Configuring proxy settings for all apps

Some environments restrict access to the Internet by requiring traffic to pass through an HTTP or HTTPS proxy. Operations Manager operators can use the Cloud Foundry Command Line Interface (cf CLI) to provide the proxy settings to all apps, including system apps and service brokers.

Incorrectly configuring proxy settings can prevent apps from connecting to the internet or accessing required resources. It can also cause errands to fail and break system apps, and service brokers. Although errands, system apps, and service brokers do not need to connect to the internet, they often need to access other resources in Operations Manager. Incorrect proxy settings can break these connections.

Set environment variables

To globally configure proxy settings for Operations Manager apps, you must set three environment variables for both the staging environment variable group and the running environment variable group.

For more information about variable groups, see Environment Variable Groups in TAS for VMs Environment Variables.

The following procedure explains how to set proxy information for both staging and running apps. However, you can also set proxy settings for only staging or only running apps.

To globally configure proxy settings for Operations Manager apps:

Target your Cloud Controller with the cf CLI. If you have not installed the cf CLI, see Installing the cf CLI. Run:
```
cf api api.SYSTEM-DOMAIN
```
Where SYSTEM-DOMAIN is your system domain.
Log in with your UAA administrator credentials.
To retrieve these credentials:
1. Go to the Tanzu Operations Manager Installation Dashboard.
2. Click the VMware Tanzu Application Service for VMs (TAS for VMs) tile.
3. Select the Credentials tab.
4. Under UAA, next to Admin Credentials, click Link to Credential.
5. Record the password.
Run:
```
cf login
```
To configure proxy access for apps that are staging, run:
```
cf set-staging-environment-variable-group '{"http_proxy": "http://PROXY:8080/", "https_proxy": "http://PROXY:8080/", "no_proxy": "DNS-SUFFIX-OR-IP-ADDRESS,DNS-SUFFIX-OR-IP-ADDRESS"}'
```
Where:
- http_proxy is the proxy to use for HTTP requests.
- https_proxy is the proxy to use for HTTPS requests. In most cases, this is the same as http_proxy.
- PROXY is your proxy.
- no_proxy is a comma separated list of DNS suffixes or IP addresses that can be accessed without passing through the proxy. VMware recommends this value contains the domain .cf.internal, which is used by the platform to communicate with CredHub.
- DNS-SUFFIX-OR-IP-ADDRESS is a DNS suffix or IP address that can be accessed without passing through the proxy.
From now on, the proxy settings are applied to apps during staging.
To configure proxy access for apps that are running:
- Non Java-based apps:
```
cf set-running-environment-variable-group '{"http_proxy": "http://PROXY:8080/", "https_proxy": "http://PROXY:8080/", "no_proxy": "DNS-SUFFIX-OR-IP-ADDRESS,DNS-SUFFIX-OR-IP-ADDRESS"}'
```
  Where:
  - http_proxy is the proxy to use for HTTP requests.
  - https_proxy is the proxy to use for HTTPS requests. In most cases, this is the same as http_proxy.
  - PROXY is your proxy.
  - no_proxy is a comma separated list of DNS suffixes or IP addresses that can be accessed without passing through the proxy. VMware recommends this value contains the domain .cf.internal, which is used by the platform to communicate with CredHub.
  - DNS-SUFFIX-OR-IP-ADDRESS is a DNS suffix or IP address that can be accessed without passing through the proxy.
- Java-based apps:
```
cf set-running-environment-variable-group '{"JAVA_OPTS": "-Dhttp.proxyHost=PROXY -Dhttp.proxyPort=8080 -Dhttp.nonProxyHosts=DNS-SUFFIX-OR-IP-ADDRESS|DNS-SUFFIX-OR-IP-ADDRESS"}'
```
  Where:
  - -Dhttp.proxyHost is the proxy to use for HTTP requests.
  - PROXY is your proxy.
  - -Dhttp.proxyPort is the port your proxy uses.
  - -Dhttp.nonProxyHosts is a pipe-separated list of DNS suffixes or IP addresses that can be accessed without passing through the proxy. VMware recommends this value contains the domain .cf.internal, which is used by the platform to communicate with CredHub.
  - DNS-SUFFIX-OR-IP-ADDRESS is a DNS suffix or IP address that can be accessed without passing through the proxy.
  Note System environment variables can only be strings. This is enforced on the API. For more information about these Java proxy settings, see [Java Networking and Proxies](http://docs.oracle.com/javase/8/docs/technotes/guides/net/proxies.html).
To apply the proxy configuration for the running environment variable group, start each app again for the new configuration.

Troubleshooting

This section describes solutions to try if an app fails after you apply the global proxy settings.

Exclude an app from global proxy settings

If your app fails, try instructing the app to ignore the global proxy settings.

To manually unset the proxy environment variables for the failing app:

Set the proxy environment variables for http_proxy to an empty value by running:
```
cf set-env APP-NAME http_proxy ''
```
Where APP-NAME is the name of your app.
Set the proxy environment variables for https_proxy to an empty value by running:
```
cf set-env APP-NAME https_proxy ''
```
Where APP-NAME is the name of your app.
Set the proxy environment variables for no_proxy to an empty value by running:
```
cf set-env APP-NAME no_proxy ''
```
Where APP-NAME is the name of your app.

Change case of HTTP environment variables

Your app and language runtime might be case-sensitive. Try using the steps in Set environment variables using uppercase for HTTP_PROXY, HTTPS_PROXY, and NO_PROXY instead of lowercase, as in the following example:

cf set-staging-environment-variable-group '{"HTTP_PROXY": "http://PROXY:8080/", "HTTPS_PROXY": "http://PROXY:8080/", "NO_PROXY": "DNS-SUFFIX-OR-IP-ADDRESS,DNS-SUFFIX-OR-IP-ADDRESS"}'.

Where:

PROXY is your proxy.
DNS-SUFFIX-OR-IP-ADDRESS is a DNS suffix or IP address that can be accessed without passing through the proxy.

Check proxy settings

If you have set up your proxy so that it can only send traffic to the Internet, a request to an internal resource like Operations Manager fails. You must set no_proxy so that traffic destined for Operations Manager and other internal resources is sent directly and does not go through the proxy. For example, setting no_proxy to include your system and app domains will ensure that requests destined for those domains are sent directly.

Verify interpretation

The interpretation of no_proxy depends on the app and the language runtime. Most support no_proxy, but the specific implementation can vary. For example, some match DNS names that end with the value set in no_proxy: example.com can match test.example.com. Others support the use of the asterisk as a wildcard to provide basic pattern matching in DNS names: *.example.com can match test.example.com. Most apps and language run times do not support pattern matching and wildcards for IP addresses.