@@ -8,6 +8,7 @@ Use `**BREAKING**:` to denote a breaking change
 
 ## Unreleased
 
+- Added an `outbound-http-proxy` example, which routes outbound traffic from frontend and worker through an HTTP proxy with `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`
 - Fixed the `codeintel-db` PersistentVolumeClaim being renamed by `codeIntelDB.name`, which left the StatefulSet pointing at a `codeintel-db` claim that no longer existed and stuck the pod in `Pending`. The PVC is now always named `codeintel-db`, matching the other components and the documented behaviour of `*.name`. If you worked around this by creating a `codeintel-db` PVC by hand, label it `app.kubernetes.io/managed-by: Helm` and annotate it with `meta.helm.sh/release-name` and `meta.helm.sh/release-namespace` before upgrading so Helm can adopt it. [#612](https://github.com/sourcegraph/deploy-sourcegraph-helm/issues/612)
 - Added opt-in Redis config management through `redisCache.config.enabled` and `redisStore.config.enabled` (both default to `false`). Default deployments retain their image configs, custom mounts, authentication, and memory settings. When enabled, the chart mounts `/etc/redis/redis.conf` and supports `existingConfig`, `maxmemory`, `maxmemoryRatio`, `maxmemoryPolicy`, and `additionalConfig`. See [Enabling Redis config management](README.md#enabling-redis-config-management) before opting in, especially when using custom images or Secret-mounted configs.
 - With Redis config management enabled, the chart sizes `maxmemory` at 75% of `resources.limits.memory` to leave room for overhead; this reduces, but does not eliminate, OOM risk. Ratios must be greater than 0 and less than 1. Auto-sizing is skipped in local development mode or when the limit is absent or unrecognised. At the default 7Gi limit, opting in lowers the effective cap from 6GiB to 5.25GiB: `redis-cache` evicts earlier, but `redis-store` uses `noeviction`, so its write-error ceiling drops too. Set `redisStore.config.maxmemory: 6gb` to keep the old ceiling if the pod has sufficient memory.
 
@@ -0,0 +1,55 @@
+# Override file for routing outbound HTTP(S) traffic through an HTTP proxy
+# ex. telemetry, update checks, and license verification to services.sourcegraph.com,
+# and connections to code hosts, auth providers, and LLM providers outside your private network
+# See https://sourcegraph.com/docs/self-hosted/private-network#http-proxy-configuration
+
+# Reusable block of environment variables, for services which initiate outbound connections
+proxyEnvVars: &proxy-env-vars
+  HTTP_PROXY:
+    value: http://proxy.example.com:8080
+  HTTPS_PROXY:
+    value: http://proxy.example.com:8080
+  # Skip the proxy for local traffic
+  # Add your internal code hosts, auth providers, image registries, etc. which are reachable without the proxy
+  # If pods fail their readiness or health checks after adding the proxy, also add the cluster's pod and service CIDR ranges, ex. 10.10.0.0/16,10.20.0.0/16
+  # Each line needs a trailing comma, as YAML folds these lines into one line, separated by spaces
+  NO_PROXY:
+    value: >-
+      blobstore,
+      cloud-sql-proxy,
+      codeinsights-db,
+      codeintel-db,
+      gitserver,
+      grafana,
+      indexed-search,
+      indexed-search-indexer,
+      jaeger-query,
+      pgsql,
+      precise-code-intel-worker,
+      prometheus,
+      redis-cache,
+      redis-store,
+      searcher,
+      sourcegraph-frontend,
+      sourcegraph-frontend-internal,
+      syntect-server,
+      worker,
+      worker-executors,
+      localhost,
+      127.0.0.1,
+      .svc,
+      .svc.cluster.local,
+      kubernetes.default.svc
+
+frontend:
+  env:
+    <<: *proxy-env-vars
+
+# Uncomment if connections to code hosts outside your private network need to use the proxy
+# gitserver:
+#   env:
+#     <<: *proxy-env-vars
+
+worker:
+  env:
+    <<: *proxy-env-vars