Chef Proxy Settings Across Compile and Converge Phases

Account for recipe compilation and resource execution when changing a global proxy for one remote_file action.

previous = Chef::Config[:http_proxy]
Chef::Config[:http_proxy] = 'http://proxy.example.net:8080'

remote_file '/var/tmp/package.zip' do
  source 'https://downloads.example.net/package.zip'
end

Chef::Config[:http_proxy] = previous

The temporary value is gone before this ordinary resource downloads anything:

  1. Compile: top-level Ruby saves the value, sets the temporary proxy, declares remote_file and restores the value.
  2. Converge: the resource performs its action using configuration available then.

A stable client proxy with suitable internal exclusions avoids this timing problem. Use the installed client's documented exclusion syntax rather than assuming shell wildcard rules. For an independent public-artifact download on an allowed public route, an HTTP proxy list entry can supply the stable HTTP endpoint when the Chef client has no configured or retained proxy account. Keep its internal exclusions; choosing an address does not change when compile and converge consume it.

If one operation needs a special route, put its configuration change and execution in the same scope. A custom resource with appropriate unified-mode behavior is one option, but Chef::Config remains global. Restore it when the download fails and when the file is already current. An update notification does not run unconditionally, and a later cleanup resource may never run after an exception.

A lazy source property delays that property's evaluation, not surrounding Ruby assignments. Compile-time resource execution is a separate supported choice when that is when the download belongs; it also changes dependency and notification timing. Choose according to when the HTTP client consumes its proxy setting, rather than expecting declaration order to provide isolation.

Erthyglow kevrennek