For the sake of comparing notes, here’s my experience trying to get mix deps.get working in a Codex environment. It looks like I’m hitting a proxy wall too.

Based on Codex’s documentation on internet access and proxies, here’s what I tried after installing Elixir via asdf:

1. Set all the recommended proxy and cert env vars:

   export http_proxy="http://proxy:8080"
   export https_proxy="http://proxy:8080"
   export SSL_CERT_FILE="$CODEX_PROXY_CERT"
   export REQUESTS_CA_BUNDLE="$CODEX_PROXY_CERT"
   export HEX_CACERTS_PATH="$CODEX_PROXY_CERT"
   export HEX_HTTP_CONCURRENCY=1
   

2. Installed Hex manually (since mix local.hex --force fails with a 503):

   mix archive.install github hexpm/hex --branch latest --force
   

3. Ran mix deps.get and got this repeated error:

   upstream connect error or disconnect/reset before headers. reset reason: connection termination
   

It looks like repo.hex.pm is getting blocked entirely, or the TLS handshake is being dropped by the proxy. Even with HEX_CACERTS_PATH pointing to the Codex proxy cert, the connection fails before it completes.

I noticed the docs say:

Environments are pre-configured to work with common tools and package managers

So I’m guessing Hex just isn’t allowed yet the way pip, npm, and others are.

Would love to get this working. Happy to test more or compare setups.

FWIW here’s my full script up until I try doing mix local.hex --force

#!/usr/bin/env bash
# bootstrap_asdf_prebuilt.sh – pulls binary OTP builds, so no C tool-chain needed
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive

# 1. Runtime-only libs (<< 10 MB total)
apt-get update -qq
apt-get install -y --no-install-recommends libssl3 zlib1g libncurses6
rm -rf /var/lib/apt/lists/*

# 2. asdf (same as before, but no gcc/make)
git clone -q https://github.com/asdf-vm/asdf.git /opt/asdf --branch v0.14.1
echo '. /opt/asdf/asdf.sh' >> /etc/bash.bashrc
. /opt/asdf/asdf.sh

# 3. **Pre-built** plugin for Erlang
asdf plugin add erlang https://github.com/michallepicki/asdf-erlang-prebuilt-ubuntu-24.04.git || true
asdf plugin add elixir
asdf plugin add nodejs

# 4. Honour your .tool-versions file
asdf install
asdf reshim

echo "🔥 OTP and Elixir installed"

export http_proxy="http://proxy:8080"
export https_proxy="http://proxy:8080"
export SSL_CERT_FILE="$CODEX_PROXY_CERT"
export REQUESTS_CA_BUNDLE="$CODEX_PROXY_CERT"
export HEX_CACERTS_PATH="$CODEX_PROXY_CERT"
export HEX_HTTP_CONCURRENCY=1

The underlying bug has been fixed in OTP and Elixir will work in Codex Cloud with the latest Erlang patches.

We patched erlang/otp httpc module. It has been released in OTP 28.1, 27.3.4.3 and 26.2.5.15. mix deps.get now works as expected since httpc no longer sends the te header for default GET requests.

Thanks @Damirados for the sample using Mise en Place. This works:

# make sure mise + its shims are on PATH now and later
echo 'export PATH=$HOME/.local/bin:$PATH' >> ~/.bashrc
echo 'export PATH=$HOME/.local/share/mise/shims:$PATH' >> ~/.bashrc
echo 'export HEX_CACERTS_PATH=$CODEX_PROXY_CERT' >> ~/.bashrc
export PATH=$HOME/.local/bin:$PATH
export PATH=$HOME/.local/share/mise/shims:$PATH
export HEX_CACERTS_PATH=$CODEX_PROXY_CERT

mise use --global erlang@28.1
mise use --global elixir@1.18.4-otp-28

mix deps.get
mix deps.compile
mix compile

Success! After spending a few hours with ChatGPT o3, I have finally managed to cast an incantation that seems to work! Some of the steps might be not necessary, and I might play with the script some more to experiment what can be safely removed.

TL;DR of the two critical steps:

• Need to compile Erlang with the right certificates (just using the binaries doesn’t seem to work). That’s unfortunate, as compiling Erlang takes the most amount of time (be patient!)
• Need to use a different Hex proxy jsDeliver from Mirrors | Hex; the official one doesn’t seem to work

Here is the script - let me know if it works for you, and how we can eliminate the unnecessary settings.

I asked our engineer Savvas to look into this. He is still working on it and will post more details later. But here the brief explanation of what is broken and how to work around it.

• httpc library used by Hex has a bug which makes it fail with proxy server that Codex uses. Savvas filed a bug here: httpc violates RFC 2616 for default requests · Issue #10065 · erlang/otp · GitHub
• Hex can be patched to work around the httpc bug: Comparing hexpm:latest...650health:latest · hexpm/hex · GitHub
• Various Elixir/Erlang utilities need to be configured to use the proxy and its CA certificate

Here is the setup script that should work for now:

# OpenAI Codex setup script for Elixir projects
go install github.com/asdf-vm/asdf/cmd/asdf@v0.18.0
asdf plugin add erlang https://github.com/michallepicki/asdf-erlang-prebuilt-ubuntu-24.04.git || true
asdf plugin add elixir
asdf install erlang 28.0.2
asdf set --home erlang 28.0.2
asdf install elixir 1.18.4-otp-28
asdf set --home elixir 1.18.4-otp-28
echo 'export PATH=$HOME/.asdf/shims:$PATH' >> ~/.bashrc
echo 'export HEX_CACERTS_PATH=$CODEX_PROXY_CERT' >> ~/.bashrc
export PATH=$HOME/.asdf/shims:$PATH
export HEX_CACERTS_PATH=$CODEX_PROXY_CERT
# use hex fork with a workaround for httpc bug https://github.com/erlang/otp/issues/10065
mix archive.install --force github 650health/hex branch latest
# mix local.rebar doesn't work on Codex likely because it's not respecting HEX_CACERTS_PATH env var.
# TODO investigate this further
# install rebar manually as a temporary workaround
curl -L -o rebar3 https://s3.amazonaws.com/rebar3/rebar3
chmod +x ./rebar3
./rebar3 local install
export PATH=/root/.cache/rebar3/bin:$PATH
mix local.rebar rebar3 $(which rebar3)

mix deps.get
mix deps.compile
mix compile

I made some tweaks to it for my setup, but that worked! Thank you