GoRunner docs
Search or askSearch⌘K

A company proxy

Send everything GoRunner calls outside through your company’s proxy.

5 min · Self-hosted

This is for traffic leaving GoRunner. For a proxy in front of it, see Behind your own proxy.

Set the proxy

Give it to the setup (--https-proxy, --http-proxy, --no-proxy), or write it in .env and apply it with ./deploy.sh "$(cat VERSION)".

.env
HTTPS_PROXY=http://proxy.example.com:3128
HTTP_PROXY=http://proxy.example.com:3128
NO_PROXY=intranet.example.com,.corp.example.com
HTTPS_PROXY, HTTP_PROXY
An http://, https:// or socks5:// proxy (socks5h:// lets it look names up). A sign-in goes in the address, http://user:password@…; the password never shows in logs.
NO_PROXY
Your own internal sites, reached directly. GoRunner adds its own: this server, its containers and the cloud metadata addresses.

On Kubernetes they are proxy.https, proxy.http, proxy.noProxy and proxy.connect. The preflight check tests that the proxy answers.

What goes through it

Through the proxyNever through it
Workflow steps’ calls (HTTP, GraphQL, RSS…), after GoRunner checks the address. A step’s own proxy wins, and is checked the same way.The built-in database, Redis and storage, and GoRunner’s own containers.
OAuth sign-ins and token refreshes.Event streams over syslog: give the collector a direct route.
Notifications and event streams over HTTP.Anything in NO_PROXY.
Your own S3 bucket, Sentry and OpenTelemetry.

For addresses other people choose, GoRunner looks the name up and checks every address before it asks the proxy. So the server still needs DNS for outside names. Workflow steps follow Outbound access.

Squid, among others, refuses plain-http calls to ports other than 443 by default. Put such internal sites in NO_PROXY.

The proxy’s certificate

A proxy that inspects https signs with your company’s own certificate authority. Put its .pem file in the install’s certs/ folder, and every container trusts it after a restart, one at a time:

bash
docker compose restart api-twin
docker compose restart api
docker compose restart worker

By name, or by address

EGRESS_PROXY_CONNECT (--proxy-connect) says what GoRunner asks the proxy for, once it has checked the address.

name, the default
The site by its name, which proxies that allow sites by name need (Squid with a domain list, Zscaler, Blue Coat). The proxy looks the name up again with its own DNS, so set it to refuse private, link-local and metadata addresses. The check warns about this every time.
ip
The address GoRunner checked, never the name. The proxy can reach only what GoRunner allowed. A proxy that allows by name refuses these requests, and the error says so.

The ranges to refuse on the proxy: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, fc00::/7, fe80::/10.

Which calls does this rule cover?

Workflow steps, notification endpoints, event streams over HTTP, and the token address of an OAuth app someone brings. Your bucket and your monitoring are handed to the proxy by name, as any program does.

A step’s plain-http call goes to the proxy by name, once every address of that name was checked. With ip, it is a tunnel to the checked address.

Can I go back to an older version?

Not below v2026.10.3. Versions v2026.10.0 to v2026.10.2 didn’t use a company proxy, so the update refuses to go back, and changes nothing.

Checked against 12d85b3b