Egress relay

A tiny, dependency-free forward proxy you run inside your own network so the hosted platform can reach private / on-prem resources (internal APIs, VPC-only services) with a reachable, authenticated proxy endpoint. The private targets remain behind that proxy.

When you need it

Only on the hosted platform, and only for connectors whose downstream is a private address - a private endpoint with no egress proxy is denied (connector.egress in the decision trail). Public endpoints never need one. Self-hosted deployments already run inside your network, so they address private endpoints directly (site-to-site VPN / PrivateLink included) - the relay is optional there.

Provenant speaks standard forward-proxy semantics - absolute-URI requests for plain HTTP and CONNECT tunnels for HTTPS/mTLS (TLS stays end-to-end) - so any compliant proxy works (Squid, Envoy, a corporate proxy you already run), or the Provenant relay below, built for exactly this. Provenant only ever connects to the proxy; the proxy resolves and reaches the private target from within. Provide connectivity to the proxy through a controlled ingress or network route; a private-only proxy hostname is not reachable from the hosted service by itself.

Run it

The relay ships as a public image, ghcr.io/identiqube/provenant-relay - pull and run it inside your network (pin a released tag; latest tracks the newest):

Run the relay (Docker, inside your network)

# Save this value securely; use the same credentials in the connector proxy URL.
export RELAY_AUTH="relay:$(openssl rand -hex 16)"
docker run -d --name provenant-relay -p 127.0.0.1:8080:8080 \
  -e RELAY_AUTH \
  -e RELAY_ALLOWED_HOSTS="internal-api.corp.local" \
  ghcr.io/identiqube/provenant-relay:vX.Y.Z

Variable	Default	Purpose
`RELAY_PORT`	`8080`	listen port
`RELAY_HOST`	`0.0.0.0`	bind address
`RELAY_AUTH`	(off)	`user:pass` - require matching `Proxy-Authorization: Basic`
`RELAY_ALLOWED_HOSTS`	(any)	comma-separated allowlist; `host` (default port only) or `host:port` to pin a port
`RELAY_TIMEOUT_MS`	`15000`	upstream socket timeout
`RELAY_ALLOW_OPEN`	`false`	override the fail-closed startup refusal (not recommended)

The relay fails closed

On a non-loopback bind with neither RELAY_AUTH nor RELAY_ALLOWED_HOSTS, the relay refuses to start - an open forward proxy is a liability, not a convenience. Set both in production. GET /healthz answers liveness probes without auth.

Point a connector at it

Set the connector’s Egress proxy field (Govern → Connectors) to the relay URL - https://user:[email protected]. The bundled relay listens on plain HTTP; the example above binds it to localhost. Put a TLS-capable forward-proxy ingress in front of it that supports CONNECT, and make that secured endpoint reachable from Provenant. Do not point an HTTPS URL directly at its plain-HTTP listener. URL-encode credentials if needed. Provenant routes that connector’s downstream calls through the relay; every other connector is unaffected. See Connectors & secrets for the connector setup itself.