From eecde11061626e777b5622e10ba4c433a248eadf Mon Sep 17 00:00:00 2001
From: Cynosure159 <15217310106@163.com>
Date: Thu, 13 Aug 2026 15:10:03 +0800
Subject: [PATCH] docs(docker): document outbound proxy configuration

---
 docker-compose.yml            |  3 +++
 wiki/Environment-Variables.md | 18 +++++++++++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index e59ccbc2a..6709c3d30 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -31,6 +31,9 @@ services:
 #      - COOKIE_SECURE=false # Escape hatch: force session cookies over plain HTTP even in production. Not recommended.
 #      - TRUST_PROXY=1 # Trusted proxy count for X-Forwarded-For / X-Forwarded-Proto. Required for FORCE_HTTPS to work.
 #      - ALLOW_INTERNAL_NETWORK=false # Set to true if Immich or other services are hosted on your local network (RFC-1918 IPs). Loopback and link-local addresses remain blocked regardless.
+#      - HTTP_PROXY=${HTTP_PROXY:-} # Optional. Proxy URL for outbound HTTP requests (e.g. http://192.168.1.10:7890)
+#      - HTTPS_PROXY=${HTTPS_PROXY:-} # Optional. Proxy URL for outbound HTTPS requests
+#      - NO_PROXY=${NO_PROXY:-localhost,127.0.0.1} # Optional. Comma-separated hosts and domains that bypass the outbound proxy
 #      - APP_URL=https://trek.example.com # Public base URL — required when OIDC is enabled (must match the redirect URI registered with your IdP); also used as base URL for links in email notifications
 #      - OIDC_ISSUER=https://auth.example.com # OpenID Connect provider URL
 #      - OIDC_CLIENT_ID=trek # OpenID Connect client ID
diff --git a/wiki/Environment-Variables.md b/wiki/Environment-Variables.md
index 9ff47f98b..e6b47f9aa 100644
--- a/wiki/Environment-Variables.md
+++ b/wiki/Environment-Variables.md
@@ -97,7 +97,23 @@ translations are added to TREK.
 
 ---
 
-## HTTPS / Proxy
+## Outbound HTTP(S) Proxy
+
+TREK can route supported outbound HTTP(S) requests through a proxy by setting the standard variables below. Outbound
+proxying is disabled by default.
+
+| Variable      | Description                                                   | Default |
+|---------------|---------------------------------------------------------------|---------|
+| `HTTP_PROXY`  | Proxy URL for outbound HTTP requests                          | —       |
+| `HTTPS_PROXY` | Proxy URL for outbound HTTPS requests                         | —       |
+| `NO_PROXY`    | Comma-separated hosts or domains that should bypass the proxy | —       |
+
+> **Note:** Proxy environment variables apply to requests made through Node.js's default HTTP dispatcher. Requests
+> handled by TREK's SSRF protection use a dedicated dispatcher and do not use the environment proxy.
+
+---
+
+## HTTPS / Reverse Proxy
 
 These three variables work together behind a TLS-terminating reverse proxy. See [Reverse-Proxy](Reverse-Proxy) for the
 full explanation.