Chapter 3. Configuring Ansible Automation Platform to use egress proxy You can deploy Ansible Automation Platform so that egress from the platform for various purposes functions properly through proxy servers. Egress proxy allows clients to make indirect (through a proxy server) requests to network services. The client first connects to the proxy server and requests some resource, for example, email, located on another server. The proxy server then connects to the specified server and retrieves the resource from it. 3.1. Overview The egress proxy should be configured on the system and component level of Ansible Automation Platform, for all the RPM and containerized installation methods. For containerized installers, the system proxy configuration for podman on the nodes solves most of the problems with access through the proxy. For RPM installation, both system and component configurations are needed. 3.1.1. Proxy backends For HTTP and HTTPS proxies you can use a squid server. Squid is a forward proxy for the Web supporting HTTP, HTTPS, and FTP, reducing bandwidth and improving response times by caching and reusing frequently-requested web pages. It is licensed under the GNU GPL. Forward proxies are systems that intercept network traffic going to another network (typically the internet) and send it on the behalf of the internal systems. The squid proxy enables all required communication to pass through it. Make sure all the required Ansible Automation Platform control plane ports are opened on the squid proxy backend. Ansible Automation Platform-specific ports: acl Safe_ports port 81 acl Safe_ports port 82 acl Safe_ports port 389 acl Safe_ports port 444 acl Safe_ports port 445 acl SSL_ports port 22 The following ports are for containerized installations: acl SSL_ports port 444 acl SSL_ports port 445 acl SSL_ports port 8443 acl SSL_ports port 8444 acl SSL_ports port 8445 acl SSL_ports port 8446 acl SSL_ports port 44321 acl SSL_ports port 44322 http_access deny !Safe_ports http_access deny CONNECT !SSL_ports 3.2. System proxy configuration The outbound proxy is configured on the system level for all the nodes in the control plane. The following environment variables must be set: http_proxy="http://external-proxy_0:3128" https_proxy="http://external-proxy_0:3128" no_proxy="localhost,127.0.0.0/8,10.0.0.0/8" You can also add those variables to the /etc/environment file to make them permanent. The installation program ensures that all external communication during the installation goes through the proxy. For containerized installation, those variables ensure that the podman uses the egress proxy. 3.3. Automation controller settings After using the RPM installation program, you must configure automation controller to use egress proxy. Note This is not required for containerized installers because podman uses system configured proxy and redirects all the container traffic to the proxy. For automation controller, set the AWX_TASK_ENV variable in /api/v2/settings/ . To do this through the UI use the following procedure: Procedure From the navigation panel, select Settings Job . Click Edit . Add the variables to the Extra Environment Variables field and set: "AWX_TASK_ENV": { "http_proxy": "http://external-proxy_0:3128", "https_proxy": "http://external-proxy_0:3128", "no_proxy": "localhost,127.0.0.0/8" } 3.4. Enabling a configurable proxy environment for AWS inventory synchronization To enable a configurable proxy environment for AWS inventory synchronization, you can manually edit the override configuration file or set the configuration in the platform UI: Manually edit /usr/lib/systemd/system/receptor.service.d/override.conf and add the following http_proxy environment variables there: http_proxy:<value> https_proxy:<value> proxy_username:<value> Proxy_password:<value> Or To do this through the UI use the following procedure: Procedure From the navigation panel, select Settings Job . Click Edit . Add the variables to the Extra Environment Variables field For example: * "AWX_TASK_ENV": { "no_proxy": "localhost,127.0.0.0/8,10.0.0.0/8", "http_proxy": "http://proxy_host:3128/", "https_proxy": "http://proxy_host:3128/" }, 3.5. Configuring Proxy settings on automation hub If your private automation hub is behind a network proxy, you can configure proxy settings on the remote to sync content located outside of your local network. Prerequisites You have Modify Ansible repo content permissions. For more information on permissions, see Access management and authentication . You have a requirements.yml file that identifies those collections to synchronize from Ansible Galaxy as in the following example: Requirements.yml example Procedure Log in to Ansible Automation Platform. From the navigation panel, select Automation Content Remotes . In the Details tab in the Community remote, click Edit remote . In the YAML requirements field, paste the contents of your requirements.yml file. Click Save remote . You can now synchronize collections identified in your requirements.yml file from Ansible Galaxy to your private automation hub. From the navigation panel, select Automation Content Repositories . to the community repository, click the More Actions icon ... and select Sync repository to sync collections between Ansible Galaxy and Ansible automation hub. On the modal that appears, you can toggle the following options: Mirror : Select if you want your repository content to mirror the remote repository's content. Optimize : Select if you want to sync only when no changes are reported by the remote server. Click Sync to complete the sync. Verification The Sync status column updates to notify you whether the Ansible Galaxy collections synchronization to your Ansible automation hub is successful. Navigate to Automation Content Collections and select Community to confirm successful synchronization. 3.6. Configuring proxy settings on Event-Driven Ansible For Event-Driven Ansible, there are no global settings to set a proxy. You must specify the proxy for every project. Procedure From the navigation panel, select Automation Decisions Projects . Click Create Project Use the Proxy field. 3.7. Configuring proxy settings for automation mesh You can route outbound communication from the receptor on an automation mesh node through a proxy server. If your proxy does not strip out TLS certificates then an installation of Ansible Automation Platform automatically supports the use of a proxy server. Every node on the mesh must have a Certifying Authority that the installer creates on your behalf. The default install location for the Certifying Authority is: /etc/receptor/tls/ca/mesh-CA.crt The certificates and keys created on your behalf use the nodeID for their names: For the certificate: /etc/receptor/tls/NODEID.crt For the key: /etc/receptor/tls/NODEID.key

Commands:
acl Safe_ports port 81 acl Safe_ports port 82 acl Safe_ports port 389 acl Safe_ports port 444 acl Safe_ports port 445 acl SSL_ports port 22
acl SSL_ports port 444 acl SSL_ports port 445 acl SSL_ports port 8443 acl SSL_ports port 8444 acl SSL_ports port 8445 acl SSL_ports port 8446 acl SSL_ports port 44321 acl SSL_ports port 44322 http_access deny !Safe_ports http_access deny CONNECT !SSL_ports
http_proxy="http://external-proxy_0:3128" https_proxy="http://external-proxy_0:3128" no_proxy="localhost,127.0.0.0/8,10.0.0.0/8"
"AWX_TASK_ENV": { "http_proxy": "http://external-proxy_0:3128", "https_proxy": "http://external-proxy_0:3128", "no_proxy": "localhost,127.0.0.0/8" }
http_proxy:<value> https_proxy:<value> proxy_username:<value> Proxy_password:<value>
"AWX_TASK_ENV": { "no_proxy": "localhost,127.0.0.0/8,10.0.0.0/8", "http_proxy": "http://proxy_host:3128/", "https_proxy": "http://proxy_host:3128/" },
collections: # Install a collection from Ansible Galaxy. - name: community.aws version: 5.2.0 source: https://galaxy.ansible.com