Working through a proxy

Docker

If docker.mitigator.ru is accessed through a proxy, you need to configure Docker.

On systems running systemd, you need to:

Create a drop-in to the Docker service, specifying the proxy in the environment (replace the details of connecting to the proxy with the current ones):

mkdir -p /etc/systemd/system/docker.service.d
cat >/etc/systemd/system/docker.service.d/proxy.conf <<END
[Service]
Environment=HTTP_PROXY=http://user:password@proxy.local:1234
Environment=HTTPS_PROXY=http://user:password@proxy.local:1234
Environment=NO_PROXY=docker.local
END

Add proxy certificate to Docker’s trusted ones (/path/to/proxy.crt replace with the path to the proxy certificate):

mkdir -p /etc/docker/certs.d/docker.mitigator.ru
cp /path/to/proxy.crt /etc/docker/certs.d/docker.mitigator.ru/ca.crt

Update the description of the Docker service and restart it:
```
systemctl daemon-reload
systemctl restart docker
```

Podman

If docker.mitigator.ru is accessed through a proxy, you need to configure Podman.

Set proxy environment variables in Podman’s containers.conf (system-wide or per-user, replace the proxy connection details with the current ones):
For system-wide configuration:
```
mkdir -p /etc/containers
cat >>/etc/containers/containers.conf <<END
[engine]
env = [
  "http_proxy=http://user:password@proxy.local:1234",
  "https_proxy=http://user:password@proxy.local:1234",
  "no_proxy=docker.local"
]
END
```
For per-user configuration, use ~/.config/containers/containers.conf instead.

Add proxy certificate to Podman’s trusted ones (/path/to/proxy.crt replace with the path to the proxy certificate):

mkdir -p /etc/containers/certs.d/docker.mitigator.ru
cp /path/to/proxy.crt /etc/containers/certs.d/docker.mitigator.ru/ca.crt

No daemon restart is needed (Podman is daemonless). If using the Podman system socket, restart it:
```
systemctl restart podman
```

Collector

If Collector will communicate with the license server (ls.mitigator.ru) through a proxy, you need to specify environment variables. To do this, you need to create a docker-compose.override.yml file with content like this:

services:
  backend:
    environment:
      HTTP_PROXY: "http://user:password@proxy.local:3128"
      HTTPS_PROXY: "http://user:password@proxy.local:3128"

If necessary, also set NO_PROXY (addresses that need to be accessed without a proxy), you need to include .collector, localhost, 127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16 and 172.16.0.0/12 in it:

NO_PROXY: "<new servers>,.collector,localhost,127.0.0.0/8,10.0.0.0/8,192.168.0.0/16,172.16.0.0/12"

After that, you need to restart the backend service:

docker-compose up -d backend

podman-compose up -d backend

Do not use proxy settings in ~/.docker/config.json (Docker) or ~/.config/containers/containers.conf (Podman) configuration file for Collector containers. If these settings are required for non-Collector containers, specify them only for such containers.