fix(embed): honor proxy env for non-loopback endpoints - #130
Open
spacemolt-molty wants to merge 1 commit into
Open
fix(embed): honor proxy env for non-loopback endpoints#130spacemolt-molty wants to merge 1 commit into
spacemolt-molty wants to merge 1 commit into
Conversation
The embedding client set Proxy: nil on its http.Transport — intended to keep local Ollama instances off corporate proxies, but it also disabled proxy env for every remote endpoint. Behind credential gateways that inject auth at the proxy boundary (a transparent HTTPS_PROXY), remote OpenAI-compatible providers became unreachable: the client bypassed the gateway, then failed with 401 because the key only exists gateway-side. Route by endpoint instead: loopback (localhost / 127.0.0.0/8 / ::1) never uses a proxy; everything else resolves through the standard HTTPS_PROXY/HTTP_PROXY/NO_PROXY environment. The loopback branch returns an explicit no-proxy resolver rather than nil, which panics when the Transport invokes it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The embedding client's
http.Transportnow resolves its proxy from the environment (HTTPS_PROXY/HTTP_PROXY/NO_PROXY) for non-loopback endpoints, and never uses a proxy for loopback endpoints.Why
NewClientWithModelsetProxy: nilon the transport. The comment said "Bypass system proxy for localhost connections" — butProxy: nildisables proxy env for every endpoint, not just localhost. Two consequences:HTTPS_PROXY, as used by e.g. OneCLI-style agent gateways), remote OpenAI-compatible embedding providers become unreachable: the client bypasses the gateway and hits the provider directly, then fails with 401 because the API key only exists gateway-side.Routing by endpoint fixes both: loopback never proxied, remote endpoints follow standard env resolution (so gateways work), and corporate proxies stop breaking local setups in the opposite direction.
One subtlety: the loopback branch returns an explicit no-proxy resolver (
func(*http.Request) (*url.URL, error) { return nil, nil }) rather thannil, because a nilTransport.Proxypanics when invoked.Follow-up to #127 (same area, found while wiring up a Voyage AI backend behind a credential gateway).
Checklist
make test)make test-integration, when affected)