Does Traefik honour http_proxy for corporate proxies?

[lhaig]

What version of Traefik are you using (traefik version)?

Version: v1.1.2
Codename: camembert
Go version: go1.7.4
Built: 2016-12-15_10:27:40AM
OS/Arch: linux/amd64

What is your environment & configuration (arguments, toml...)?

Standard traefik toml file with acme enabled

What did you do?

I tested a connection on http and this worked connecting to the proxied server.
I enabled https and letsencrypt on a separate entrypoint with the staging server

What did you expect to see?

To get a staging certificate from letsencrypt.

What did you see instead?

time="2017-02-03T17:37:02+01:00" level=fatal msg="Error preparing server: get directory at 'https://acme-staging.api.letsencrypt.org/directory': failed to get \"https://acme-staging.api.letsencrypt.org/directory\": Get https://acme-staging.api.letsencrypt.org/directory: dial tcp: lookup acme-staging.api.letsencrypt.org on X.X.X.X:53: no such host"

This error is due to their being no access to the internet directly from hosts. we have to use a corporate proxy.

I configured http_proxy and https_proxy within the system environment variables but it seems that the traefik binary does not honour these variables.

[dtomcej]

@lhaig Are your hosts externally accessible?

Lets Encrypt uses a TLS challenge to issue certificates, which requires external (separate) TLS access to the client. The bigger question is, does your corporate proxy allow Let's Encrypt access to your binary?

[lhaig]

Hi, Yes the access back is not proxied just the access out. The request is successful when you use the standard client. So traefik does not seem to honour the http_proxy environment variables Thanks Lance

[andrejvanderzee]

Looks like this is still the case :-(

Will this be solved anytime soon?

[lhaig]

I had to go with an Nginx reverse proxy for now until this can be solved.
If I can help with debugging this let me know

[grealish]

Bumping Issue as it also block's a deployment i'm working one where they use a outbound http_proxy

[nmengin]

Hello @lhaig @andrejvanderzee @grealish .

Many thanks for your interest in our project.

Can you give me more information about your environments? Do you use Traefik directly on the host where you declared your environment variables (HTTP_PROXY and HTTPS_PROXY) or do you use containers? If you use containers, how do you declare the environment variables?

Indeed, I tam currently trying to reproduce your problem on my own machine but I can't!
I use Traefik directly on my host and I have a Docker environment with boulder and a squid server.
I added some debug logs into lego and apparently the HTTP_PROXY and HTTPS_PROXY variables are set when it does the HTTP requests...

Many thanks in advance.

[grealish]

Hi @nmengin
After I wrote my message, I anyways included traefik into my docker deployment where HTTP_PROXY was set as a ENV, intending to use traefik without Lets Encrypt.
Good news is GoLang HTTP client respects HTTP_PROXY variable if it's set before it starts.

It will be a difficult environment to reproduce, as this customer is using a commercial http proxy that only respects specific HTTPS URL's that are white-listed so,
from the error messages that sometimes are returned, i'm pretty sure it's this: https://www.mcafee.com/us/products/web-gateway.aspx

The setup is as simple as this:

services:                 
  traefik:                
    build: .              
    command: --logLevel=DEBUG                       
    ports:                
      - "80:80"           
      - "443:443"         
      - "127.0.0.1:8484:8484"                       
    restart: always       
    environment:          
      - HTTP_PROXY=http://proxyoutbound.corp-network.com:8080/                                                    
      - HTTPS_PROXY=http://proxyoutbound.corp-network.com:8080/                                                   
    volumes:              
      - /var/run/docker.sock:/var/run/docker.sock   

For now, that makes lego work, i'll provider more feedback if I get traefik up and running fully

[nmengin]

Hello @grealish .

Many thanks for these information.
I'm really interested in a feedback from you 😄

[andrejvanderzee]

Hi @nmengin

We are also running behind a corporate proxy server that whitelist only certain external URLs. I tried running traefik in Kubernetes like this:

apiVersion: v1
kind: DaemonSet
apiVersion: extensions/v1beta1
metadata:
  name: ingress-ctl
  namespace: kube-system
spec:
  template:
    metadata:
      labels:
        name: ingress-ctl
    spec:
      containers:
      - image: {{docker-registry}}/traefik:v1.2.3
        env:
        - name: http_proxy
          value: {{http_proxy}}
        - name: https_proxy
          value: {{https_proxy}}
        - name: no_proxy
          value: {{no_proxy}}
        name: ingress-ctl
        resources:
          limits:
            cpu: 200m
            memory: 50Mi
          requests:
            cpu: 100m
            memory: 50Mi
        ports:
        - name: http
          containerPort: 80
          hostPort: {{host-port}}
        - name: admin
          containerPort: 8080
        args:
        - --web
        - --web.address=:8080
        - --kubernetes
        - --kubernetes.namespaces={{namespaces}}

[grealish]

@nmengin
After some testing over the weekend it doesn't look good,
so far, when passing HTTP_PROXY env, treafik passes all it's traffic over the outbound proxy, including the addresses of the containers (if they pass a different network), which are accessed from the perspective of the external http proxy defined in the ENV
you therefore get the page of the http_proxy "access denied or non-white-listed address"

We need to find a way so just the lets encrypt http client uses the http_proxy and not all http calls inside of traefik to the backend services

[nmengin]

@grealish
Many thanks for your analysis!!!

We discussed about the problem with part of the team.
I guess we are going to see if/how we can fix the problem for users with (non transparent) proxy and white list IP.

I'll give you a feedback in the issue to keep you in touch.

cc @containous/traefik

[grealish]

@nmengin what might be of interest is to follow the way docker handle's it using a "NO_PROXY" ENV
you could also read that dynamically
https://docs.docker.com/engine/admin/systemd/#httphttps-proxy

[lhaig]

I am closing this issue