pings.mdx | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/docs/admin/pings.mdx b/docs/admin/pings.mdx index 5613b3497..74135dbcb 100644 --- a/docs/admin/pings.mdx +++ b/docs/admin/pings.mdx @@ -206,9 +206,7 @@ Refer to [outbound access to Sourcegraph services](/self-hosted/private-network# ## Using an HTTP proxy for ping requests -The environment variable `TELEMETRY_HTTP_PROXY` can be set on the `sourcegraph-frontend` service, to use an HTTP proxy for ping requests. - -Be sure to update the environment variable like so : `TELEMETRY_HTTP_PROXY:"http://proxy.example.com:8080"` +Refer to [HTTP proxy configuration](/self-hosted/private-network#http-proxy-configuration) to route pings and all other outbound requests through a proxy. ## Connections to Sourcegraph-managed services From d8ddf7136c997cffd99034dcae03612997183f29 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:53:20 -0600 Subject: [PATCH 3/6] docs: Link to deploy repo examples instead of inlining proxy config The example override files are validated by CI in the deploy repos and live beside the service definitions they list, so they stay current. Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- docs/self-hosted/private-network.mdx | 50 +++------------------------- 1 file changed, 4 insertions(+), 46 deletions(-) diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index 8b895c3e8..c4d5da0d2 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -32,55 +32,13 @@ To ensure a smooth experience, instances must allow **outbound TCP port `443` to ## HTTP proxy configuration -All Sourcegraph services respect the conventional `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables for -routing Sourcegraph client application HTTP traffic through a proxy server. The steps for configuring proxy environment -variables will depend on your Sourcegraph deployment method. +Sourcegraph services respect the conventional `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables. Set them on the `frontend`, `gitserver`, and `worker` services, using the example override file for your deployment method: -Set them on `frontend`, `gitserver`, and `worker`, the services which make outbound HTTP requests. `migrator` only connects to Postgres, and `executor` only connects to the frontend and does not pass these variables to its jobs, so neither needs them. - -### Kubernetes Helm - -Add the proxy environment variables to your Sourcegraph Helm chart [override file](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/values.yaml). See the [outbound-http-proxy example](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/examples/outbound-http-proxy/override.yaml) for a complete override file. - -```yaml -frontend|gitserver|worker: - env: - HTTP_PROXY: - value: http://proxy.example.com:8080 - HTTPS_PROXY: - value: http://proxy.example.com:8080 - NO_PROXY: - value: 'blobstore,codeinsights-db,codeintel-db,sourcegraph-frontend-internal,sourcegraph-frontend,gitserver,grafana,indexed-search-indexer,indexed-search,jaeger-query,pgsql,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher,syntect-server,worker-executors,worker,cloud-sql-proxy,localhost,127.0.0.1,.svc,.svc.cluster.local,kubernetes.default.svc' -``` - - -If the updated Sourcegraph pods fail to pass their readiness or health checks after configuring the HTTP proxy environment variables, you may also need to add your k8s cluster pod & service CIDR ranges to the `NO_PROXY` environment variable. For example, if the k8s cluster pod & service CIDR ranges are `10.10.0.0/16` and `10.20.0.0/16`, configure the `NO_PROXY` environment variable as: - -```yaml -frontend|gitserver|worker: - env: - NO_PROXY: - value: 'blobstore,codeinsights-db,codeintel-db,sourcegraph-frontend-internal,sourcegraph-frontend,gitserver,grafana,indexed-search-indexer,indexed-search,jaeger-query,pgsql,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher,syntect-server,worker-executors,worker,cloud-sql-proxy,localhost,127.0.0.1,.svc,.svc.cluster.local,kubernetes.default.svc,10.10.0.0/16,10.20.0.0/16' -``` - - - -### Docker Compose - -Add the proxy environment variables to your docker compose override file. See the [outbound-http-proxy example](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/main/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml) for a complete override file. - -```yaml -services: - sourcegraph-frontend-0|sourcegraph-frontend-internal|gitserver-0|worker: - environment: - HTTP_PROXY: http://proxy.example.com:8080 - HTTPS_PROXY: http://proxy.example.com:8080 - NO_PROXY: blobstore,caddy,cadvisor,codeinsights-db,codeinsights-db-exporter,codeintel-db,codeintel-db-exporter,gitserver-0,grafana,migrator,node-exporter,otel-collector,pgsql,pgsql-exporter,precise-code-intel-worker,prometheus,redis-cache,redis-store,searcher-0,sourcegraph-frontend-0,sourcegraph-frontend-internal,syntactic-code-intel-worker,syntect-server,worker,zoekt-indexserver-0,zoekt-webserver-0,localhost,127.0.0.1 -``` +- [Kubernetes Helm](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/examples/outbound-http-proxy/override.yaml) +- [Docker Compose](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/main/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml) - Failure to configure `NO_PROXY` correctly can cause the proxy configuration - to interfere with local networking between internal Sourcegraph services. +`NO_PROXY` must list every Sourcegraph service, so traffic between them does not go through the proxy. If services fail their health checks after adding the proxy, also add your cluster or Docker network CIDR ranges, for example `10.10.0.0/16,10.20.0.0/16`. ## Docker networking configuration From 6c9dd0e9006c3bc9936038015aff2cb4c50ff954 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 16:58:03 -0600 Subject: [PATCH 4/6] docs: Wording Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- docs/self-hosted/private-network.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index c4d5da0d2..6a278c9b8 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -32,7 +32,7 @@ To ensure a smooth experience, instances must allow **outbound TCP port `443` to ## HTTP proxy configuration -Sourcegraph services respect the conventional `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables. Set them on the `frontend`, `gitserver`, and `worker` services, using the example override file for your deployment method: +Sourcegraph services use the conventional `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables. Set them on the `frontend`, `gitserver`, and `worker` services, using the example override file for your deployment method: - [Kubernetes Helm](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/examples/outbound-http-proxy/override.yaml) - [Docker Compose](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/main/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml) From cea7422be1e212759c440ae42d40c9b573375dc3 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 17:08:16 -0600 Subject: [PATCH 5/6] docs: Proxy env vars go on frontend and worker only Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- docs/self-hosted/private-network.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index 6a278c9b8..309b4bba6 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -32,7 +32,7 @@ To ensure a smooth experience, instances must allow **outbound TCP port `443` to ## HTTP proxy configuration -Sourcegraph services use the conventional `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables. Set them on the `frontend`, `gitserver`, and `worker` services, using the example override file for your deployment method: +Sourcegraph services use the conventional `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables. Set them on the `frontend` and `worker` services, using the example override file for your deployment method: - [Kubernetes Helm](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/examples/outbound-http-proxy/override.yaml) - [Docker Compose](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/main/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml) From ab7f0fa8285594cb88fe2a9af89d247f60bfcba1 Mon Sep 17 00:00:00 2001 From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com> Date: Wed, 14 Oct 2026 17:20:41 -0600 Subject: [PATCH 6/6] docs: Drop NO_PROXY callout, the example files cover it Amp-Thread-ID: https://ampcode.com/threads/T-01a13c4a-ae1a-7319-bf11-cb792b1a5481 Co-authored-by: Amp --- docs/self-hosted/private-network.mdx | 4 ---- 1 file changed, 4 deletions(-) diff --git a/docs/self-hosted/private-network.mdx b/docs/self-hosted/private-network.mdx index 309b4bba6..4ee09a498 100644 --- a/docs/self-hosted/private-network.mdx +++ b/docs/self-hosted/private-network.mdx @@ -37,10 +37,6 @@ Sourcegraph services use the conventional `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_P - [Kubernetes Helm](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/examples/outbound-http-proxy/override.yaml) - [Docker Compose](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/main/docker-compose/examples/outbound-http-proxy/docker-compose.override.yaml) - -`NO_PROXY` must list every Sourcegraph service, so traffic between them does not go through the proxy. If services fail their health checks after adding the proxy, also add your cluster or Docker network CIDR ranges, for example `10.10.0.0/16,10.20.0.0/16`. - - ## Docker networking configuration If there is an IP conflict on between the host network and the Docker network, you may need to configure the docker CIDR