HTTP Proxy Configuration

Before You Begin

You will need:

• A running Tymeslot instance deployed inside a corporate network
• The hostname, port, and (if required) credentials for your corporate proxy
• Access to your Tymeslot instance's environment variables

By the end of this guide, all outbound HTTP and HTTPS traffic from Tymeslot will route through your corporate proxy.

When You Need This

This guide applies only to corporate or restricted-network environments where direct internet access from servers is blocked by policy. Most self-hosted deployments on a home server, VPS, or cloud VM do not need a proxy — skip this guide if your server can reach the internet directly.

Tymeslot makes outbound connections to the following external services. If any of them are unreachable, the corresponding feature fails silently or with a connection error:

1 Configure the Proxy

Set proxy configuration via environment variables. Both uppercase and lowercase forms are recognised — use uppercase for maximum compatibility across tools and shells:

# HTTPS proxy — handles all external API calls (OAuth, Calendar, email)
HTTPS_PROXY=http://proxy.corp.example.com:3128

# HTTP proxy — for any plain HTTP traffic (uncommon but required by some networks)
HTTP_PROXY=http://proxy.corp.example.com:3128

# Bypass list — hosts that must NOT go through the proxy
NO_PROXY=localhost,127.0.0.1,::1

After setting these variables, restart Tymeslot. The proxy is picked up at startup — a running instance will not detect the change without a restart.

2 Authenticated Proxy

If your proxy requires credentials, embed them directly in the proxy URL using standard URL syntax:

HTTPS_PROXY=http://username:password@proxy.corp.example.com:3128

URL-encode any special characters in the password. For example, a password containing @ must be written as %40.

3 Configure the Bypass List

NO_PROXY is a comma-separated list of hosts that bypass the proxy entirely. Three pattern formats are supported:

A complete example combining all three pattern types:

NO_PROXY=localhost,127.0.0.1,::1,10.0.0.0/8,192.168.0.0/16,*.internal.example.com

TLS-Inspecting Proxies (MITM Proxies)

Some corporate proxies perform TLS inspection — they terminate the HTTPS connection, inspect the traffic, then re-establish a new TLS connection to the destination using their own CA certificate. If your proxy does this, Tymeslot will reject all HTTPS connections because the proxy's certificate is not trusted by the system.

The symptom is SSL certificate verification errors in Tymeslot logs even though the proxy URL is correct. To fix this, mount your corporate CA certificate bundle into the container and set the trust path:

# docker-compose.yml snippet
services:
  tymeslot:
    volumes:
      - /path/to/corporate-ca.crt:/etc/ssl/certs/corporate-ca.crt:ro
    environment:
      - SSL_CERT_FILE=/etc/ssl/certs/corporate-ca.crt

Your network or security team can provide the CA certificate bundle. It is typically a .crt or .pem file.

Testing Proxy Connectivity

Before restarting Tymeslot with the new proxy settings, verify that the proxy accepts connections from inside your container. Run this command to send a request through the proxy and inspect the result:

docker-compose exec tymeslot sh -c \
  "HTTPS_PROXY=http://proxy.corp.example.com:3128 curl -sv https://www.google.com 2>&1 | head -30"

Expected result: the output includes CONNECT www.google.com:443 followed by HTTP/1.1 200 Connection established and eventually a 301 Moved Permanently from Google. That confirms the proxy tunnel is open and HTTPS traffic flows through it correctly.

After confirming proxy connectivity, verify end-to-end with a real Tymeslot flow: restart the application with the proxy variables set, then attempt a Google OAuth login. A successful redirect to the Google login page confirms that Tymeslot can reach Google's OAuth endpoints through the proxy.

Troubleshooting

❓ Frequently Asked Questions

Verification Checklist

• HTTPS_PROXY is set to your corporate proxy URL
• NO_PROXY includes localhost, 127.0.0.1, and ::1
• curl test from inside the container returns 200 Connection established followed by a 301 from Google
• If using a TLS-inspecting proxy: corporate CA certificate mounted and trusted inside the container
• Tymeslot restarted after environment variable changes
• Google OAuth login attempt redirects to the Google login page (confirming OAuth endpoints are reachable)