Configuring an Outbound HTTP Proxy (Firewall Egress)

In strictly secured corporate networks or government environments, servers often have no direct access to the internet and all outbound traffic must pass through a central HTTP / HTTPS Proxy (e.g. Squid or a corporate firewall).

LockMyCal fully supports routing all outbound communication (Google Calendar API, Microsoft Graph, Stripe, Webhooks) through a dedicated outbound proxy.

1. Standard proxy configuration

Set in the .env file:

# Outbound HTTP/HTTPS proxy
HTTP_PROXY=http://proxy.corporation.com:8080
HTTPS_PROXY=http://proxy.corporation.com:8080

# A list of addresses and ranges that the proxy should bypass (a direct connection)
NO_PROXY=localhost,127.0.0.1,db,.internal-network.com

2. Authenticated proxy (Username and password)

If the proxy requires a login:

HTTP_PROXY=http://user:password@proxy.corporation.com:8080
HTTPS_PROXY=http://user:password@proxy.corporation.com:8080

3. Support for custom root CA certificates (TLS Inspection)

If your corporate proxy inspects TLS traffic (a MITM proxy) using its own internal certification authority (CA), attach the certificate bundle to the container in docker-compose.yml:

volumes:
  - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro