GitLab Proxy: Shared Access, API Limits and the Object Storage Path

You can use GitLab in two different ways: on the cloud instance the provider operates, or on a copy you install on your own server. This distinction changes the proxy decision from the outset, because in the second case the target address is under your control and some of the traffic never leaves for the external network.

The second distinction is on the client side. The browser, the git client, the continuous integration runner and scripts read different configurations. Runners usually look at environment variables; this makes it critical to write correctly the list that determines which addresses are kept out of scope.

The third is download behaviour: in most setups, artefacts and large file content are served not from the main application but from an object store. The sections below unpack these three topics separately.

A cloud instance and a self-hosted installation do not require the same thing

On the instance the provider operates, the target address is on the external network and all of your clients talk by going out to the internet. Here the proxy's function is to control the exit, to speak from a fixed address on the corporate network, or to verify a regional view. Writing rules is relatively simple because the target is a single domain family.

With a self-hosted installation the picture is reversed. If the application runs on the internal network, routing traffic to it through the proxy is usually unnecessary and even harmful: directing internal addresses to an external exit can break the connection entirely. That is why the list of addresses to exclude is as important as the proxy address itself.

Mixed scenarios are also common: the application may be on the internal network while container images and package dependencies are pulled from outside. In such a setup the rule is built like this: internal addresses direct, external addresses through the proxy.

Another difference is on the redundancy side. On a cloud instance, availability is the provider's responsibility; with a self-hosted installation the proxy creates a new single point of failure between client and application. Before adding this layer, list in writing which jobs will stop if the proxy goes down, and define at least a fallback path for the deployment pipeline.

Whichever setup you have, the first step is to write the target list. The application itself, the package registry, the container registry and the object store may be at separate addresses; note them all down one by one. The difference between forward and reverse proxies is a good starting point for clarifying which direction you are working in.

Settling team access into a single exit scheme

Not everyone who accesses a repository connects from the same place: in-house developers may come from the office network, remote workers from a home connection, and external agencies from an entirely different country. In setups where access is restricted to specific addresses, this scatter turns directly into an access problem.

Defining a common exit simplifies this picture: wherever anyone connects from, they reach the application from a single recognised address. But a single exit should not mean a single set of credentials. Defining separate credentials per group means that when someone leaves you only have to renew the relevant record.

Think of the life cycle in three steps: during definition, scope and permissions are set; during use, git, interface and runner traffic all pass through the same scheme; during renewal, both credentials and tokens are refreshed. Tying this cycle to a calendar prevents forgotten access from piling up.

When dividing access, review permission depth as well. Which projects the credentials tied to an exit cover is often set during setup and never revisited; a scope kept broader than necessary turns a small leak into a wide surface.

Setting aside a separate exit when working with external teams brings an added advantage: when the contract ends you shut down only that exit, and the internal team is unaffected. Choose the authentication method according to the team structure; for offices with fixed addresses, IP authorisation is practical.

The scope of the git client, the runner and environment variables

The git client on the command line reads its own configuration; a setting you write in the browser does not affect it. The continuous integration runner runs on another machine and in most setups looks at environment variables. Three different components working on the same repository mean three separate scopes.

On the runner side, the critical point is the list of addresses to be excluded. If this list is incomplete, a request to a service on the internal network is routed to the external exit and never arrives; if it is too broad, some external traffic bypasses the proxy and an audit gap appears. When writing the list, consider host names and any internal network blocks together.

The second point is the sub-processes launched inside a job. If a script pulls a container image, a package manager downloads dependencies, or a test tool sends requests outside, each of these is a separate client. Defining the variables at job level is enough in most cases, but some tools expect their own configuration.

Be careful when committing configuration to the repository as well. Scope lists are usually harmless, but an address line containing credentials stays in the history once committed and goes to everyone who takes a copy of the repository. Keeping these values in protected variables and masking them in job logs should be standard practice.

After finishing the configuration, add a small check to the job's first step that prints the exit address. A step like this catches coverage that quietly breaks months later. If you want to review the protocol choice, the protocol selection guide compares the two transports.

Artefact and large file downloads land on another host

When you want to download an artefact produced by a job or a large file object, the request first goes to the application, but the response is usually not the file itself. The application generates a temporary, signed address for the object store where the content sits and redirects the client there. The client then opens a second connection to this new host.

From the proxy's point of view this has two consequences. First, if your rule only covers the application domain, the actual download traffic falls outside the scope and goes directly. Second, on a network where access is restricted to specific addresses, the download fails if the target of the second connection is not on the allow list.

The same behaviour is seen in container registries: the manifest request may go to one address and layer downloads to another. When writing rules, avoid the assumption "I can reach the application, so everything must work"; actually try the download.

Keeping a record of the redirects makes diagnosis easier. Turn on your client's verbose output and watch the response codes; seeing which host the second connection is opened to solves most problems on its own. To test that the exit is genuinely being used, proxy checker tool you can use.