# A company proxy

Send everything GoRunner calls outside through your company’s proxy.

This is for traffic leaving GoRunner. For a proxy in front of it, see [Behind your own proxy](https://docs.gorunner.io/self-host/own-proxy).

## Set the proxy

Give it to the setup (`--https-proxy`, `--http-proxy`, `--no-proxy`), or write it in `.env` and apply it with `./deploy.sh "$(cat VERSION)"`.

`.env`

```
HTTPS_PROXY=http://proxy.example.com:3128
HTTP_PROXY=http://proxy.example.com:3128
NO_PROXY=intranet.example.com,.corp.example.com
```

- `HTTPS_PROXY`, `HTTP_PROXY`: An `http://`, `https://` or `socks5://` proxy (`socks5h://` lets it look names up). A sign-in goes in the address, `http://user:password@…`; the password never shows in logs.
- `NO_PROXY`: Your own internal sites, reached directly. GoRunner adds its own: this server, its containers and the cloud metadata addresses.

On Kubernetes they are `proxy.https`, `proxy.http`, `proxy.noProxy` and `proxy.connect`. The [preflight check](https://docs.gorunner.io/self-host/preflight-check) tests that the proxy answers.

## What goes through it

| Through the proxy | Never through it |
| --- | --- |
| Workflow steps’ calls (HTTP, GraphQL, RSS…), after GoRunner checks the address. A step’s own proxy wins, and is checked the same way. | The built-in database, Redis and storage, and GoRunner’s own containers. |
| OAuth sign-ins and token refreshes. | Event streams over syslog: give the collector a direct route. |
| Notifications and event streams over HTTP. | Anything in `NO_PROXY`. |
| Your own S3 bucket, Sentry and OpenTelemetry. |   |

For addresses other people choose, GoRunner looks the name up and checks every address before it asks the proxy. So the server still needs DNS for outside names. Workflow steps follow [Outbound access](https://docs.gorunner.io/self-host/outbound-access).

Squid, among others, refuses plain-http calls to ports other than 443 by default. Put such internal sites in `NO_PROXY`.

## The proxy’s certificate

A proxy that inspects https signs with your company’s own certificate authority. Put its `.pem` file in the install’s `certs/` folder, and every container trusts it after a restart, one at a time:

```bash
docker compose restart api-twin
docker compose restart api
docker compose restart worker
```

## By name, or by address

`EGRESS_PROXY_CONNECT` (`--proxy-connect`) says what GoRunner asks the proxy for, once it has checked the address.

- `name`, the default: The site by its name, which proxies that allow sites by name need (Squid with a domain list, Zscaler, Blue Coat). The proxy looks the name up again with its own DNS, so set it to refuse private, link-local and metadata addresses. The check warns about this every time.
- `ip`: The address GoRunner checked, never the name. The proxy can reach only what GoRunner allowed. A proxy that allows by name refuses these requests, and the error says so.

The ranges to refuse on the proxy: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `100.64.0.0/10`, `127.0.0.0/8`, `169.254.0.0/16`, `fc00::/7`, `fe80::/10`.

**Which calls does this rule cover?**

Workflow steps, notification endpoints, event streams over HTTP, and the token address of an OAuth app someone brings. Your bucket and your monitoring are handed to the proxy by name, as any program does.

A step’s plain-http call goes to the proxy by name, once every address of that name was checked. With `ip`, it is a tunnel to the checked address.

**Can I go back to an older version?**

Not below v2026.10.3. Versions v2026.10.0 to v2026.10.2 didn’t use a company proxy, so the update refuses to go back, and changes nothing.

## Related

- [Outbound access](https://docs.gorunner.io/self-host/outbound-access): Where workflow steps may connect · 4 min
- [Behind your own proxy](https://docs.gorunner.io/self-host/own-proxy): A proxy in front of GoRunner · 10 min
- [Settings (.env)](https://docs.gorunner.io/self-host/settings): Every setting

Source: https://docs.gorunner.io/self-host/company-proxy