Using Upstream Sources on Azure DevOps Server that's behind a HTTP Proxy

2
votes

Our Azure DevOps Server infrastructure is behind all behind a HTTP Web Proxy server for all outbound traffic. We want to enable the Upstream Sources feature in Azure Artifacts, so that Azure DevOps downloads packages from nuget.org, etc. when they are requested.

We have however not found any documentation on how to make the Azure DevOps Server Application Tier (which we're assuming is making the outbound connection to the upstream sources). When we enable the upstream sources feature on one of our feeds, and adding nuget.org to it, we get the following error when trying to download any package in our feed:

Response status code does not indicate success: 500 (Internal Server Error - Failed to retrieve data from the upstream package source 'https://api.nuget.org/v3/index.json': An error occurred while sending the request. (DevOps Activity ID: F2C6C7EF-6651-4FB2-B650-5221ABC80F64)

When we disable the upstream sources, this error goes away, and package download succeeds from Azure DevOps cache instead of the upstream source.

Searching through the Application Tier's directories on the server, we saw the that the web.config for the DevOps website already has the following proxy settings applied:

<system.net>
  <defaultProxy useDefaultCredentials="true"/>
</system.net>

We've modified this further to explicitly provide our proxy server address as such:

<system.net>
  <defaultProxy useDefaultCredentials="true">
    <proxy proxyAddress="http://<ourproxyserver>" />
  <defaultProxy/>
</system.net>

And then tried again, but received the same Failed to retrieve data from the upstream package source error.

We've tried looking for more detailed error logs from Azure DevOps server but have not found any trace of it in the log files we've found. But we're not exactly sure where Azure DevOps Server writes its error logs too.

Is there something that we're are missing to get Upstream Sources working in our scenario? Is Azure DevOps Server capable of making outbound requests through a HTTP proxy?

2
azure-devops

2 Answers

4
votes

It turns at that @Leo Liu-MSFT answer is not quite accurate; Azure DevOps Server can work behind a HTTP proxy server.

The problem in our instance was that the infrastructure team forgot to install the CA certificates for the proxy server on the host which was the actual cause of the HTTP 500 error message we were seeing.

Once the certificates were correctly installed, our best guess of updating the web.config file for the Azure DevOps site to use our proxy server details was correct.

<system.net>
  <defaultProxy useDefaultCredentials="true">
    <proxy proxyaddress="http://<ourproxyserver>" />
  <defaultProxy/>
</system.net>

See the following for additional proxy options: https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/network/proxy-element-network-settings

As a good measure, we also set the proxy server settings at the Windows server level too, using the following command in a console session:

netsh winhttp set proxy proxy-server=http://<ourproxyserver>

Once these steps were done, upstream sources started working in our Azure DevOps instance.

0
votes

Using Upstream Sources on Azure DevOps Server that's behind a HTTP Proxy

I am afraid there is no such out-of-box way to use Upstream Sources on Azure DevOps Server behind a HTTP Proxy at this moment.

As workaround, we could disable the upstream sources, then place the following setting in each project’s nuget.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <config>
        <add key="http_proxy" value="http://proxy_hostname_or_ip:xxxx" />
        <add key="https_proxy" value="http://proxy_hostname_or_ip:xxx" />
    </config>

  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
  </packageSources>

</configuration>

Use this nuget.config file when you restore nuget packages. Hope this helps.