feat(network): honor HTTP_PROXY, HTTPS_PROXY and NO_PROXY for guarded requests, AWS SDK clients and OTLP export

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -255,6 +255,7 @@ Configure at least one. Every configured provider stays active and is tried in o
 | `EGRESS_ALLOWED_HOSTS` | unset | Comma-separated hostnames outbound requests may reach on a private network. Leading wildcard allowed, e.g. `host.docker.internal,*.svc.cluster.local`. Not honored for URLs harvested from content or a third-party response, nor for an HTTP block's `proxyUrl` |
 | `EGRESS_ALLOWED_IP_RANGES` | unset | Comma-separated CIDRs or IPs outbound requests may reach on a private network, e.g. `10.0.0.0/8`. Same exclusions |
 | `ALLOW_PRIVATE_DATABASE_HOSTS` | unset | **Deprecated.** Vouches for the entire private address space, for database, cache, and mail connector hosts only. Replace it with the two settings above naming specific destinations |
+| `DOMAIN_VERIFICATION_NAMESERVERS` | `1.1.1.1,8.8.8.8` | Comma-separated nameserver IPs that SSO domain verification sends its TXT lookup to. Set it when the network only allows DNS to an internal resolver. Entries that are not IP addresses are ignored |
 
 A malformed entry in either allowlist stops the app at startup with a message naming the setting. See [the SSRF boundary](/platform/self-hosting/security#the-ssrf-boundary) for the accepted syntax and for what the allowlist does and does not reach.
 

apps/docs/content/docs/platform/self-hosting/networking.mdx

@@ -265,7 +265,7 @@ Most `/api` requests also pass through Next.js Proxy. The current app configurat
 
 The app makes outbound calls to model providers, integration APIs, your email provider, object storage, and your telemetry backend. Whether `HTTP_PROXY` / `HTTPS_PROXY` apply depends on which of those paths a call takes — there is no single answer, and no global setting that covers all of them.
 
-The server runs on Bun, and Bun's native `fetch` honors `$HTTP_PROXY`, `$HTTPS_PROXY`, and `$NO_PROXY`. Sim installs no global dispatcher. Default `fetch` uses the configured proxy unless `NO_PROXY` excludes the destination. The rest either build their own HTTP agent or speak a non-HTTP protocol.
+The server runs on Bun, and Bun's native `fetch` honors `$HTTP_PROXY`, `$HTTPS_PROXY`, and `$NO_PROXY`. Sim installs no global dispatcher. Default `fetch` uses the configured proxy unless `NO_PROXY` excludes the destination. The SSRF guard reads the same three variables, with the same rules, for every request it sends. The rest either build their own HTTP agent or speak a non-HTTP protocol.
 
 This depends on the runtime. The published images run Bun. If you build the standalone output and run it under Node instead, Node ignores these variables unless started with `NODE_USE_ENV_PROXY=1` (Node 22.21+ / 24.5+), and the `fetch`-based "Yes" rows stop being proxied — model providers, Resend, Gmail sending, the desktop update feed, and the telemetry relay. The Azure Blob, GCS and Azure Communication Services rows still hold: those SDKs read the proxy variables through their own agents rather than through `fetch`. See [Bun fetch](https://bun.sh/docs/runtime/networking/fetch) and [Node proxy configuration](https://nodejs.org/learn/http/enterprise-network-configuration).
 
@@ -275,20 +275,31 @@ This depends on the runtime. The published images run Bun. If you build the stan
 | Email via Resend, Azure Communication Services, and Gmail sending | Yes |
 | The desktop update feed's calls to GitHub | Yes |
 | Object storage — Azure Blob and GCS | Yes — their SDK pipelines read the proxy variables |
-| Everything through the SSRF guard — the HTTP block, tools, connectors, outbound webhooks, content fetches, MCP servers | No |
-| Azure OpenAI, Azure Anthropic, vLLM | Only when the endpoint comes from `AZURE_OPENAI_ENDPOINT`, `AZURE_ANTHROPIC_ENDPOINT`, or `VLLM_BASE_URL`. An endpoint typed into the block is validated and pinned to its resolved IP, which bypasses the proxy |
-| Amazon Bedrock, and object storage on S3 | No — the AWS SDK uses its own request handler |
-| Email via SMTP | No — Nodemailer opens a raw TCP connection |
-| Email via Amazon SES | No — the AWS SDK transport, over HTTPS |
-| OTLP export from the server SDK | No |
+| Everything through the SSRF guard — SSO OIDC discovery, the HTTP block, tools, connectors, outbound webhooks, content fetches, MCP servers, and model endpoints typed into a block | Yes — see [Proxying guarded requests](#proxying-guarded-requests) |
+| SSO sign-in — the token, JWKS, and userinfo calls made while a user signs in | Yes — they use the default `fetch` |
+| SSO domain verification (TXT lookup) | No — DNS, sent to `1.1.1.1` and `8.8.8.8` unless `DOMAIN_VERIFICATION_NAMESERVERS` names your resolvers |
+| Amazon Bedrock, object storage on S3, and every AWS integration (DynamoDB, SQS, Lambda, Textract, and the rest) | Yes — each AWS client gets a proxy-aware agent while a proxy is set. Bedrock then uses HTTP/1.1 instead of HTTP/2 |
+| Email via SMTP, and the SMTP block | No — SMTP is not HTTP. Use a mail relay the app can reach directly, or Resend or SES |
+| Email via Amazon SES | Yes — the AWS SDK client above |
+| OTLP export from the server SDK | Yes — the exporters get the same proxy-aware agent |
 | The `/api/telemetry` relay that forwards browser events | Yes — it uses the default `fetch` |
 | Postgres and Redis | No — raw TCP |
 
-The practical consequence: a mandatory-egress-proxy environment can route most LLM traffic, Resend mail, and Azure/GCS storage through the proxy, but guarded integration calls, S3, Bedrock, SMTP, telemetry, and datastore traffic still need a transparent proxy or NAT-based egress.
+The practical consequence: a mandatory-egress-proxy environment can route LLM traffic, SSO, integration and workflow HTTP calls, Resend mail, Azure/GCS storage, AWS services, SES, and OTLP export through the proxy. SMTP and datastore traffic (Postgres, Redis, and the database blocks) still need a transparent proxy or NAT-based egress.
+
+### Proxying guarded requests
+
+A request through the SSRF guard keeps its checks when it is proxied. Before each request, and again for each redirect hop, the app resolves the destination's hostname with its own DNS and refuses it if any policy in [Security](/platform/self-hosting/security#the-ssrf-boundary) blocks the address. It then hands the hostname, not the address, to the proxy, so a proxy that allowlists by domain sees the name it expects.
+
+- **DNS must still resolve inside the container.** A destination that the app cannot resolve is refused before the proxy is asked.
+- **The proxy resolves the name again.** The app cannot pin the address across a proxy, so the proxy's own egress policy is the last check.
+- **`https` destinations are tunneled** with `CONNECT host:443`. **`http` destinations are forwarded** to the proxy as an absolute URL, as curl and Bun do.
+- **Proxy credentials** go in the URL, e.g. `http://user:pass@proxy.internal:3128`. They are sent only to the proxy. An `https://` proxy URL also works; SOCKS proxies are not supported.
+- **The HTTP block's `proxyUrl`** still takes precedence for that one request.
 
 ### Internal destinations and `NO_PROXY`
 
-Set `NO_PROXY` for every destination that is not on the public internet, not just model endpoints. The app reaches the realtime server (`SOCKET_SERVER_URL`), the Presidio PII service (`PII_URL`), and itself (`INTERNAL_API_BASE_URL`) over the same default `fetch`, alongside self-hosted Ollama, LiteLLM, and vLLM — so a proxy that cannot reach your internal network breaks live updates and PII redaction, not only inference.
+Set `NO_PROXY` for every destination that is not on the public internet, not just model endpoints. The app reaches the realtime server (`SOCKET_SERVER_URL`), the Presidio PII service (`PII_URL`), and itself (`INTERNAL_API_BASE_URL`) over the same default `fetch`, alongside self-hosted Ollama, LiteLLM, and vLLM — so a proxy that cannot reach your internal network breaks live updates and PII redaction, not only inference. AWS clients and OTLP export follow the same rule, so also add an internal S3-compatible store such as MinIO, AWS VPC endpoints, and an in-cluster OpenTelemetry collector.
 
 Set it in the application environment, not your shell — under `app.env` on Helm, or the service's `environment:` on Compose. On Helm the suffixes alone are not enough: the chart wires `SOCKET_SERVER_URL`, `PII_URL`, and `OLLAMA_URL` to bare Service names, which no domain suffix matches. Add those names too — `helm template` prints the rendered ones, and the prefix is the release name unless it already contains `sim`, in which case it is the release name alone:
 

apps/sim/instrumentation-node.ts

@@ -176,6 +176,8 @@ async function initializeOpenTelemetry() {
     const { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION, ATTR_DEPLOYMENT_ENVIRONMENT } = await import(
       '@opentelemetry/semantic-conventions/incubating'
     )
+    const { otlpExporterProxyOptions } = await import('@/lib/core/network/proxy-agent.server')
+    const exporterProxyOptions = otlpExporterProxyOptions()
     const { OTLPTraceExporter } = await import('@opentelemetry/exporter-trace-otlp-http')
     const { OTLPMetricExporter } = await import('@opentelemetry/exporter-metrics-otlp-http')
     const { PeriodicExportingMetricReader } = await import('@opentelemetry/sdk-metrics')
@@ -236,6 +238,7 @@ async function initializeOpenTelemetry() {
       headers: otlpHeaders,
       timeoutMillis: Math.min(telemetryConfig.batchSettings.exportTimeoutMillis, 10000),
       keepAlive: false,
+      ...exporterProxyOptions,
     })
 
     // Surface export failures (BatchSpanProcessor swallows them otherwise).
@@ -273,6 +276,7 @@ async function initializeOpenTelemetry() {
             headers: otlpHeaders,
             timeoutMillis: Math.min(telemetryConfig.batchSettings.exportTimeoutMillis, 10000),
             keepAlive: false,
+            ...exporterProxyOptions,
           }),
           exportIntervalMillis: 60000,
         })
@@ -289,6 +293,7 @@ async function initializeOpenTelemetry() {
             headers: otlpHeaders,
             timeoutMillis: Math.min(telemetryConfig.batchSettings.exportTimeoutMillis, 10000),
             keepAlive: false,
+            ...exporterProxyOptions,
           }),
         })
 

apps/sim/lib/auth/sso/domain-verification.ts

@@ -1,8 +1,10 @@
 import { Resolver } from 'node:dns/promises'
+import { isIP } from 'node:net'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateShortId } from '@sim/utils/id'
 import type { OrganizationDomain } from '@/lib/api/contracts/organization'
+import { env } from '@/lib/core/config/env'
 
 const logger = createLogger('SSODomainVerification')
 
@@ -54,7 +56,24 @@ const TXT_VALUE_PREFIX = 'sim-domain-verification='
 
 /** Public nameservers used for the challenge lookup, so verification does not
  * depend on (or get poisoned by) the host's local resolver/split-horizon DNS. */
-const VERIFICATION_NAMESERVERS = ['1.1.1.1', '8.8.8.8']
+const DEFAULT_VERIFICATION_NAMESERVERS = ['1.1.1.1', '8.8.8.8']
+
+/**
+ * `DOMAIN_VERIFICATION_NAMESERVERS` replaces the public resolvers for deployments whose
+ * outbound DNS only reaches an internal resolver. An entry that is not an IP address is
+ * skipped rather than failing every verification.
+ */
+function resolveVerificationNameservers(): string[] {
+  const configured = (env.DOMAIN_VERIFICATION_NAMESERVERS ?? '')
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+  const usable = configured.filter((entry) => isIP(entry) !== 0)
+  if (usable.length < configured.length) {
+    logger.error('Ignoring DOMAIN_VERIFICATION_NAMESERVERS entries that are not IP addresses')
+  }
+  return usable.length > 0 ? usable : DEFAULT_VERIFICATION_NAMESERVERS
+}
 
 /**
  * Per-attempt timeout. c-ares multiplies this across servers and retries by
@@ -74,12 +93,12 @@ const DNS_TIMEOUT_MS = 2000
 const RECORD_ABSENT_DNS_CODES = new Set(['ENODATA', 'ENOTFOUND', 'NXDOMAIN'])
 
 /**
- * Shared resolver pinned to the public nameservers. Its config is fully static
+ * Shared resolver pinned to the verification nameservers. Its config is fully static
  * and `resolveTxt` is safe to call concurrently, so a single module-scope
  * instance avoids re-allocating one per verification.
  */
 const verificationResolver = new Resolver({ timeout: DNS_TIMEOUT_MS, tries: 1 })
-verificationResolver.setServers(VERIFICATION_NAMESERVERS)
+verificationResolver.setServers(resolveVerificationNameservers())
 
 /** The fully-qualified host an org must create the TXT record on. */
 export function buildChallengeHost(domain: string): string {

apps/sim/lib/billing/aws-marketplace/client.ts

@@ -4,6 +4,7 @@ import { SQSClient } from '@aws-sdk/client-sqs'
 import { fromHttp } from '@aws-sdk/credential-providers'
 import { getAwsCredentials } from '@/lib/core/config/aws'
 import { env } from '@/lib/core/config/env'
+import { awsRequestHandler } from '@/lib/core/network/proxy-agent.server'
 
 /**
  * The Entitlement Service exists only here. Metering is multi-region, but a registration token is
@@ -38,7 +39,7 @@ function marketplaceClientConfig() {
   const fullUri = env.AWS_CONTAINER_CREDENTIALS_FULL_URI
   return {
     region: MARKETPLACE_REGION,
-    requestHandler: REQUEST_HANDLER,
+    requestHandler: awsRequestHandler(REQUEST_HANDLER),
     credentials:
       relativeUri || fullUri
         ? fromHttp({

apps/sim/lib/core/config/appconfig.ts

@@ -10,6 +10,7 @@ import { toRecordOrNull } from '@sim/utils/object'
 import { LRUCache } from 'lru-cache'
 import { getAwsCredentials } from '@/lib/core/config/aws'
 import { env } from '@/lib/core/config/env'
+import { awsRequestHandler } from '@/lib/core/network/proxy-agent.server'
 
 const logger = createLogger('AppConfig')
 
@@ -122,6 +123,7 @@ function getClient(): AppConfigDataClient {
     client = new AppConfigDataClient({
       region: env.AWS_REGION,
       credentials: getAwsCredentials(),
+      requestHandler: awsRequestHandler(),
     })
   }
   return client

apps/sim/lib/core/config/env.ts

@@ -134,6 +134,7 @@ export const env = createEnv({
     ALLOW_PRIVATE_DATABASE_HOSTS:          z.boolean().optional(),                 // Deprecated alias for the egress allowlist, kept so existing self-hosted deployments keep working. Equivalent to allowing every private, reserved, and loopback destination. Prefer EGRESS_ALLOWED_HOSTS / EGRESS_ALLOWED_IP_RANGES, which name specific destinations.
     EGRESS_ALLOWED_HOSTS:                  z.string().optional(),                  // Comma-separated hostnames outbound requests may reach on a private network, leading wildcard allowed (e.g. "host.docker.internal,*.svc.cluster.local"). Self-hosted only; ignored on the hosted platform. Replaces ALLOW_PRIVATE_DATABASE_HOSTS.
     EGRESS_ALLOWED_IP_RANGES:              z.string().optional(),                  // Comma-separated CIDRs or IPs outbound requests may reach on a private network (e.g. "10.0.0.0/8,192.168.65.254/32"). Self-hosted only; never lifts the cloud-metadata block.
+    DOMAIN_VERIFICATION_NAMESERVERS:       z.string().optional(),                  // Comma-separated nameserver IPs for the domain-verification TXT lookup (e.g. "10.0.0.2"). Defaults to 1.1.1.1 and 8.8.8.8; set it where outbound DNS is restricted to an internal resolver.
     ALLOWED_LOGIN_EMAILS:                  z.string().optional(),                  // Comma-separated list of allowed email addresses for login
     ALLOWED_LOGIN_DOMAINS:                 z.string().optional(),                  // Comma-separated list of allowed email domains for login
     BLOCKED_SIGNUP_DOMAINS:                z.string().optional(),                  // Comma-separated list of email domains blocked from signing up (e.g., "gmail.com,yahoo.com")