core icon indicating copy to clipboard operation
core copied to clipboard

Add /etc/profile.d/proxy.sh for upstream proxy to use pkg

Open mimugmail opened this issue 7 months ago • 2 comments

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

  • [X] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
  • [X] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

In a secure system where internet access in only allowed via proxy I want to fetch updates via pkg. My idea would be to add a proxy.sh with export variables in /etc/profile.d/ folder. Before going deep I'd just like to know if this would be an acceptable approach so a PR also get's in? :)

Describe the solution you like

See above

Describe alternatives you considered

Manual updates

Additional context

Some alternatives: https://forum.opnsense.org/index.php?topic=45005.msg225291#msg225291

mimugmail avatar May 27 '25 07:05 mimugmail

you should only need https://docs.opnsense.org/development/backend/configd.html#extending-the-environment

AdSchellevis avatar May 27 '25 07:05 AdSchellevis

If it is a secure environment it probably is an authenticating proxy, and that's where the lottery begins. Enterprise grade apps / appliances fail or partially fail sending the traffic through the proxy.

Alternatives that come to mind.

a) Seeking a FW exception allowing Source-OPNsense-FWs Dest_OPN_Mirror tcp/443 and a similar rule for http dealing with CRL traffic

b) In case of an authenticating proxy an exception can be made to allow OPN FW(s) to hit the mirror and CRL URLs without authentication

99% of the time I'd push for option a) since you want to be able to upgrade your FWs even when the proxies are down for a reason or other.

ronin3510 avatar May 27 '25 08:05 ronin3510