Skip to main content
All products
Enterprise administrators

This version of GitHub Enterprise was discontinued on 2023-03-15. No patch releases will be made, even for critical security issues. For better performance, improved security, and new features, upgrade to the latest version of GitHub Enterprise. For help with the upgrade, contact GitHub Enterprise support.

Configuring an outbound web proxy server

In this article

A proxy server provides an additional level of security for your GitHub Enterprise Server instance.

Who can use this feature

Site administrators can configure an outbound web proxy server for a GitHub Enterprise Server instance.

About configuration of a proxy for GitHub Enterprise Server

When a proxy server is enabled for your GitHub Enterprise Server instance, outbound messages sent by GitHub Enterprise Server are first sent through the proxy server, unless the destination host is added as an HTTP proxy exclusion. Types of outbound messages include outgoing webhooks, uploading bundles, and fetching legacy avatars. The proxy server's URL is the protocol, domain or IP address, plus the port number, for example http://127.0.0.1:8123.

Note: To connect your GitHub Enterprise Server instance to GitHub.com, your proxy configuration must allow connectivity to github.com and api.github.com. For more information, see "Managing GitHub Connect."

If GitHub Actions is enabled for your enterprise, only HTTP proxies are supported. SOCKS5 and HTTPS proxies are not supported. For more information about using GitHub Actions with GitHub Enterprise Server, see "Getting started with GitHub Actions for GitHub Enterprise Server."

Configuring an outbound web proxy server

You can configure an outbound proxy server your GitHub Enterprise Server instance, and you can configure exceptions for connections to specific domains.

  1. From an administrative account on GitHub Enterprise Server, in the upper-right corner of any page, click .

  2. If you're not already on the "Site admin" page, in the upper-left corner, click Site admin.

  3. In the " Site admin" sidebar, click Management Console.

  4. In the "Settings" sidebar, click Privacy.

  5. Under HTTP Proxy Server, type the URL of your proxy server.

  6. Optionally, under HTTP Proxy Exclusion, type any hosts that do not require proxy access, separating hosts with commas. To exclude all hosts in a domain from requiring proxy access, you must use . as a wildcard prefix, such as .octo-org.tentacle.

    Note: In GitHub Enterprise Server 3.4.18 and later, your instance validates the hostnames using the list of IANA's registered top-level domains (TLDs). For more information, see the list of TLDs on the IANA website. If you want to exclude an unregistered TLD, see "Excluding additional unregistered TLDs from the proxy."

  7. Under the "Settings" sidebar, click Save settings.

    Note: Saving settings in the Management Console restarts system services, which could result in user-visible downtime.

  8. Wait for the configuration run to complete.

Excluding additional unregistered TLDs from the proxy

In GitHub Enterprise Server 3.4.18 and later, you can configure your instance's proxy settings to exclude unregistered TLDs that aren't specified in the list of TLDs on the IANA website.

  1. SSH into your GitHub Enterprise Server instance. If your instance comprises multiple nodes, for example if high availability or geo-replication are configured, SSH into the primary node. If you use a cluster, you can SSH into any node. For more information about SSH access, see "Accessing the administrative shell (SSH)."

    $ ssh -p 122 admin@HOSTNAME

  2. Enter the following command, replacing COMMA-SEPARATED-TLD-LIST with a comma-separated list of TLDs.

    $ ghe-config noproxy.exception-tld-list "COMMA-SEPARATED-TLD-LIST"

  3. To apply the configuration, run the following command.

    Note: During a configuration run, services on your GitHub Enterprise Server instance may restart, which can cause brief downtime for users.

    Shell
    ghe-config-apply

  4. Wait for the configuration run to complete.