Routing Private Gateway Traffic Through a Proxy

A Private Gateway can send its outbound traffic through any standard HTTP/HTTPS proxy — a corporate proxy, a network appliance, or a Cyolo-managed proxy. This is useful in locked-down networks where the Private Gateway has no direct egress to the internet.

Configuration

Add the following environment variables to the router service in the Private Gateway's docker-compose.yml:

environment:
  - USE_EDGE_PROXY=true
  - ENABLE_UPSTREAM_VIA_PROXY=true
  - HTTP_PROXY=http://<proxy-ip>:<port>
  - HTTPS_PROXY=https://<proxy-ip>:<port>

Environment variables

Variable	Required	Description
`USE_EDGE_PROXY`	Yes	Master switch. Must be `true` for the Private Gateway to route traffic through a proxy. If `false` (the default), `HTTP_PROXY` and `HTTPS_PROXY` are ignored even if set.
`HTTP_PROXY`	Yes	Proxy URL for the Private Gateway's outbound HTTP connections.
`HTTPS_PROXY`	Yes	Proxy URL for the Private Gateway's outbound HTTPS connections.
`ENABLE_UPSTREAM_VIA_PROXY`	Optional	When `true`, the Private Gateway's upstream connection to the Cyolo Global Gateway (or to an upstream Private Gateway) is also tunneled through the proxy. Requires `USE_EDGE_PROXY=true`. When `false` (the default), only outbound HTTP/HTTPS calls go through the proxy — the upstream tunnel connects directly.