debootstrap Proxy Settings Belong to the Host Downloader

For debootstrap's Wget-based download path, supply the proxy to the host-side wgetprogress environment:

sudo env \
  http_proxy=http://proxy.example.net:8080 \
  https_proxy=http://proxy.example.net:8080 \
  debootstrap stable /srv/chroot/debian https://deb.debian.org/debian

Choose the suite, target directory and mirror for the deployment. The assignments occur after sudo, so the privileged command receives them without relying on the caller's exported variables surviving sudo policy. Both destination schemes can use this ordinary HTTP proxy. For an allowed public-mirror download without proxy authentication, the HTTP proxy list offers candidate HTTP endpoints for those environment values.

The first downloads obtain metadata and packages before the new Debian system is usable. An APT proxy file inside that future root cannot configure the earlier host downloader.

For authentication, use Wget's supported proxy credentials. URI user information needs reserved-character encoding; startup configuration also provides proxy_user and proxy_password. The privileged account’s inputs may differ from the interactive user's .wgetrc, so identify the one actually read and keep its scope deliberate.

Plan the next stages separately. A second-stage bootstrap, especially for foreign architecture, can execute in another environment. Later APT inside the completed system reads that system's configuration. The host command does not permanently configure either one.