Setting Up HTTP Proxies

Overview

If you are setting up your proxy through Amazon, read this before proceeding:

Avoid proxying internal requests, especially for the Services machine. To add these to theNO_PROXYrules, run:

export NO_PROXY=

In an ideal case, traffic to S3 will not be proxied, and will instead be bypassed by addings3.amazonaws.com,*.s3.amazonaws.comto theNO_PROXYrule.

These instructions assume an unauthenticated HTTP proxy at10.0.0.33:3128, a Services machine at10.0.1.238and use ofghe.example.comas the GitHub Enterprise host.

The following proxy instructions must be completedbeforeinstalling CircleCI on fresh VMs or instances. You must also configure JVM OPTs again as described below.

Service Machine Proxy Configuration

The Service machine has many components that need to make network calls, as follows:

  • External Network Calls- Replicated is a vendor service that we use for the Management Console of CircleCI. CircleCI requires Replicated to make an outside call to validate the license, check for updates, and download upgrades. Replicated also downloads docker, installs it on the local machine, and uses a Docker container to create and configure S3 buckets. GitHub Enterprise may or may not be behind the proxy, but github.com will need to go through the proxy.

  • Internal Network Calls

    • If S3 traffic requires going through an HTTP proxy, CircleCI must pass proxy settings into the container.

    • The CircleCI instance on the Services machine runs in a Docker container, so it must to pass the proxy settings to the container to maintain full functionality.

建立服务机代理中rt

For a static installation, not on AWS, SSH into the Services machine and run the following code snippet with your proxy address:

echo '{"HttpProxy": "http://"}' | sudo tee /etc/replicated.conf (cat <<'EOF' export HTTP_PROXY= export HTTPS_PROXY= EOF ) | sudo tee -a /etc/circle-installation-customizations systemctl restart replicated\*

If you run in Amazon’s EC2 service then you’ll need to include169.254.169.254EC2 services as shown below:

echo '{"HttpProxy": "http://"}' | sudo tee /etc/replicated.conf (cat < export HTTPS_PROXY= export NO_PROXY=169.254.169.254,,127.0.0.1,localhost,ghe.example.com export JVM_OPTS="-Dhttp.proxyHost= -Dhttp.proxyPort= -Dhttps.proxyHost= -Dhttps.proxyPort= -Dhttp.nonProxyHosts=169.254.169.254||127.0.0.1|localhost|ghe.example.com" EOF ) | sudo tee -a /etc/circle-installation-customizations systemctl restart replicated\*
NOTE: If the proxy requires user authentication, you will need to add user authentication information into like below:
export HTTP_PROXY=http://:@: export HTTPS_PROXY=https://:@:
The above is not handled by by our enterprise-setup script and will need to be added to the user data for the Services Machine startup or done manually.

Corporate Proxies

When our instructions ask if you use a proxy, you will also be prompted to input the address. It isvery importantthat you input the proxy in the following format:://:. If you miss any part, thenapt-getwon’t work correctly and the packages won’t download.

Nomad Client Configuration

External Network Calls

CircleCI uses旋度andawscliscripts to download initialization scripts, along with jars from Amazon S3. Both旋度andawsclirespect environment settings, but if you have allowed traffic from Amazon S3 you should not have any problems.

Internal Network Calls

  • CircleCI JVM:

    • Any connections to other Nomad Clients or the Services machine should be excluded from HTTP proxy

    • Connections to GitHub Enterprise should be excluded from HTTP proxy

  • The following contains parts that may be impacted due to a proxy configuration:

    • Amazon EC2 metadata. Thisshould notbe proxied. If it is, then the machine will be misconfigured.

    • Amazon S3 traffic — note S3 discussion above

    • Amazon EC2 API - EC2 API traffic may need to be proxied. You would note lots of failures (timeout failures) in logs if the proxy setting is misconfigured, but it will not block CircleCI from functioning.

Nomad Client Proxy Setup

  • If you are installing CircleCI Server on AWS using Terraform, you should add the below to your Nomad client launch configuration – these instructions should be added to/etc/environment.

  • If you are using Docker refer to theDocker HTTP Proxy Instructionsdocumentation.

  • If you are running a static installation, add the following to the server before installation:

    #!/bin/bash (cat < HTTPS_PROXY= NO_PROXY=169.254.169.254,,127.0.0.1,localhost,ghe.example.com JVM_OPTS="-Dhttp.proxyHost= -Dhttp.proxyPort= -Dhttps.proxyHost= -Dhttps.proxyPort=3128 -Dhttp.nonProxyHosts=169.254.169.254||127.0.0.1|localhost|ghe.example.com" EOF) | sudo tee -a /etc/environment set -a . /etc/environment

    If your containers need to use a proxy server you will need to set the following schedulerer environment variables:DOCKER_HTTP_PROXY,DOCKER_HTTPS_PROXY,NO_PROXY, corresponding to those listed inthe Docker instructions. This will ensure your containers have outbound/proxy access. For more information on creating configuration overrides, see theCustomizations Guide.

Troubleshooting

Can’t access the Management Console

If you cannot access the CircleCI Management Console, but the Services machine seems to be running, try to SSH tunnel into the machine by running the following, substituting your proxy address and the IP address of your Services machine:

ssh -L 8800:
:8800 ubuntu@

REPL time out

If you experience a timeout when connecting to the REPL, you will need to allow access, through your corporate proxy, to the domains of any Clojure library repositories that are required to download dependencies for running the REPL.

sudo su docker exec -it frontend /bin/bash lein repl :connect 6005

Refer to the error output for guidance on which repositories need to be granted access. The list will be different for each corporate proxy, but following is an example list:

  • repo1.maven.org

  • build.clojure.org

  • clojars.org

  • repo.clojars.org

Data Persistence

ContactCircleCI Supportto discuss externalizing services for data persistence.