> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting proxy servers

There are a few common setups for situations where mirrors should go through a proxy server, each with their own specific requirements and considerations.

These methods can be compounded, meaning you can have an environment that employs any combination of the following setups:

## Single proxy

A single proxy is used for all outgoing HTTP/HTTPS connections to the internet.

**Requirements**

* Proxy address/port
* Network access from Anaconda Server to the proxy server
* Ensuring proper name resolution (if needed)

**Implementation**

Follow these steps to set up a single proxy:

1. Open your `docker-compose.yml` file.

2. Add the `HTTP_PROXY` and/or `HTTPS_PROXY` as well as the `NO_PROXY` environment variables to the `repo_worker` and `repo_api` containers. For example:

   ```yaml theme={null}
   repo_worker:
     environment:
       - HTTP_PROXY=http://<PROXY_USER>:<PROXY_PW>@proxypy:8899
       - HTTPS_PROXY=http://<PROXY_USER>:<PROXY_PW>@proxypy:8899
       - NO_PROXY=localhost, repo.anaconda.com
   repo_api:
     environment:
       - HTTP_PROXY=http://<PROXY_USER>:<PROXY_PW>@proxypy:8899
       - HTTPS_PROXY=http://<PROXY_USER>:<PROXY_PW>@proxypy:8899
       - NO_PROXY=localhost, repo.anaconda.com

   ```

3. Restart the containers by running the following command:

   ```sh theme={null}
   docker-compose up -d repo_api
   docker-compose up -d repo_worker
   docker restart $(docker ps|grep repo_worker|cut -d' ' -f1)
   docker restart $(docker ps|grep repo_api|cut -d' ' -f1)
   docker-compose restart
   ```

## Multiple proxies (or users) for mirror jobs

When mirroring through different proxies—whether this is because you’re using a different proxy server or
an entirely different user is mirroring—you must apply the correct settings to each respective mirror.

**Requirements**

The requirements for multiple proxies are the same as the requirements for single proxies; however, you must
modify the settings for each respective proxy.

For example, the proxy URI two users could be named the following:

```sh theme={null}
http://user1:pw1@proxy:8899
and
http://user2:pw2@proxy:8899
```

**Implementation**

<Note>
  All updates to the mirror must go through the CLI/PAI, *not* through the GUI (the proxy setting will be removed if you update from the GUI).
</Note>

Establish the mirror using `conda repo mirror` in the cli, or `/channel/mirrors` via the REST API. This will
allow you to specify the proxy address to be used for the specific mirror.

The following example shows multiple mirrors with different proxy users. It assumes a proxy is available at [http://proxy:8899](http://proxy:8899) with basic auth.

If you are using a terminating SSL proxy, see the [Terminating SSL proxy](#terminating-ssl-proxy) section.

```sh theme={null}
# Replace user1/pw1 and user2/pw2 with valid credentials.
repo channel --create proxy-example
conda repo mirror --create proxy-mirror1 \
                --channel proxy-example \
                --source https://repo.anaconda.com/pkgs/main \
                --only_spec python \
                --proxy http://user2:pw2@proxy:8899
```

Here is a second mirror with a different user. You can also use multiple
proxies in the same manner, for example `@another.proxy.server` instead of `@proxy`.

```sh theme={null}
conda repo mirror --create proxy-mirror2 \
                --channel proxy-example \
                --source https://repo.anaconda.com/pkgs/main \
                --only_spec pandas \
                --proxy http://user1:pw1@proxy:8899
```

## Terminating SSL Proxy

For a proxy server that terminates the SSL connection, you’ll typically need to distribute the root ca certificate used by
the proxy to TE so it can verify the certs.

**Requirements**

* Same requirements as those for single proxies
* The ca cert from the proxy server
* All certs for proxies (if multiple proxies are used)

**Implementation**

For this setup, you must append all required ca certs to the TE `repo_api` and `repo_worker` containers.
Certs are stored in `/conda/ssl/cacert.pem`.

Use the following bash function to update existing containers with the root CA for the proxy:

```sh theme={null}
update_proxy_ca() {
  # usage: update_proxy_ca <path-to-cert>
  if [[ -f $1 ]]; then
    ca="$1"
  else
    echo please provide a path to cert file
    return
  fi
  for c in $(docker ps | awk '/repo_[a,w]/ {print $1}') ; do
    docker cp $ca ${c}:/usr/share/pki/ca-trust-source/anchors/proxy.pem
    docker exec -ti ${c} sh -c "cat /usr/share/pki/ca-trust-source/anchors/proxy.pem >> /conda/ssl/cacert.pem"
    docker exec $c update-ca-trust
  done
}
```