LCORE-1253: Add e2e proxy and TLS networking tests

docs/e2e_scenarios.md

@@ -116,6 +116,14 @@
 * Check if models can be filtered
 * Check if filtering can return empty list of models
 
+## [`proxy.feature`](https://github.com/lightspeed-core/lightspeed-stack/blob/main/tests/e2e/features/proxy.feature)
+
+* Traffic is routed through a configured tunnel proxy
+* Interception proxy works with correct CA certificate
+* TLS security profile is applied to outgoing connections
+* ModernType TLS profile enforces TLS 1.3
+* Connection fails when proxy is unreachable
+
 ## [`query.feature`](https://github.com/lightspeed-core/lightspeed-stack/blob/main/tests/e2e/features/query.feature)
 
 * Check if LLM responds properly to restrictive system prompt to sent question with different system prompt

docs/e2e_testing.md

@@ -190,6 +190,11 @@ All tag behaviour is implemented in **`features/environment.py`**: the hooks (`b
 | `@RHIdentity`                   | Feature-level: use RH identity config; restore in after_feature.                                                                                        |
 | `@Feedback`                     | Feature-level: set feedback conversation list; after_feature deletes those conversations.                                                               |
 | `@MCP`                          | Feature-level: use MCP config; restore in after_feature.                                                                                                |
+| `@Proxy`                        | Feature-level: proxy networking tests. Starts test proxies (tunnel/interception) and configures the stack to route through them.                        |
+| `@TunnelProxy`                  | Scenario-level: uses a tunnel proxy (HTTP CONNECT) for the test.                                                                                        |
+| `@InterceptionProxy`            | Scenario-level: uses a TLS-intercepting proxy with trustme CA for the test.                                                                             |
+| `@TLSProfile`                   | Scenario-level: configures a TLS security profile for outgoing connections.                                                                              |
+| `@NegativeProxy`                | Scenario-level: tests failure cases (unreachable proxy, wrong CA, etc.).                                                                                 |
 
 
 ### Multiple Tags and Skip Comment

pyproject.toml

@@ -126,6 +126,7 @@ dev = [
     "ruff>=0.11.13",
     "aiosqlite",
     "behave>=1.3.0",
+    "trustme>=1.2.1",
     "types-cachetools>=6.1.0.20250717",
     "build>=1.2.2.post1",
     "twine>=6.1.0",

tests/e2e/configuration/server-mode/lightspeed-stack-proxy.yaml

@@ -0,0 +1,26 @@
+name: Lightspeed Core Service (LCS) - Proxy test
+service:
+  host: 0.0.0.0
+  port: 8080
+  auth_enabled: false
+  workers: 1
+  color_log: true
+  access_log: true
+llama_stack:
+  use_as_library_client: false
+  url: http://llama-stack:8321
+  api_key: xyzzy
+networking:
+  proxy:
+    https_proxy: http://127.0.0.1:8888
+    no_proxy: localhost,127.0.0.1
+  tls_security_profile:
+    type: IntermediateType
+user_data_collection:
+  feedback_enabled: false
+  transcripts_enabled: false
+authentication:
+  module: "noop"
+inference:
+  default_provider: openai
+  default_model: gpt-4o-mini

tests/e2e/features/proxy.feature

@@ -0,0 +1,50 @@
+@Proxy
+@skip-in-library-mode
+Feature: Proxy and TLS networking tests
+
+  Verify that the Lightspeed Stack correctly routes outgoing traffic
+  through configured proxies and enforces TLS security profiles.
+
+  Background:
+    Given The service is started locally
+      And REST API service prefix is /v1
+
+  # Proxy-restart scenarios require HTTPS endpoints for CONNECT tunneling.
+  # In local testing, Llama Stack is HTTP-only, so these are skipped.
+  # Proxy routing is verified in tests/integration/test_proxy_networking.py.
+  @TunnelProxy
+  @skip
+  Scenario: Traffic is routed through a configured tunnel proxy
+    Given A tunnel proxy is running on port 8888
+      And The lightspeed-stack is configured to use the tunnel proxy
+     When I access endpoint "readiness" using HTTP GET method
+     Then The status code of the response is 200
+      And The tunnel proxy handled at least 1 CONNECT request
+
+  @InterceptionProxy
+  @skip
+  Scenario: Interception proxy works with correct CA certificate
+    Given An interception proxy with trustme CA is running on port 8889
+      And The lightspeed-stack is configured to use the interception proxy with CA cert
+     When I access endpoint "readiness" using HTTP GET method
+     Then The status code of the response is 200
+      And The interception proxy intercepted at least 1 connection
+
+  @TLSProfile
+  Scenario: TLS security profile is applied to outgoing connections
+    Given The lightspeed-stack is configured with TLS profile "IntermediateType"
+     When I access endpoint "readiness" using HTTP GET method
+     Then The status code of the response is 200
+
+  @TLSProfile
+  Scenario: ModernType TLS profile enforces TLS 1.3
+    Given The lightspeed-stack is configured with TLS profile "ModernType"
+     When I access endpoint "readiness" using HTTP GET method
+     Then The status code of the response is 200
+
+  @NegativeProxy
+  @skip
+  Scenario: Connection fails when proxy is unreachable
+    Given The lightspeed-stack is configured with unreachable proxy "http://127.0.0.1:19999"
+     When I send a query "hello" and expect failure
+     Then The response indicates a connection error