Add egress proxy to user-app Kaniko build jobs.

Inject registry-egress-proxy into Kaniko and network init containers so npm/apk/composer/pip/git clone work on restricted egress clusters.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/templates/_helpers.tpl

@@ -123,4 +123,8 @@ PLATFORM_DOMAIN / preview domain from the first entry only. The panel host
   value: {{ .Values.build.images.alpineGit | quote }}
 - name: BASE_IMAGE_REGISTRY
   value: {{ .Values.build.baseImageRegistry | quote }}
+{{- if .Values.build.egressProxySecret }}
+- name: BUILD_EGRESS_PROXY_SECRET
+  value: {{ .Values.build.egressProxySecret | quote }}
+{{- end }}
 {{- end }}

backend/helm/cloudhost-platform/values.yaml

@@ -37,6 +37,9 @@ build:
     alpineGit: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
   # Prefix for Docker Hub images in generated user-app Dockerfiles (node, php, …)
   baseImageRegistry: registry.abrban.com/proxy-dockerhub/library
+  # Secret with HTTP_PROXY/HTTPS_PROXY for Kaniko build jobs (npm, apk, git clone).
+  # Set to registry-egress-proxy in production; leave empty when nodes have direct egress.
+  egressProxySecret: ""
 
 postgres:
   enabled: true