Running Budibase behind company proxy

If you are running budibase in an environment where you need to use a proxy, such as inside an organisational network you can have budibase proxy all it's backend requests through a proxy of your choice. This functionality is driven by the global-agent package:

https://github.com/gajus/global-agent

Configuration

There are 2 environment variables you will need to run budibase behind a company proxy:

Bear in mind that these variables need to be made available to both the worker and app services, so if using docker compose, you must add them to your docker compose configuration:

services:
  app-service:
    restart: unless-stopped
    image: budibase.docker.scarf.sh/budibase/apps
    container_name: bbapps
    environment:
     GLOBAL_AGENT_HTTP_PROXY: http://my-proxy.net
     GLOBAL_AGENT_HTTPS_PROXY: https://my-proxy.net
  worker-service:
    restart: unless-stopped
    image: budibase.docker.scarf.sh/budibase/apps
    container_name: bbworker
    environment:
      GLOBAL_AGENT_HTTP_PROXY: http://my-proxy.net
      GLOBAL_AGENT_HTTPS_PROXY: https://my-proxy.net

For container to container communication using docker-compose - you may need to add the following to avoid that local communication going through your proxy:

GLOBAL_AGENT_NO_PROXY: couchdb-service,app-service,worker-service,minio-service,redis-service,localhost

For single image setups, you can pass these environment variables using standard docker run syntax.

docker run -d -t 
-e GLOBAL_AGENT_HTTP_PROXY=http://my-proxy.net 
-p 10000:80 
-v /local/path/data:/data  
--restart unless-stopped 
budibase/budibase:latest

Security and DNS resolution

When a proxy is configured, Budibase delegates DNS resolution for outbound requests to the proxy server. This means that internal security features, such as DNS rebinding protection (IP pinning), are managed by the proxy rather than the Budibase application server. Ensure your proxy is configured to enforce your organization's destination policies and network security standards.

Outbound Allow-list

To use your Budibase deployment, you must allow a list of outbound connections. These are as follows: