Developer proxy cheat sheet — Git, npm, pip, Go, Maven and SSH

Command-line tools do not read the system proxy. This collects the configuration for the common ones in one place, to take what you need.

Assuming your mixed port is 7897 (check it in Clash Verge's port settings; defaults vary by version).

Try environment variables first — they cover more than half

Most tools that follow Unix convention respect these:

# macOS / Linux / WSL
export http_proxy=http://127.0.0.1:7897
export https_proxy=http://127.0.0.1:7897
export all_proxy=socks5://127.0.0.1:7897
export no_proxy="localhost,127.0.0.1,::1,*.local,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"

# Windows PowerShell (current session)
$env:HTTP_PROXY  = "http://127.0.0.1:7897"
$env:HTTPS_PROXY = "http://127.0.0.1:7897"
$env:NO_PROXY    = "localhost,127.0.0.1,::1,*.local"

:: Windows CMD
set HTTP_PROXY=http://127.0.0.1:7897
set HTTPS_PROXY=http://127.0.0.1:7897

Make it a pair of shell functions:

# ~/.zshrc or ~/.bashrc
proxyon() {
  export http_proxy=http://127.0.0.1:7897
  export https_proxy=$http_proxy
  export all_proxy=socks5://127.0.0.1:7897
  export no_proxy="localhost,127.0.0.1,::1,*.local"
  echo "✓ proxy on"
}
proxyoff() {
  unset http_proxy https_proxy all_proxy no_proxy
  echo "✗ proxy off"
}

Git

Git has its own configuration system. Environment variables work for HTTPS but not for SSH.

# HTTPS
git config --global http.proxy http://127.0.0.1:7897
git config --global https.proxy http://127.0.0.1:7897

# undo
git config --global --unset http.proxy
git config --global --unset https.proxy

# inspect
git config --global --get-regexp proxy

Proxy one host only (recommended, so your corporate Git server does not also go through it):

git config --global http.https://github.com.proxy http://127.0.0.1:7897

Git over SSH ([email protected]:xxx.git) ignores http.proxy and needs SSH configuration:

# ~/.ssh/config
Host github.com
  HostName github.com
  User git
  Port 22
  # macOS / Linux
  ProxyCommand nc -X connect -x 127.0.0.1:7897 %h %p
  # Windows (Git Bash ships connect.exe)
  # ProxyCommand connect -H 127.0.0.1:7897 %h %p

An alternative when port 22 is blocked

Use GitHub's SSH on port 443:

Host github.com
  HostName ssh.github.com
  Port 443
  User git

This is often more effective than configuring a proxy, because port 443 tends to have better connectivity.

npm / yarn / pnpm

# npm
npm config set proxy http://127.0.0.1:7897
npm config set https-proxy http://127.0.0.1:7897
npm config delete proxy && npm config delete https-proxy   # undo

# yarn (v1)
yarn config set proxy http://127.0.0.1:7897
yarn config set https-proxy http://127.0.0.1:7897

# pnpm
pnpm config set proxy http://127.0.0.1:7897
pnpm config set https-proxy http://127.0.0.1:7897

The settings live in ~/.npmrc and can be edited directly:

proxy=http://127.0.0.1:7897
https-proxy=http://127.0.0.1:7897
noproxy=localhost,127.0.0.1,.company.com

A mirror registry is often faster than a proxy

npm config set registry https://registry.npmmirror.com

A nearby mirror reached directly usually beats pulling the official registry through a proxy. The two do not conflict — install packages from the mirror and keep the proxy for other tools.

Python / pip

# one-off
pip install --proxy http://127.0.0.1:7897 requests

# permanent
pip config set global.proxy http://127.0.0.1:7897
pip config unset global.proxy

Config file locations:

Windows: %APPDATA%\pip\pip.ini
macOS/Linux: ~/.config/pip/pip.conf

[global]
proxy = http://127.0.0.1:7897
index-url = https://pypi.org/simple

The requests library reads the environment variables too, and can be told explicitly in code:

proxies = {
    "http": "http://127.0.0.1:7897",
    "https": "http://127.0.0.1:7897",
}
requests.get(url, proxies=proxies)

Go

# Go modules through the official proxy (usually enough, no local proxy needed)
go env -w GOPROXY=https://proxy.golang.org,direct

# a regional mirror
go env -w GOPROXY=https://goproxy.cn,direct

# keep private repositories off the proxy
go env -w GOPRIVATE=*.company.com,github.com/myorg/*

# when you do need the local proxy (pulling a private GitHub repo, say)
go env -w GOPROXY=direct
export HTTPS_PROXY=http://127.0.0.1:7897

go get respects the HTTP_PROXY and HTTPS_PROXY environment variables.

Java / Maven / Gradle

Maven (~/.m2/settings.xml):

<settings>
  <proxies>
    <proxy>
      <id>clash</id>
      <active>true</active>
      <protocol>http</protocol>
      <host>127.0.0.1</host>
      <port>7897</port>
      <nonProxyHosts>localhost|127.0.0.1|*.company.com</nonProxyHosts>
    </proxy>
  </proxies>
</settings>

Gradle (~/.gradle/gradle.properties):

systemProp.http.proxyHost=127.0.0.1
systemProp.http.proxyPort=7897
systemProp.https.proxyHost=127.0.0.1
systemProp.https.proxyPort=7897
systemProp.http.nonProxyHosts=localhost|127.0.0.1|*.company.com

JVM command-line flags:

java -Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort=7897 \
     -Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort=7897 \
     -Dhttp.nonProxyHosts="localhost|127.0.0.1" -jar app.jar

Rust / Cargo

~/.cargo/config.toml:

[http]
proxy = "http://127.0.0.1:7897"

[https]
proxy = "http://127.0.0.1:7897"

curl / wget

# curl, one-off
curl -x http://127.0.0.1:7897 https://example.com
curl --socks5 127.0.0.1:7897 https://example.com

# curl, permanent (~/.curlrc)
echo 'proxy = "http://127.0.0.1:7897"' >> ~/.curlrc

# wget, permanent (~/.wgetrc)
cat >> ~/.wgetrc <<'EOF'
use_proxy = on
http_proxy = http://127.0.0.1:7897
https_proxy = http://127.0.0.1:7897
EOF

System package managers

# apt (/etc/apt/apt.conf.d/95proxy)
echo 'Acquire::http::Proxy "http://127.0.0.1:7897";' | sudo tee /etc/apt/apt.conf.d/95proxy
echo 'Acquire::https::Proxy "http://127.0.0.1:7897";' | sudo tee -a /etc/apt/apt.conf.d/95proxy

# dnf/yum (add to /etc/dnf/dnf.conf)
# proxy=http://127.0.0.1:7897

# Homebrew (macOS) — reads the environment
export ALL_PROXY=socks5://127.0.0.1:7897
brew install xxx

A quick reference table

Tool	How to configure	Reads env vars
curl / wget	`-x` flag or `.curlrc`	✅
Git (HTTPS)	`git config http.proxy`	✅
Git (SSH)	ProxyCommand in `~/.ssh/config`	❌
npm / yarn / pnpm	`.npmrc`	⚠️ Some versions
pip	`pip.conf`	✅
Go	Env vars plus GOPROXY	✅
Maven	`settings.xml`	❌
Gradle	`gradle.properties`	❌
Cargo	`.cargo/config.toml`	✅
Docker daemon	systemd drop-in	❌
apt / dnf	Their own config files	⚠️ Lost under sudo
Homebrew	Environment variables	✅

Why environment variables sometimes do nothing

The easier route: enable TUN

All of the above adds up, and every new tool you install may need doing again.

With TUN mode on, every command-line tool is proxied automatically and none of them needs configuring.

The cost is virtual adapter privileges, plus remembering to add private ranges to your direct rules:

prepend-rules:
  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve
  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - DOMAIN-SUFFIX,company.com,DIRECT

Verifying

# what exit IP am I using
curl https://api.ipify.org

# is Git going through the proxy (-v prints connection details)
GIT_CURL_VERBOSE=1 git ls-remote https://github.com/git/git 2>&1 | head -20

# npm settings
npm config list | grep -i proxy

You can also open the connections page in Clash Verge and watch for new entries while running a command — one appearing means the traffic came through.

In short

Try environment variables first; they cover curl, pip, Go, Cargo, Homebrew and plenty more
Git, npm, Maven, Gradle and Docker have their own configuration systems and must be done separately
SSH needs ProxyCommand, or switch to port 443
no_proxy is mandatory, or local and internal services all break
Remember -E with sudo
If it is all too much, enable TUN — but set up your private-range direct rules

Related docs

Deployment Getting Docker and WSL2 onto the host's Clash proxy

127.0.0.1 inside a container is not the host. Configuration for all three Docker scenarios — daemon pulls, build time and run time — plus two approaches for WSL2's different networking modes.

2026-06-141330 words3 min read

Deployment Mihomo as a home gateway — transparent proxying on a soft router or NAS

Zero configuration for every device in the house. The trade-offs between three approaches (side router, TProxy, TUN), the full config and systemd service, firewall rules, and fault tolerance so the household stays online.

2026-06-051791 words4 min read

Deployment The Clash control API in full — endpoints, dashboards and automation scripts

The complete RESTful API exposed by external-controller: switching nodes, inspecting connections, reloading the config, deploying a web dashboard, and several practical automation scripts.

2026-06-011299 words3 min read