feat: honor HTTP proxies across install and runtime (#3239) - #3242

Closes #3239.

Installing and running Anthias on a host whose only internet path is an HTTP proxy previously meant patching every network layer by hand, because none of them share environment or config: the Ansible play, apt, the Docker daemon, the anthias-host-agent unit, and the app containers each have an isolated environment. Each was verified against the code before this change (the reporter's nine points all held up).

Design — one input, one source of truth, four layers

The proxy is captured once (a new install.sh prompt, prefilled from any HTTP_PROXY/HTTPS_PROXY already in the environment) and propagated from a single on-disk file, /etc/anthias/proxy.env, written by the Ansible system role:

• install-time tooling — play-level environment: so get_url/apt traverse the proxy; install.sh also exports it for its own curl/git/uv and writes an apt proxy conf (its apt runs via bare sudo, so it never sees the shell env).
• Docker daemon — a docker.service.d/http-proxy.conf systemd drop-in (EnvironmentFile) so ghcr.io pulls work.
• host systemd — the one rendered unit (anthias-host-agent) gets an EnvironmentFile; its requests calls then honor it via trust_env.
• containers — HTTP_PROXY/HTTPS_PROXY/NO_PROXY rendered into the server/viewer/celery services via envsubst (upgrade_containers.sh sources proxy.env). All app HTTP clients use requests so they honor it for free; yt-dlp and QtWebEngine inherit the container env.

NO_PROXY is computed, not hand-typed. It always includes the Compose service names (anthias-server, redis) plus loopback, so container-to-container traffic is never force-proxied — the failure that blanked the screen in the report (requests matches NO_PROXY on the URL hostname, so the service names are what matter). Everything is idempotent both ways: with no proxy configured the managed files are removed and rendered values are empty (treated as "no proxy").

Also fixed (robustness points from the report)

• get_url for the Docker apt key gets a stat+when guard (network-free when the key is already present).
• boot.yml (writes /boot/firmware/config.txt) gets a device_type when: guard so a direct ansible-playbook run can't hit it on non-Pi hardware.
• install.sh warns before git reset --hard discards local tracked edits.
• anthias_user is passed explicitly and falls back to ansible_user_id, not just env USER (which resolves to root under sudo, breaking host-agent paths).

Balena images use a different (supervisor/NetworkManager) proxy mechanism and are out of scope here.

Testing — validated end-to-end against a real logging proxy

Stood up a logging forward proxy and introspected exactly what routed through it vs bypassed it. Hosts seen through the proxy:

  CONNECT cli.github.com          (apt)
  CONNECT download.docker.com     (apt — the exact host that failed in the report)
  CONNECT github.com              (git ls-remote — install.sh clone path)
  CONNECT www.youtube.com         (curl HTTPS)
  CONNECT example.com             (requests + container)
  GET http://archive.ubuntu.com   (apt, x9)
  GET http://security.ubuntu.com  (apt, x3)

Internal service names (anthias-server, redis) in the proxy log: 0 — proven bypass by absence.

Per layer:

• apt through the exact generated apt.conf → all repos incl. download.docker.com routed via proxy.
• app clients (requests, trust_env) → https://example.com via proxy (200); http://anthias-server:8080 and http://redis:6379 bypassed (no proxy log entry).
• git / curl HTTP+HTTPS → routed via proxy and succeeded.
• real container with the compose-rendered env → example.com via proxy (200); anthias-server bypassed (resolved directly, no proxy entry).
• persistence → sourcing an Ansible-written proxy.env (set -a) + envsubst renders the proxy into all three services.

Static checks all green: bash -n, ansible-lint (production profile), ansible-playbook --syntax-check, and the computed NO_PROXY/environment templating evaluated across proxy / no-proxy / https-only scenarios.

The Docker-daemon drop-in is the standard systemd EnvironmentFile mechanism; the apt run already proves download.docker.com reaches through the proxy, which is the same env the daemon reads for pulls. A full behind-proxy install on the x86 hardware testbed is a sensible pre-merge acceptance check and can follow.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HJ3ucEkn62cbgPoisAZ5LQ