Configuring Proxy Settings for All Apps

Page last updated:

This topic describes how to globally configure proxy settings for all apps in your Pivotal Cloud Foundry (PCF) deployment. Some environments restrict access to the Internet by requiring traffic to pass through an HTTP or HTTPS proxy. PCF operators can use the Cloud Foundry Command Line Interface (cf CLI) to provide the proxy settings to all apps, including system apps and service brokers.

Note: Incorrectly configuring proxy settings can prevent apps from connecting to the Internet or accessing required resources. They can also cause errands to fail and break system apps and service brokers. Although errands, system apps, and service brokers do not need to connect to the Internet, they often need to access other resources on PCF. Incorrect proxy settings can break these connections.

Set Environment Variables

To globally configure proxy settings for apps, you must set three environment variables for both the staging environment variable group and the running environment variable group.

For more information about variable groups, see the Environment Variable Groups section of the PAS Environment Variables topic.

This procedure explains how to set proxy information for both staging and running apps. However, you can set proxy settings for only staging or only running apps.

To globally configure proxy settings for apps:

  1. Target your Cloud Controller with the cf CLI. If you have not installed the cf CLI, see Installing the cf CLI. Run:

    cf api api.YOUR-SYSTEM-DOMAIN

    Where YOUR-SYSTEM-DOMAIN is your system domain.

  2. Log in with your UAA administrator credentials. To retrieve these credentials, navigate to the Pivotal Application Service (PAS) tile in the Ops Manager Installation Dashboard and click Credentials. Under UAA, click Link to Credential next to Admin Credentials and record the password. Run:

    cf login
  3. To configure proxy access for apps that are staging, run:

    cf set-staging-environment-variable-group '{"http\_proxy": "<span>http:</span>//YOUR-PROXY:8080/", "https\_proxy": "<span>http:</span>//YOUR-PROXY:8080/", "no\_proxy": "NO-PROXY.EXAMPLE.COM"}'</pre>


    • http_proxy: Set this value to the proxy to use for HTTP requests.
    • https_proxy: Set this value to the proxy to use for HTTPS requests. In most cases, this is the same as http_proxy.
    • no_proxy: Set this value to a comma-separated list of DNS suffixes or IP addresses that can be accessed without passing through the proxy. Pivotal recommends this value contains the domain .cf.internal, which is used by the platform to communicate with CredHub.

    From now on, the proxy settings are applied to apps during staging.

  4. To configure proxy access for apps that are running, run:

    cf set-running-environment-variable-group '{"http\_proxy": "<span>http:</span>//YOUR-PROXY:8080/", "https\_proxy": "<span>http:</span>//YOUR-PROXY:8080/", "no\_proxy": "NO-PROXY.EXAMPLE.COM"}'

    To configure proxy settings for Java-based apps, use the following command instead, replacing the placeholder values. For http.nonProxyHosts, use a pipe-separated list rather than a comma-separated list. Run:

    cf set-running-environment-variable-group '{"JAVA\_OPTS": "-Dhttp.proxyHost=YOUR-PROXY -Dhttp.proxyPort=8080 -Dhttp.nonProxyHosts=NO-PROXY.EXAMPLE.COM"}'

    For more information about these Java proxy settings, see Java Networking and Proxies in the Oracle documentation.

  5. To apply the proxy configuration for the running environment variable group, restart each app that you want to use the new configuration.


If an app fails after you apply the global proxy settings, try the following solutions.

Exclude an App From Global Proxy Settings

If your app fails, try instructing the app to ignore the global proxy settings. To manually unset the proxy environment variables for the failing app:

  1. Set the proxy environment variables for http_proxy to an empty value by running:

    cf set-env YOUR-APP http_proxy ''
  2. Set the proxy environment variables for https_proxy to an empty value by running:

    cf set-env YOUR-APP https_proxy ''
  3. Set the proxy environment variables for no_proxy to an empty value by running:

    cf set-env YOUR-APP no_proxy ''

Change Case of HTTP

Your app and language runtime may be case-sensitive. Try performing the steps in Set Environment Variables using uppercase for HTTP_PROXY, HTTPS_PROXY, and NO_PROXY instead of lowercase, as in the following example:

cf set-staging-environment-variable-group '{"HTTP\_PROXY": "<span>http:</span>//YOUR-PROXY:8080/", "HTTPS\_PROXY": "<span>http:</span>//YOUR-PROXY:8080/"}'.

Check Proxy Settings

If you have set up your proxy so that it can only send traffic to the Internet, a request to an internal resource like fails. You must set no_proxy so that traffic destined for and other internal resources is sent directly and does not go through the proxy. For instance, setting no_proxy to include your system and app domains will ensure that requests destined for those domains are sent directly.

Verify Interpretation

The interpretation of no_proxy depends on the app and the language runtime. Most support no_proxy, but the specific implementation may vary. For example, some match DNS names that end with the value set in no_proxy: would match Others support the use of the asterisk as a wildcard to provide basic pattern matching in DNS names: * would match Most apps and language runtimes do not support pattern matching and wildcards for IP addresses.