Network

Set the standard proxy variables and exclude loopback addresses. OpenCode uses local HTTP connections between the CLI and its background service, so the loopback exclusion is required when a proxy is configured in the CLI environment.

export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080
export NO_PROXY=localhost,127.0.0.1,::1

opencode

HTTP_PROXY handles HTTP destinations and HTTPS_PROXY handles HTTPS destinations. The proxy URL itself can use http:// for both variables. NO_PROXY is a comma-separated list of hosts and addresses that connect directly.

Service

Shell exports affect a background service only when that service starts from the shell. Persist the variables in the managed service configuration so later service starts use the same network settings.

opencode service set env HTTP_PROXY http://proxy.example.com:8080
opencode service set env HTTPS_PROXY http://proxy.example.com:8080
opencode service set env NO_PROXY localhost,127.0.0.1,::1
opencode service start

Changing a managed environment variable stops the running service. service start starts it again with the new environment. Keep NO_PROXY in the CLI shell too when that shell sets a proxy, because managed service variables apply to the server process, not the CLI process.

Remove a persisted variable with service unset env:

opencode service unset env HTTPS_PROXY

Authentication

For a proxy that accepts URL credentials, include the username and password in each proxy URL that needs authentication. Percent-encode characters such as @, :, and / inside either credential.

export HTTPS_PROXY='http://user:p%40ssword@proxy.example.com:8080'

For the background service, persist the complete URL. The value is stored in the private service configuration and is shown by opencode service get env, so do not share that output.

opencode service set env HTTPS_PROXY 'http://user:p%40ssword@proxy.example.com:8080'

Certificates

Set NODE_EXTRA_CA_CERTS to a PEM file when the proxy or destination uses a certificate signed by a private certificate authority. The extra authorities are added to the runtime trust store when the process starts.

export NODE_EXTRA_CA_CERTS=/etc/company/ca.pem
opencode --standalone

Persist the file path for the background service, then restart it:

opencode service set env NODE_EXTRA_CA_CERTS /etc/company/ca.pem
opencode service start

Foreground

--standalone and serve use the environment of their own process. opencode service set env does not configure these processes.

HTTP_PROXY=http://proxy.example.com:8080 \
HTTPS_PROXY=http://proxy.example.com:8080 \
NO_PROXY=localhost,127.0.0.1,::1 \
opencode --standalone

Apply the same pattern to a foreground server:

HTTPS_PROXY=http://proxy.example.com:8080 \
NO_PROXY=localhost,127.0.0.1,::1 \
opencode serve

Verify

Check that the CLI can reach the background service after applying the settings:

opencode api get /api/info

A successful health response verifies the local client-to-service connection. Run a normal provider request to verify the service’s outbound proxy and certificate path.