For the sake of comparing notes, here’s my experience trying to get mix deps.get working in a Codex environment. It looks like I’m hitting a proxy wall too.

Based on Codex’s documentation on internet access and proxies, here’s what I tried after installing Elixir via asdf:

1. Set all the recommended proxy and cert env vars:

   export http_proxy="http://proxy:8080"
   export https_proxy="http://proxy:8080"
   export SSL_CERT_FILE="$CODEX_PROXY_CERT"
   export REQUESTS_CA_BUNDLE="$CODEX_PROXY_CERT"
   export HEX_CACERTS_PATH="$CODEX_PROXY_CERT"
   export HEX_HTTP_CONCURRENCY=1
   

2. Installed Hex manually (since mix local.hex --force fails with a 503):

   mix archive.install github hexpm/hex --branch latest --force
   

3. Ran mix deps.get and got this repeated error:

   upstream connect error or disconnect/reset before headers. reset reason: connection termination
   

It looks like repo.hex.pm is getting blocked entirely, or the TLS handshake is being dropped by the proxy. Even with HEX_CACERTS_PATH pointing to the Codex proxy cert, the connection fails before it completes.

I noticed the docs say:

Environments are pre-configured to work with common tools and package managers

So I’m guessing Hex just isn’t allowed yet the way pip, npm, and others are.

Would love to get this working. Happy to test more or compare setups.

FWIW here’s my full script up until I try doing mix local.hex --force

#!/usr/bin/env bash
# bootstrap_asdf_prebuilt.sh – pulls binary OTP builds, so no C tool-chain needed
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive

# 1. Runtime-only libs (<< 10 MB total)
apt-get update -qq
apt-get install -y --no-install-recommends libssl3 zlib1g libncurses6
rm -rf /var/lib/apt/lists/*

# 2. asdf (same as before, but no gcc/make)
git clone -q https://github.com/asdf-vm/asdf.git /opt/asdf --branch v0.14.1
echo '. /opt/asdf/asdf.sh' >> /etc/bash.bashrc
. /opt/asdf/asdf.sh

# 3. **Pre-built** plugin for Erlang
asdf plugin add erlang https://github.com/michallepicki/asdf-erlang-prebuilt-ubuntu-24.04.git || true
asdf plugin add elixir
asdf plugin add nodejs

# 4. Honour your .tool-versions file
asdf install
asdf reshim

echo "🔥 OTP and Elixir installed"

export http_proxy="http://proxy:8080"
export https_proxy="http://proxy:8080"
export SSL_CERT_FILE="$CODEX_PROXY_CERT"
export REQUESTS_CA_BUNDLE="$CODEX_PROXY_CERT"
export HEX_CACERTS_PATH="$CODEX_PROXY_CERT"
export HEX_HTTP_CONCURRENCY=1

The underlying bug has been fixed in OTP and Elixir will work in Codex Cloud with the latest Erlang patches.

We patched erlang/otp httpc module. It has been released in OTP 28.1, 27.3.4.3 and 26.2.5.15. mix deps.get now works as expected since httpc no longer sends the te header for default GET requests.

Thanks @Damirados for the sample using Mise en Place. This works:

# make sure mise + its shims are on PATH now and later
echo 'export PATH=$HOME/.local/bin:$PATH' >> ~/.bashrc
echo 'export PATH=$HOME/.local/share/mise/shims:$PATH' >> ~/.bashrc
echo 'export HEX_CACERTS_PATH=$CODEX_PROXY_CERT' >> ~/.bashrc
export PATH=$HOME/.local/bin:$PATH
export PATH=$HOME/.local/share/mise/shims:$PATH
export HEX_CACERTS_PATH=$CODEX_PROXY_CERT

mise use --global erlang@28.1
mise use --global elixir@1.18.4-otp-28

mix deps.get
mix deps.compile
mix compile

Success! After spending a few hours with ChatGPT o3, I have finally managed to cast an incantation that seems to work! Some of the steps might be not necessary, and I might play with the script some more to experiment what can be safely removed.

TL;DR of the two critical steps:

• Need to compile Erlang with the right certificates (just using the binaries doesn’t seem to work). That’s unfortunate, as compiling Erlang takes the most amount of time (be patient!)
• Need to use a different Hex proxy jsDeliver from Mirrors | Hex; the official one doesn’t seem to work

Here is the script - let me know if it works for you, and how we can eliminate the unnecessary settings.