Skip to content

feat(proxy): add explicit PROXY_ADDRESS configuration option (currently only WITH_PROXY boolean) #205

Description

Problem

The OpenAEV agent currently only supports a boolean WITH_PROXY flag to control proxy usage. There is no explicit configuration option to set a proxy address directly through the agent's installation/configuration parameters.

Current behavior (confirmed in code)

In the Rust agent client (src/api/mod.rs):

pub fn new(server_url: String, token: String, unsecured_certificate: bool, with_proxy: bool) -> Client {
    ...
    if !with_proxy {
        http_client = http_client.no_proxy();
    }
    ...
}

with_proxy is a simple boolean. When true, the underlying HTTP client (reqwest) falls back to reading the system-level environment variables HTTP_PROXY / HTTPS_PROXY. There is no code path that accepts an explicit proxy address as a parameter.

This boolean flows end-to-end unchanged from the installer/command builder down to the agent binary:

  • PowerShell installer (agent-installer.ps1): ~WITH_PROXY=${OPENAEV_WITH_PROXY}
  • Command builder (Java, OpenaevImplantCommandBuilder.java): --with-proxy $with_proxy
  • Rust agent: with_proxy: bool

Why this is a problem

Users deploying the agent in environments where:

  • They don't have control over OS-level environment variables (locked-down endpoints, managed images, some EDR-controlled environments), or
  • They need per-agent / per-deployment proxy configuration different from the system default,

...have no way to configure the proxy through OpenAEV's own installation parameters. They must rely entirely on system-level HTTP_PROXY/HTTPS_PROXY env vars being correctly set outside of OpenAEV's control, which is not always possible or practical in enterprise/managed environments.

This has come up repeatedly in community support threads (Slack), with the recurring point being: "WITH_PROXY boolean is not sufficient — there's no way to pass the actual proxy address."

Proposed solution

Add an explicit PROXY_ADDRESS (e.g. http://proxyhost:port, optionally with credentials) configuration option, threaded through the same chain as WITH_PROXY:

  1. Rust agent (src/api/mod.rs): accept an optional explicit proxy address and pass it to the reqwest client builder (e.g. .proxy(Proxy::all(address)?)) instead of relying solely on no_proxy() / implicit env var detection.
  2. Command builder (Java, OpenaevImplantCommandBuilder.java): add a --proxy-address parameter alongside --with-proxy.
  3. Installer scripts (PowerShell/bash): add ~PROXY_ADDRESS= parameter, passed through when generating the agent install command from the platform UI.
  4. Platform UI: expose a field to set the proxy address when generating agent deployment commands (currently only a WITH_PROXY toggle is likely exposed, if at all).

Backward compatibility: if PROXY_ADDRESS is not set and WITH_PROXY=true, keep the current fallback behavior (system env vars).

Use case

An enterprise customer deploys OpenAEV agents on endpoints where outbound traffic must go through a specific corporate proxy, and the deployment process (via GPO/SCCM/managed image) does not reliably set HTTP_PROXY/HTTPS_PROXY system-wide before the agent starts. Today, the only workaround is manually configuring OS-level env vars per host — this doesn't scale for fleet deployments and defeats the purpose of a single install command.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugType: something isn't working (fix:).

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions