From 2f0f6bc1cd3c0390217c4e1ccbf608da618fc998 Mon Sep 17 00:00:00 2001
From: Jeremy Stein <j.stein@ucl.ac.uk>
Date: Wed, 2 Sep 2026 19:26:59 +0100
Subject: [PATCH 1/4] Use yaml anchors to avoid repeating http proxy config

---
 docker-compose.yml | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index b04c1f6..d66744d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,3 +1,9 @@
+x-proxy-common: &proxy-common
+  HTTP_PROXY: ${HTTP_PROXY}
+  http_proxy: ${http_proxy}
+  HTTPS_PROXY: ${HTTPS_PROXY}
+  https_proxy: ${https_proxy}
+
 services:
   waveform-controller:
     build:
@@ -5,10 +11,7 @@ services:
       dockerfile: waveform-controller/Dockerfile
       target: waveform_controller
       args:
-        HTTP_PROXY: ${HTTP_PROXY}
-        http_proxy: ${http_proxy}
-        HTTPS_PROXY: ${HTTPS_PROXY}
-        https_proxy: ${https_proxy}
+        <<: *proxy-common
     # ideally we'd use docker secrets but it's not enabled currently
     env_file:
      - ../config/controller.env
@@ -21,10 +24,7 @@ services:
       dockerfile: waveform-controller/Dockerfile
       target: waveform_exporter
       args:
-        HTTP_PROXY: ${HTTP_PROXY}
-        http_proxy: ${http_proxy}
-        HTTPS_PROXY: ${HTTPS_PROXY}
-        https_proxy: ${https_proxy}
+        <<: *proxy-common
         # Set to 1 in integration tests so COVERAGE_PROCESS_START can collect data.
         # Default 0 keeps production/dev images free of the coverage package.
         INSTALL_COVERAGE: ${INSTALL_COVERAGE:-0}
@@ -45,10 +45,7 @@ services:
       target: hasher_api
       args:
         PIXL_PACKAGE_DIR: hasher
-        HTTP_PROXY: ${HTTP_PROXY}
-        http_proxy: ${http_proxy}
-        HTTPS_PROXY: ${HTTPS_PROXY}
-        https_proxy: ${https_proxy}
+        <<: *proxy-common
     ports:
       # this is only here as a convenience for testing, we don't actually use it from the exporter
       - "127.0.0.1::8000"
@@ -65,10 +62,7 @@ services:
       context: .
       dockerfile: monitoring/Dockerfile
       args:
-        HTTP_PROXY: ${HTTP_PROXY}
-        http_proxy: ${http_proxy}
-        HTTPS_PROXY: ${HTTPS_PROXY}
-        https_proxy: ${https_proxy}
+        <<: *proxy-common
     env_file:
       - ../config/monitoring.env
     volumes:

From 952a643faa8eb7a866bc14d7bfde09561e81980e Mon Sep 17 00:00:00 2001
From: Jeremy Stein <j.stein@ucl.ac.uk>
Date: Wed, 2 Sep 2026 19:50:26 +0100
Subject: [PATCH 2/4] Remove warning about blank proxy env vars by explicitly
 saying they should be blank if missing

---
 docker-compose.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index d66744d..6a09ff8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,8 @@
 x-proxy-common: &proxy-common
-  HTTP_PROXY: ${HTTP_PROXY}
-  http_proxy: ${http_proxy}
-  HTTPS_PROXY: ${HTTPS_PROXY}
-  https_proxy: ${https_proxy}
+  HTTP_PROXY: ${HTTP_PROXY:-}
+  http_proxy: ${http_proxy:-}
+  HTTPS_PROXY: ${HTTPS_PROXY:-}
+  https_proxy: ${https_proxy:-}
 
 services:
   waveform-controller:

From 962765e57714c748da643b4be012bcaa0fdd58b5 Mon Sep 17 00:00:00 2001
From: Jeremy Stein <j.stein@ucl.ac.uk>
Date: Wed, 2 Sep 2026 19:58:55 +0100
Subject: [PATCH 3/4] Hasher requires internet access at runtime so it can talk
 to the keyvault

---
 docker-compose.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 6a09ff8..8d80941 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,14 @@
+# you may need to add to this list if containers need to have internet access
+# AND talk to other containers.
+x-no-proxy: &no-proxy localhost
+
 x-proxy-common: &proxy-common
   HTTP_PROXY: ${HTTP_PROXY:-}
   http_proxy: ${http_proxy:-}
   HTTPS_PROXY: ${HTTPS_PROXY:-}
   https_proxy: ${https_proxy:-}
+  NO_PROXY: *no-proxy
+  no_proxy: *no-proxy
 
 services:
   waveform-controller:
@@ -51,6 +57,8 @@ services:
       - "127.0.0.1::8000"
     env_file:
       - ../config/hasher.env
+    environment:
+      <<: *proxy-common
     restart: unless-stopped
   waveform-monitoring:
     # This service exists as a partly temporary measure, covering a few different cases:

From 296c8abc3070a895a93cfd5ac16084ee5a8e7ae1 Mon Sep 17 00:00:00 2001
From: Jeremy Stein <j.stein@ucl.ac.uk>
Date: Wed, 2 Sep 2026 20:35:02 +0100
Subject: [PATCH 4/4] Add explanatory comment

---
 docker-compose.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 8d80941..638169b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -58,6 +58,7 @@ services:
     env_file:
       - ../config/hasher.env
     environment:
+      # hasher needs access to key vaults at run time
       <<: *proxy-common
     restart: unless-stopped
   waveform-monitoring: