[PATCH proxmox{,-backup} 0/4] fix #3723: allow using node http proxy for remote connections

[PATCH proxmox{,-backup} 0/4] fix #3723: allow using node http proxy for remote connections

[Christian Ebner]

These patches allow setting a boolean flag on a remote's
configuration to control whether or not to use the http proxy
settings of the Proxmox Backup Server node for the connection.

The default remains to not use the node's proxy, guaranteeing full
backwards compatibility. If no http proxy is configured, the flag has
no effect and no proxy will be used.

Currently it is only possible to set a custom per-remote proxy
setting, which can however be easily added on-demand.

Note:
Testing was performed using https://www.mitmproxy.org/
Fingerprint on the PBS remote must then match the one provided by
the proxy, the proxy must be started with `--ssl-insecure` if
self-signed certificates are use on the remote.

Link to the issue in the bugtracker:
https://bugzilla.proxmox.com/show_bug.cgi?id=3723


proxmox:

Christian Ebner (1):
  pbs-api-types: remote: add flag to use node proxy for remote connect

 pbs-api-types/src/remote.rs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)


proxmox-backup:

Christian Ebner (3):
  http client: use http proxy from client options if set
  fix #3723: api: remote: optionally use node proxy config for http
    client
  ui: expose flag to use node's http proxy in remote edit window

 pbs-client/src/http_client.rs |  9 +++++++++
 src/api2/config/remote.rs     | 13 +++++++++++++
 src/config/node.rs            |  5 +++++
 www/window/RemoteEdit.js      | 19 +++++++++++++++++++
 4 files changed, 46 insertions(+)


Summary over all repositories:
  5 files changed, 60 insertions(+), 0 deletions(-)

-- 
Generated by murpp 0.9.0

[PATCH proxmox 1/1] pbs-api-types: remote: add flag to use node proxy for remote connect

[Christian Ebner]

Introduces the `use-node-proxy` flag in the remote config and the
corresponding boolean API schema. Setting this flag will allow users
to enable using the node's http proxy config for remote connections.

Defaults to false for backwards compatibility.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 pbs-api-types/src/remote.rs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pbs-api-types/src/remote.rs b/pbs-api-types/src/remote.rs
index 29d41e87..6a21345a 100644
--- a/pbs-api-types/src/remote.rs
+++ b/pbs-api-types/src/remote.rs
@@ -1,5 +1,7 @@
 use serde::{Deserialize, Serialize};
 
+use proxmox_schema::BooleanSchema;
+
 use super::*;
 
 pub const REMOTE_PASSWORD_SCHEMA: Schema =
@@ -22,6 +24,12 @@ pub const REMOTE_ID_SCHEMA: Schema = StringSchema::new("Remote ID.")
     .max_length(32)
     .schema();
 
+pub const USE_NODE_HTTP_PROXY_SCHEMA: Schema = BooleanSchema::new(
+    "Use the http proxy configuration of the node for remote connections.",
+)
+.default(false)
+.schema();
+
 #[api(
     properties: {
         comment: {
@@ -43,6 +51,10 @@ pub const REMOTE_ID_SCHEMA: Schema = StringSchema::new("Remote ID.")
             optional: true,
             schema: CERT_FINGERPRINT_SHA256_SCHEMA,
         },
+        "use-node-proxy": {
+            optional: true,
+            schema: USE_NODE_HTTP_PROXY_SCHEMA,
+        },
     },
 )]
 #[derive(Serialize, Deserialize, Updater, Clone, PartialEq)]
@@ -57,6 +69,8 @@ pub struct RemoteConfig {
     pub auth_id: Authid,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub fingerprint: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub use_node_proxy: Option<bool>,
 }
 
 #[api(
-- 
2.47.3

[PATCH proxmox-backup 1/3] http client: use http proxy from client options if set

[Christian Ebner]

The client already supports reading the proxy config from the env
variables, now it is also possible to specify it as optional
parameter via the http client options.

For backwards compatibility always use the env variable proxy setting
over the http client option.

To be used for setting the http proxy on remotes for sync jobs.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 pbs-client/src/http_client.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pbs-client/src/http_client.rs b/pbs-client/src/http_client.rs
index 4730db8d1..43f9a3367 100644
--- a/pbs-client/src/http_client.rs
+++ b/pbs-client/src/http_client.rs
@@ -134,6 +134,7 @@ pub struct HttpClientOptions {
     fingerprint_cache: bool,
     verify_cert: bool,
     limit: RateLimitConfig,
+    proxy: Option<ProxyConfig>,
 }
 
 impl HttpClientOptions {
@@ -196,6 +197,11 @@ impl HttpClientOptions {
         self.limit = rate_limit;
         self
     }
+
+    pub fn proxy(mut self, proxy: Option<ProxyConfig>) -> Self {
+        self.proxy = proxy;
+        self
+    }
 }
 
 impl Default for HttpClientOptions {
@@ -209,6 +215,7 @@ impl Default for HttpClientOptions {
             fingerprint_cache: false,
             verify_cert: true,
             limit: RateLimitConfig::default(), // unlimited
+            proxy: None,
         }
     }
 }
@@ -479,6 +486,8 @@ impl HttpClient {
         }
 
         let proxy_config = ProxyConfig::from_proxy_env()?;
+        let proxy_config = proxy_config.or(options.proxy.clone());
+
         if let Some(config) = proxy_config {
             info!("Using proxy connection: {}:{}", config.host, config.port);
             https.set_proxy(config);
-- 
2.47.3

[PATCH proxmox-backup 2/3] fix #3723: api: remote: optionally use node proxy config for http client

[Christian Ebner]

Allow to use the node's http proxy config if the new `use-node-proxy`
flag is set in the remote config. If ever required, it is still
possible to extend this to allow for custom proxy settings on the
remote.

Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=3723
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/api2/config/remote.rs | 13 +++++++++++++
 src/config/node.rs        |  5 +++++
 2 files changed, 18 insertions(+)

diff --git a/src/api2/config/remote.rs b/src/api2/config/remote.rs
index 0a0996e25..1996ee91b 100644
--- a/src/api2/config/remote.rs
+++ b/src/api2/config/remote.rs
@@ -142,6 +142,8 @@ pub enum DeletableProperty {
     Fingerprint,
     /// Delete the port property.
     Port,
+    /// Delete the use_node_proxy property.
+    UseNodeProxy,
 }
 
 #[api(
@@ -209,6 +211,9 @@ pub fn update_remote(
                 DeletableProperty::Port => {
                     data.config.port = None;
                 }
+                DeletableProperty::UseNodeProxy => {
+                    data.config.use_node_proxy = None;
+                }
             }
         }
     }
@@ -238,6 +243,10 @@ pub fn update_remote(
         data.config.fingerprint = update.fingerprint;
     }
 
+    if update.use_node_proxy.is_some() {
+        data.config.use_node_proxy = update.use_node_proxy;
+    }
+
     config.set_data(&name, "remote", &data)?;
 
     pbs_config::remote::save_config(&config)?;
@@ -310,6 +319,10 @@ pub fn remote_client_config(
     if let Some(limit) = limit {
         options = options.rate_limit(limit);
     }
+    if remote.config.use_node_proxy.unwrap_or(false) {
+        let proxy = crate::config::node::node_http_proxy_config()?;
+        options = options.proxy(proxy);
+    }
 
     let client = HttpClient::new(
         &remote.config.host,
diff --git a/src/config/node.rs b/src/config/node.rs
index 81eecb247..a79bf5707 100644
--- a/src/config/node.rs
+++ b/src/config/node.rs
@@ -309,3 +309,8 @@ impl Iterator for AcmeDomainIter<'_> {
         ))
     }
 }
+
+pub(crate) fn node_http_proxy_config() -> Result<Option<ProxyConfig>, Error> {
+    let (node_config, _digest) = self::config()?;
+    Ok(node_config.http_proxy())
+}
-- 
2.47.3

[PATCH proxmox-backup 3/3] ui: expose flag to use node's http proxy in remote edit window

[Christian Ebner]

Allows to set/clear the flag to enable using the node http proxy
config for given remote config. Place in the advanced settings to not
intrude in current remote edit window layout to much.

Defaults to not being set, clear from config if unset to avoid config
bloating.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 www/window/RemoteEdit.js | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/www/window/RemoteEdit.js b/www/window/RemoteEdit.js
index 9e8353ff8..e9ce709f0 100644
--- a/www/window/RemoteEdit.js
+++ b/www/window/RemoteEdit.js
@@ -128,6 +128,21 @@ Ext.define('PBS.window.RemoteEdit', {
                 fieldLabel: gettext('Comment'),
             },
         ],
+        advancedColumn1: [
+            {
+                xtype: 'proxmoxcheckbox',
+                fieldLabel: gettext("Use node proxy"),
+                name: 'use-node-proxy',
+                autoEl: {
+                    tag: 'div',
+                    'data-qtip': gettext(
+                        "Use the node's http proxy configuration for remote connections.",
+                    ),
+                },
+                uncheckedValue: false,
+                value: false,
+            },
+        ],
     },
 
     setValues: function (values) {
@@ -153,6 +168,10 @@ Ext.define('PBS.window.RemoteEdit', {
             delete values.password;
         }
 
+        if (!me.isCreate) {
+            PBS.Utils.delete_if_default(values, 'use-node-proxy', false);
+        }
+
         return values;
     },
 });
-- 
2.47.3

applied-series: [PATCH proxmox{,-backup} 0/4] fix #3723: allow using node http proxy for remote connections

[Fabian Grünbichler]

with a small follow-up switching the precende in pbs-client around -
since passing in an explicitly configured proxy is opt-in, it makes
sense for that to take precedence over an env variable.

On February 11, 2026 5:18 pm, Christian Ebner wrote:
> These patches allow setting a boolean flag on a remote's
> configuration to control whether or not to use the http proxy
> settings of the Proxmox Backup Server node for the connection.
> 
> The default remains to not use the node's proxy, guaranteeing full
> backwards compatibility. If no http proxy is configured, the flag has
> no effect and no proxy will be used.
> 
> Currently it is only possible to set a custom per-remote proxy
> setting, which can however be easily added on-demand.
> 
> Note:
> Testing was performed using https://www.mitmproxy.org/
> Fingerprint on the PBS remote must then match the one provided by
> the proxy, the proxy must be started with `--ssl-insecure` if
> self-signed certificates are use on the remote.
> 
> Link to the issue in the bugtracker:
> https://bugzilla.proxmox.com/show_bug.cgi?id=3723
> 
> 
> proxmox:
> 
> Christian Ebner (1):
>   pbs-api-types: remote: add flag to use node proxy for remote connect
> 
>  pbs-api-types/src/remote.rs | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> 
> proxmox-backup:
> 
> Christian Ebner (3):
>   http client: use http proxy from client options if set
>   fix #3723: api: remote: optionally use node proxy config for http
>     client
>   ui: expose flag to use node's http proxy in remote edit window
> 
>  pbs-client/src/http_client.rs |  9 +++++++++
>  src/api2/config/remote.rs     | 13 +++++++++++++
>  src/config/node.rs            |  5 +++++
>  www/window/RemoteEdit.js      | 19 +++++++++++++++++++
>  4 files changed, 46 insertions(+)
> 
> 
> Summary over all repositories:
>   5 files changed, 60 insertions(+), 0 deletions(-)
> 
> -- 
> Generated by murpp 0.9.0
> 
> 
> 
> 
>