fix: simplify api-proxy iptables bypass condition#819
Merged
lpcox merged 2 commits intoclaude/fix-github-actions-workflow-againfrom Feb 13, 2026
Merged
Conversation
The NAT bypass for api-proxy traffic was checking both AWF_ENABLE_API_PROXY and AWF_API_PROXY_IP, but this was too strict. When the HTTP_PROXY environment variable is set, HTTP clients will send requests through the proxy unless NO_PROXY is configured or iptables rules prevent it. The issue was that the NAT bypass required both flags, causing traffic to 172.30.0.30 (api-proxy) to be sent through Squid when it should go directly. Squid then blocked these requests because the IP address wasn't in the domain whitelist. The fix simplifies the condition to only check AWF_API_PROXY_IP, matching the pattern used for the OUTPUT FILTER ACCEPT rules (lines 285-289). This ensures that when AWF_API_PROXY_IP is set, traffic to that IP bypasses Squid at the NAT level, preventing HTTP clients from routing through the proxy regardless of HTTP_PROXY settings. Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Claude
AI
changed the title
lpcox
merged commit 64055bb
into
claude/fix-github-actions-workflow-again
2 checks passed
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes a critical bug where the agent container could not communicate with the api-proxy sidecar due to an overly strict iptables NAT bypass condition. The root cause was that the NAT bypass required both AWF_ENABLE_API_PROXY AND AWF_API_PROXY_IP to be set, but when HTTP_PROXY environment variable is set, HTTP clients route traffic through Squid at the application level. The iptables NAT bypass should have prevented this at the network level, but the dual-flag check caused the bypass to be skipped.
Changes:
- Simplified the NAT bypass condition in
setup-iptables.shto check onlyAWF_API_PROXY_IP(matching the OUTPUT FILTER ACCEPT rules pattern) - Removed the
AWF_ENABLE_API_PROXYcheck and associated warning message - Updated comment to reflect the simplified condition
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
lpcox
added a commit
that referenced
this pull request
Feb 13, 2026
…ng (#802) * Initial plan * fix(ci): add BASE_URL environment variables for CODEX api-proxy routing CODEX was not being directed to use the api-proxy because the OPENAI_BASE_URL and ANTHROPIC_BASE_URL environment variables were not explicitly set in the smoke-codex workflow. While AWF automatically sets these variables when generating the docker-compose configuration (if API keys are present), explicitly setting them in the workflow env ensures they are available to the CODEX agent for routing API calls through the api-proxy sidecar. This fix adds: - OPENAI_BASE_URL=http://api-proxy:10000 - ANTHROPIC_BASE_URL=http://api-proxy:10001 to the 'Run Codex' step environment variables. Fixes job failure in run 63483600453. * fix(ci): remove API keys from agent env when api-proxy is enabled (#803) * Initial plan * fix(ci): remove API keys from agent env when api-proxy is enabled When api-proxy is enabled (indicated by BASE_URL environment variables), API keys should NOT be exposed to the agent container for security. The api-proxy sidecar holds the credentials and injects auth headers. Previously, the workflow was passing both: - CODEX_API_KEY and OPENAI_API_KEY (should NOT be in agent env) - OPENAI_BASE_URL and ANTHROPIC_BASE_URL (should be in agent env) This defeated the security isolation provided by api-proxy. Changes: - Removed CODEX_API_KEY and OPENAI_API_KEY from agent environment block - Kept OPENAI_BASE_URL and ANTHROPIC_BASE_URL for routing to api-proxy - The awf CLI still receives keys via `sudo -E` and `--env-all` - awf passes keys only to api-proxy container, not agent container Security model: - awf reads keys from host environment (process.env) - awf passes keys only to api-proxy sidecar (src/docker-manager.ts:908-909) - Agent only receives BASE_URL variables (src/docker-manager.ts:948-955) - api-proxy injects auth headers and routes through Squid 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix(firewall): add api-proxy to allowed domains when enabled (#804) * Initial plan * fix(firewall): add api-proxy to allowed domains when enabled Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix(squid): handle bare hostnames without leading dot for api-proxy (#805) * Initial plan * fix(squid): handle bare hostnames without leading dot for api-proxy Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix(agent): enable direct api-proxy access and remove api key from env (#807) * Initial plan * fix(agent): enable direct api-proxy access and remove api key from env - Add iptables bypass for api-proxy in setup-iptables.sh - Pass AWF_ENABLE_API_PROXY env var from docker-manager.ts - Remove ANTHROPIC_API_KEY from agent env in workflows - Update postprocess script to strip API key from compiled workflows Fixes agent->api-proxy connectivity and security vulnerability where API key was exposed to agent container instead of isolated to api-proxy. --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> * fix: pass ANTHROPIC_API_KEY to validation in all Claude workflows (#808) * Initial plan * fix: pass ANTHROPIC_API_KEY to validation step in smoke-claude workflow Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix: pass ANTHROPIC_API_KEY to validation in all Claude workflows Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix: only enable api-proxy when API keys are provided (#810) * Initial plan * fix: only enable api-proxy when API keys are provided Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * feat(workflow): enable api-proxy for smoke-claude workflow - Add --enable-api-proxy flag to awf command - Add --anthropic-api-key flag to pass API key to api-proxy sidecar - Add ANTHROPIC_API_KEY to env block for agent step - API key is shared with api-proxy, kept out of agent container - Agent uses ANTHROPIC_BASE_URL to direct requests to api-proxy Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * refactor(workflow): remove redundant --enable-api-proxy flag The --enable-api-proxy flag defaults to true (src/cli.ts:724), so it doesn't need to be explicitly specified. The api-proxy sidecar will automatically deploy when API keys are present. See docs/api-proxy-sidecar.md:51 which states "The API proxy is enabled by default and automatically deploys when API keys are present" Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix: remove unknown --anthropic-api-key flag from smoke-claude workflow (#811) * Initial plan * fix: remove unknown --anthropic-api-key flag from smoke-claude workflow Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix: use api-proxy IP address instead of hostname for BASE_URL (#813) * Initial plan * fix: use api-proxy IP address instead of hostname for BASE_URL Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix: use api-proxy IP address instead of hostname for BASE_URL (#813) (#815) * Initial plan * fix: use api-proxy IP address instead of hostname for BASE_URL (#813) Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix(api-proxy): use IP address for API base URLs to avoid DNS issues In chroot mode, Docker container hostname resolution can fail because the DNS resolver may not properly reach Docker's embedded DNS. Use the api-proxy IP address directly (e.g., http://172.30.0.30:10001) instead of the hostname (http://api-proxy:10001) to eliminate DNS resolution as a failure point. Also add test coverage for the host-iptables api-proxy ACCEPT rule. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: exclude API keys from agent when api-proxy is enabled (#814) * Initial plan * fix: exclude API keys from agent when api-proxy is enabled --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> * fix(agent): use AWF_API_PROXY_IP env var for api-proxy iptables rules (#817) * Initial plan * fix(agent): use AWF_API_PROXY_IP env var for api-proxy iptables Move api-proxy iptables rules to use pre-set AWF_API_PROXY_IP environment variable instead of dynamic hostname resolution, and place FILTER rules in the correct position (after NAT setup, before final DROP rule). Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * Add debug logging for BASE_URL environment variables in agent container (#816) * Initial plan * feat: add debug logging for BASE_URL environment variables Add logging to display ANTHROPIC_BASE_URL and OPENAI_BASE_URL values that are set for the agent container. This helps debug configuration issues when running Claude Code CLI in the workflow. The logging is added after the Docker Compose config is generated, showing whether BASE_URL variables are set or using defaults. Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix: simplify api-proxy iptables bypass condition (#819) * Initial plan * fix: simplify api-proxy iptables bypass condition The NAT bypass for api-proxy traffic was checking both AWF_ENABLE_API_PROXY and AWF_API_PROXY_IP, but this was too strict. When the HTTP_PROXY environment variable is set, HTTP clients will send requests through the proxy unless NO_PROXY is configured or iptables rules prevent it. The issue was that the NAT bypass required both flags, causing traffic to 172.30.0.30 (api-proxy) to be sent through Squid when it should go directly. Squid then blocked these requests because the IP address wasn't in the domain whitelist. The fix simplifies the condition to only check AWF_API_PROXY_IP, matching the pattern used for the OUTPUT FILTER ACCEPT rules (lines 285-289). This ensures that when AWF_API_PROXY_IP is set, traffic to that IP bypasses Squid at the NAT level, preventing HTTP clients from routing through the proxy regardless of HTTP_PROXY settings. Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * Initial plan (#818) Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> * fix: add api-proxy IP to squid allowlist (#820) * Initial plan * fix: add api-proxy IP to squid allowlist Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> Co-authored-by: Landon Cox <landon.cox@microsoft.com> Co-authored-by: Jiaxiao (mossaka) Zhou <duibao55328@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agent container could not communicate with api-proxy sidecar at
172.30.0.30. Squid logs showed 9 blocked requests to this IP.Root Cause
The NAT bypass in
setup-iptables.shrequired bothAWF_ENABLE_API_PROXYANDAWF_API_PROXY_IP:This condition was too strict. When
HTTP_PROXYenvironment variable is set, HTTP clients route traffic through Squid at the application level. The iptables NAT bypass should prevent this, but the dual-flag check caused the bypass to be skipped, sending api-proxy traffic through Squid where it was blocked (IP addresses aren't in the domain whitelist).Changes
AWF_API_PROXY_IP(matching the OUTPUT FILTER ACCEPT rules pattern at lines 285-289)AWF_ENABLE_API_PROXYcheck and unused warning messageThis ensures traffic to
172.30.0.30bypasses Squid at the network level whenever the api-proxy IP is configured, taking precedence over application-level proxy settings.