🌐 Proxy Modes

The proxy_mode setting controls how Tresor connects to downstream LLM providers. This is useful when your network requires traffic to go through a corporate or system proxy.

🎛️ Modes

Mode	Behavior
none	📡 Direct connection — no proxy used for outbound requests
env	🖥️ Uses HTTPS_PROXY / HTTP_PROXY environment variables
windows	🪟 Reads system proxy from Windows registry (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings), falls back to environment variables
auto (default)	🔍 Tries system proxy first (registry on Windows), then environment variables, then direct connection

⚙️ Configuration

# Use automatic proxy detection (default)
proxy_mode: "auto"

# Use environment variables only
proxy_mode: "env"

# No proxy
proxy_mode: "none"

🌍 Environment Variables

For env and auto modes, Tresor reads these standard variables:

• HTTPS_PROXY — 🔒 used for HTTPS connections (most LLM providers)
• HTTP_PROXY — used for HTTP connections

Example:

export HTTPS_PROXY=http://corporate-proxy.example.com:8080
./tresor run

🪟 Windows System Proxy

For windows and auto modes on Windows, Tresor reads the system proxy settings from the registry. This automatically picks up proxy configuration set by your operating system or corporate policy.

🔐 Proxy Authentication

To require authentication on incoming proxy requests (from client applications), use the proxy_api_keys setting:

proxy_api_keys:
  - sk-proxy-123

Clients must then include a matching Bearer token: 🔑

Authorization: Bearer sk-proxy-123

This is separate from admin_password, which protects the admin API and web UI.