🔧(dev) configure bureautix proxy for image builds

Builds through the Docker API of the Podman service receive none of the
proxy variables in their RUN steps and fail systematically because of
the proxy rejection. Plain HTTP connections are also rejected by the
proxy with a HTTP 405 method error.

- Passes http_proxy, https_proxy and no_proxy from the shell as build args
- Make the Debian mirror of the agents image a build argument and
  override it for bureautix to force https usage

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to
 ### Added
 
 - ✨(backend) make the LiveKit default video codec configurable
+- 🔧(dev) add support for Bureautix workstations
 
 ### Changed
 

devenv.nix

@@ -243,7 +243,9 @@ in
 
 
       # Apply Bureautix override
-      _compose_files="$_compose_files:$_compose_dir/compose.bureautix.yml"
+      if [ -n "''${http_proxy:-}" ]; then
+        _compose_files="$_compose_files:$_compose_dir/compose.bureautix.yml"
+      fi
 
       export COMPOSE_FILE="$_compose_files"
       unset _compose_dir _compose_files

docker/compose.d/compose.bureautix.yml

@@ -1,7 +1,48 @@
-# Override for Bureautix workstations, where the local proxy listens on
-# 8080 and collides with Keycloak's published admin port.
+# Bureautix proxy overrides
+#
+# Builds submitted through the Docker API of the Podman service get none of
+# the proxy variables in their RUN steps. We need to pass the http_proxy explicitely
+# otherwise all connections fail during the build.
+
+x-proxy-vars: &proxy-vars
+  http_proxy: ${http_proxy:-}
+  https_proxy: ${https_proxy:-}
+  no_proxy: ${no_proxy:-}
 
 services:
+  app:
+    build:
+      args:
+        <<: *proxy-vars
+  app-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  frontend:
+    build:
+      args:
+        <<: *proxy-vars
+  metadata-collector-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  multi-user-transcriber-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  app-summary-dev:
+    build:
+      args:
+        <<: *proxy-vars
+  celery-summary-transcribe:
+    build:
+      args:
+        <<: *proxy-vars
+  celery-summary-summarize:
+    build:
+      args:
+        <<: *proxy-vars
+  # The local proxy listens on 8080 and collides with Keycloak's published admin port.
   keycloak:
     ports: !override
       - "8081:8080"

src/agents/Dockerfile

@@ -1,7 +1,8 @@
 FROM python:3.14.6-slim AS base
 
-# Install system dependencies required by LiveKit
-RUN apt-get update && apt-get install -y \
+# Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
+RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
+    && apt-get update && apt-get install -y --no-install-recommends  \
     libglib2.0-0 \
     libgobject-2.0-0 \
     && rm -rf /var/lib/apt/lists/*