Problem
The OpenAEV agent currently only supports a boolean WITH_PROXY flag to control proxy usage. There is no explicit configuration option to set a proxy address directly through the agent's installation/configuration parameters.
Current behavior (confirmed in code)
In the Rust agent client (src/api/mod.rs):
pub fn new(server_url: String, token: String, unsecured_certificate: bool, with_proxy: bool) -> Client {
...
if !with_proxy {
http_client = http_client.no_proxy();
}
...
}
with_proxy is a simple boolean. When true, the underlying HTTP client (reqwest) falls back to reading the system-level environment variables HTTP_PROXY / HTTPS_PROXY. There is no code path that accepts an explicit proxy address as a parameter.
This boolean flows end-to-end unchanged from the installer/command builder down to the agent binary:
- PowerShell installer (
agent-installer.ps1): ~WITH_PROXY=${OPENAEV_WITH_PROXY}
- Command builder (Java,
OpenaevImplantCommandBuilder.java): --with-proxy $with_proxy
- Rust agent:
with_proxy: bool
Why this is a problem
Users deploying the agent in environments where:
- They don't have control over OS-level environment variables (locked-down endpoints, managed images, some EDR-controlled environments), or
- They need per-agent / per-deployment proxy configuration different from the system default,
...have no way to configure the proxy through OpenAEV's own installation parameters. They must rely entirely on system-level HTTP_PROXY/HTTPS_PROXY env vars being correctly set outside of OpenAEV's control, which is not always possible or practical in enterprise/managed environments.
This has come up repeatedly in community support threads (Slack), with the recurring point being: "WITH_PROXY boolean is not sufficient — there's no way to pass the actual proxy address."
Proposed solution
Add an explicit PROXY_ADDRESS (e.g. http://proxyhost:port, optionally with credentials) configuration option, threaded through the same chain as WITH_PROXY:
- Rust agent (
src/api/mod.rs): accept an optional explicit proxy address and pass it to the reqwest client builder (e.g. .proxy(Proxy::all(address)?)) instead of relying solely on no_proxy() / implicit env var detection.
- Command builder (Java,
OpenaevImplantCommandBuilder.java): add a --proxy-address parameter alongside --with-proxy.
- Installer scripts (PowerShell/bash): add
~PROXY_ADDRESS= parameter, passed through when generating the agent install command from the platform UI.
- Platform UI: expose a field to set the proxy address when generating agent deployment commands (currently only a
WITH_PROXY toggle is likely exposed, if at all).
Backward compatibility: if PROXY_ADDRESS is not set and WITH_PROXY=true, keep the current fallback behavior (system env vars).
Use case
An enterprise customer deploys OpenAEV agents on endpoints where outbound traffic must go through a specific corporate proxy, and the deployment process (via GPO/SCCM/managed image) does not reliably set HTTP_PROXY/HTTPS_PROXY system-wide before the agent starts. Today, the only workaround is manually configuring OS-level env vars per host — this doesn't scale for fleet deployments and defeats the purpose of a single install command.
Problem
The OpenAEV agent currently only supports a boolean
WITH_PROXYflag to control proxy usage. There is no explicit configuration option to set a proxy address directly through the agent's installation/configuration parameters.Current behavior (confirmed in code)
In the Rust agent client (
src/api/mod.rs):with_proxyis a simple boolean. Whentrue, the underlying HTTP client (reqwest) falls back to reading the system-level environment variablesHTTP_PROXY/HTTPS_PROXY. There is no code path that accepts an explicit proxy address as a parameter.This boolean flows end-to-end unchanged from the installer/command builder down to the agent binary:
agent-installer.ps1):~WITH_PROXY=${OPENAEV_WITH_PROXY}OpenaevImplantCommandBuilder.java):--with-proxy $with_proxywith_proxy: boolWhy this is a problem
Users deploying the agent in environments where:
...have no way to configure the proxy through OpenAEV's own installation parameters. They must rely entirely on system-level
HTTP_PROXY/HTTPS_PROXYenv vars being correctly set outside of OpenAEV's control, which is not always possible or practical in enterprise/managed environments.This has come up repeatedly in community support threads (Slack), with the recurring point being: "WITH_PROXY boolean is not sufficient — there's no way to pass the actual proxy address."
Proposed solution
Add an explicit
PROXY_ADDRESS(e.g.http://proxyhost:port, optionally with credentials) configuration option, threaded through the same chain asWITH_PROXY:src/api/mod.rs): accept an optional explicit proxy address and pass it to the reqwest client builder (e.g..proxy(Proxy::all(address)?)) instead of relying solely onno_proxy()/ implicit env var detection.OpenaevImplantCommandBuilder.java): add a--proxy-addressparameter alongside--with-proxy.~PROXY_ADDRESS=parameter, passed through when generating the agent install command from the platform UI.WITH_PROXYtoggle is likely exposed, if at all).Backward compatibility: if
PROXY_ADDRESSis not set andWITH_PROXY=true, keep the current fallback behavior (system env vars).Use case
An enterprise customer deploys OpenAEV agents on endpoints where outbound traffic must go through a specific corporate proxy, and the deployment process (via GPO/SCCM/managed image) does not reliably set
HTTP_PROXY/HTTPS_PROXYsystem-wide before the agent starts. Today, the only workaround is manually configuring OS-level env vars per host — this doesn't scale for fleet deployments and defeats the purpose of a single install command.