Egress relay

A tiny, dependency-free forward proxy you run inside your own network so the hosted platform can reach private / on-prem resources (internal APIs, VPC-only services) with no inbound firewall hole — and without Provenant ever resolving private addresses itself.

When you need it

Only on the hosted platform, and only for connectors whose downstream is a private address — a private endpoint with no egress proxy is denied (connector.egress in the decision trail). Public endpoints never need one. Self-hosted deployments already run inside your network, so they address private endpoints directly (site-to-site VPN / PrivateLink included) — the relay is optional there.

Provenant speaks standard forward-proxy semantics — absolute-URI requests for plain HTTP and CONNECT tunnels for HTTPS/mTLS (TLS stays end-to-end) — so any compliant proxy works (Squid, Envoy, a corporate proxy you already run), or the Provenant relay below, built for exactly this. Provenant only ever connects to the proxy; the proxy resolves and reaches the private target from within, so there is no inbound firewall change.

Run it

The relay ships as a public image, ghcr.io/identiqube/provenant-relay — pull and run it inside your network (pin a released tag; latest tracks the newest):

Run the relay (Docker, inside your network)

docker run -d --name provenant-relay -p 8080:8080 \
  -e RELAY_AUTH="relay:$(openssl rand -hex 16)" \
  -e RELAY_ALLOWED_HOSTS="internal-api.corp.local" \
  ghcr.io/identiqube/provenant-relay:latest

Variable	Default	Purpose
`RELAY_PORT`	`8080`	listen port
`RELAY_HOST`	`0.0.0.0`	bind address
`RELAY_AUTH`	(off)	`user:pass` — require matching `Proxy-Authorization: Basic`
`RELAY_ALLOWED_HOSTS`	(any)	comma-separated allowlist; `host` (default port only) or `host:port` to pin a port
`RELAY_TIMEOUT_MS`	`15000`	upstream socket timeout
`RELAY_ALLOW_OPEN`	`false`	override the fail-closed startup refusal (not recommended)

The relay fails closed

On a non-loopback bind with neither RELAY_AUTH nor RELAY_ALLOWED_HOSTS, the relay refuses to start — an open forward proxy is a liability, not a convenience. Set both in production. GET /healthz answers liveness probes without auth.

Point a connector at it

Set the connector’s Egress proxy field (Govern → Connectors) to the relay URL — https://user:[email protected]:8080. Provenant routes that connector’s downstream calls through the relay; every other connector is unaffected. See Connectors & secrets for the connector setup itself.