opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add upstream proxy support to aiproxy for passthrough requests (#21512)

Browse Source 
## Description

Adds upstream proxy support for AI Bridge Proxy passthrough requests.
This allows aiproxy to forward non-allowlisted requests through an
upstream proxy. Currently, the only supported configuration is when
aiproxy is the first proxy in the chain (client → aiproxy → upstream
proxy).

## Changes

* Add `--aibridge-proxy-upstream` option to configure an upstream
HTTP/HTTPS proxy URL for passthrough requests
* Add `--aibridge-proxy-upstream-ca` option to trust custom CA
certificates for HTTPS upstream proxies
* Passthrough requests (non-allowlisted domains) are forwarded through
the upstream proxy
* MITM'd requests (allowlisted domains) continue to go directly to
aibridge, not through the upstream proxy
* Add tests for upstream proxy configuration and request routing

Closes: https://github.com/coder/internal/issues/1204
This commit is contained in:
Susana Ferreira
2026-01-19 08:50:57 +00:00
committed by GitHub
parent 1813605012
commit a406ed7cc5
13 changed files with 520 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/api/general.md
Generated
+3 -1
View File
@@ -169,7 +169,9 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"
"listen_addr": "string",
"upstream_proxy": "string",
"upstream_proxy_ca": "string"
},
"bridge": {
"anthropic": {
docs/reference/api/schemas.md
Generated
+21 -11
View File
@@ -604,19 +604,23 @@
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"
"listen_addr": "string",
"upstream_proxy": "string",
"upstream_proxy_ca": "string"
}
```
### Properties
| Name | Type | Required | Restrictions | Description |
|--------------------|-----------------|----------|--------------|-------------|
| `cert_file` | string | false | | |
| `domain_allowlist` | array of string | false | | |
| `enabled` | boolean | false | | |
| `key_file` | string | false | | |
| `listen_addr` | string | false | | |
| Name | Type | Required | Restrictions | Description |
|---------------------|-----------------|----------|--------------|-------------|
| `cert_file` | string | false | | |
| `domain_allowlist` | array of string | false | | |
| `enabled` | boolean | false | | |
| `key_file` | string | false | | |
| `listen_addr` | string | false | | |
| `upstream_proxy` | string | false | | |
| `upstream_proxy_ca` | string | false | | |
## codersdk.AIBridgeTokenUsage
@@ -723,7 +727,9 @@
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"
"listen_addr": "string",
"upstream_proxy": "string",
"upstream_proxy_ca": "string"
},
"bridge": {
"anthropic": {
@@ -2639,7 +2645,9 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"
"listen_addr": "string",
"upstream_proxy": "string",
"upstream_proxy_ca": "string"
},
"bridge": {
"anthropic": {
@@ -3184,7 +3192,9 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
],
"enabled": true,
"key_file": "string",
"listen_addr": "string"
"listen_addr": "string",
"upstream_proxy": "string",
"upstream_proxy_ca": "string"
},
"bridge": {
"anthropic": {
docs/reference/cli/server.md
Generated
+20
View File
@@ -1889,6 +1889,26 @@ Path to the CA certificate file for AI Bridge Proxy.
Path to the CA private key file for AI Bridge Proxy.
### --aibridge-proxy-upstream
| | |
|-------------|---------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AIBRIDGE_PROXY_UPSTREAM</code> |
| YAML | <code>aibridgeproxy.upstream_proxy</code> |
URL of an upstream HTTP proxy to chain passthrough (non-allowlisted) requests through. Format: http://[user:pass@]host:port or https://[user:pass@]host:port.
### --aibridge-proxy-upstream-ca
| | |
|-------------|------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AIBRIDGE_PROXY_UPSTREAM_CA</code> |
| YAML | <code>aibridgeproxy.upstream_proxy_ca</code> |
Path to a PEM-encoded CA certificate to trust for the upstream proxy's TLS connection. Only needed for HTTPS upstream proxies with certificates not trusted by the system. If not provided, the system certificate pool is used.
### --audit-logs-retention
| | |