opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add upstream proxy support to aiproxy for passthrough requests (#21512)

Browse Source 
## Description

Adds upstream proxy support for AI Bridge Proxy passthrough requests.
This allows aiproxy to forward non-allowlisted requests through an
upstream proxy. Currently, the only supported configuration is when
aiproxy is the first proxy in the chain (client → aiproxy → upstream
proxy).

## Changes

* Add `--aibridge-proxy-upstream` option to configure an upstream
HTTP/HTTPS proxy URL for passthrough requests
* Add `--aibridge-proxy-upstream-ca` option to trust custom CA
certificates for HTTPS upstream proxies
* Passthrough requests (non-allowlisted domains) are forwarded through
the upstream proxy
* MITM'd requests (allowlisted domains) continue to go directly to
aibridge, not through the upstream proxy
* Add tests for upstream proxy configuration and request routing

Closes: https://github.com/coder/internal/issues/1204
This commit is contained in:
Susana Ferreira
2026-01-19 08:50:57 +00:00
committed by GitHub
parent 1813605012
commit a406ed7cc5
13 changed files with 520 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codersdk/deployment.go
+22
View File
@@ -3547,6 +3547,26 @@ Write out the current server config as YAML to stdout.`,
Group: &deploymentGroupAIBridgeProxy,
YAML: "domain_allowlist",
},
{
Name: "AI Bridge Proxy Upstream Proxy",
Description: "URL of an upstream HTTP proxy to chain passthrough (non-allowlisted) requests through. Format: http://[user:pass@]host:port or https://[user:pass@]host:port.",
Flag: "aibridge-proxy-upstream",
Env: "CODER_AIBRIDGE_PROXY_UPSTREAM",
Value: &c.AI.BridgeProxyConfig.UpstreamProxy,
Default: "",
Group: &deploymentGroupAIBridgeProxy,
YAML: "upstream_proxy",
},
{
Name: "AI Bridge Proxy Upstream Proxy CA",
Description: "Path to a PEM-encoded CA certificate to trust for the upstream proxy's TLS connection. Only needed for HTTPS upstream proxies with certificates not trusted by the system. If not provided, the system certificate pool is used.",
Flag: "aibridge-proxy-upstream-ca",
Env: "CODER_AIBRIDGE_PROXY_UPSTREAM_CA",
Value: &c.AI.BridgeProxyConfig.UpstreamProxyCA,
Default: "",
Group: &deploymentGroupAIBridgeProxy,
YAML: "upstream_proxy_ca",
},
// Retention settings
{
@@ -3647,6 +3667,8 @@ type AIBridgeProxyConfig struct {
CertFile serpent.String `json:"cert_file" typescript:",notnull"`
KeyFile serpent.String `json:"key_file" typescript:",notnull"`
DomainAllowlist serpent.StringArray `json:"domain_allowlist" typescript:",notnull"`
UpstreamProxy serpent.String `json:"upstream_proxy" typescript:",notnull"`
UpstreamProxyCA serpent.String `json:"upstream_proxy_ca" typescript:",notnull"`
}
type AIConfig struct {