I struggled a bit to get a Phoenix + Ash project running tests inside OpenAI’s Codex environment, but I found a setup that works reliably. Several steps run in parallel to keep it fast.
Gist: elixir-phoenix-ash-codex-setup.sh · GitHub
Pay attention: You will need to change "app_dev"
I’ll be really happy to improve it based on your feedback
Has anyone successfully used codex with rustler?
For example, I’m using mdex and am having issues with the http proxy reaching out to github. I think I could precompile the dependencies though I’d prefer not to change my application configuration just for codex.
I’ve verified the same issue with other rustler dependencies as well.
==> mdex
Compiling 3 files (.ex)
12:29:02.476 [debug] Downloading NIF from https://github.com/leandrocp/mdex/releases/download/v0.1.14/libcomrak_nif-v0.1.14-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz
12:29:02.476 [debug] Using HTTP_PROXY: http://proxy:8080
12:29:02.476 [debug] Using HTTPS_PROXY: http://proxy:8080
12:29:02.617 [info] Attempt 1 failed with {:error, "couldn't fetch NIF from https://github.com/leandrocp/mdex/releases/download/v0.1.14/libcomrak_nif-v0.1.14-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz: {:ok, {{~c\"HTTP/1.1\", 503, ~c\"Service Unavailable\"}, [{~c\"date\", ~c\"Mon, 08 Sep 2025 12:29:02 GMT\"}, {~c\"server\", ~c\"envoy\"}, {~c\"content-length\", ~c\"85\"}, {~c\"content-type\", ~c\"text/plain\"}], \"upstream connect error or disconnect/reset before headers. reset reason: remote reset\"}}"}
12:29:04.558 [debug] Downloading NIF from https://github.com/leandrocp/mdex/releases/download/v0.1.14/libcomrak_nif-v0.1.14-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz
12:29:04.558 [debug] Using HTTP_PROXY: http://proxy:8080
12:29:04.558 [debug] Using HTTPS_PROXY: http://proxy:8080
12:29:04.693 [info] Attempt 2 failed with {:error, "couldn't fetch NIF from https://github.com/leandrocp/mdex/releases/download/v0.1.14/libcomrak_nif-v0.1.14-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz: {:ok, {{~c\"HTTP/1.1\", 503, ~c\"Service Unavailable\"}, [{~c\"date\", ~c\"Mon, 08 Sep 2025 12:29:04 GMT\"}, {~c\"server\", ~c\"envoy\"}, {~c\"content-length\", ~c\"85\"}, {~c\"content-type\", ~c\"text/plain\"}], \"upstream connect error or disconnect/reset before headers. reset reason: remote reset\"}}"}
12:29:07.951 [debug] Downloading NIF from https://github.com/leandrocp/mdex/releases/download/v0.1.14/libcomrak_nif-v0.1.14-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz
12:29:07.951 [debug] Using HTTP_PROXY: http://proxy:8080
12:29:07.951 [debug] Using HTTPS_PROXY: http://proxy:8080
12:29:08.030 [info] Attempt 3 failed with {:error, "couldn't fetch NIF from https://github.com/leandrocp/mdex/releases/download/v0.1.14/libcomrak_nif-v0.1.14-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz: {:ok, {{~c\"HTTP/1.1\", 503, ~c\"Service Unavailable\"}, [{~c\"date\", ~c\"Mon, 08 Sep 2025 12:29:07 GMT\"}, {~c\"server\", ~c\"envoy\"}, {~c\"content-length\", ~c\"85\"}, {~c\"content-type\", ~c\"text/plain\"}], \"upstream connect error or disconnect/reset before headers. reset reason: remote reset\"}}"}
Compiling lib/mdex/native.ex (it's taking more than 10s)
12:29:12.743 [debug] Downloading NIF from https://github.com/leandrocp/mdex/releases/download/v0.1.14/libcomrak_nif-v0.1.14-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz
12:29:12.743 [debug] Using HTTP_PROXY: http://proxy:8080
12:29:12.743 [debug] Using HTTPS_PROXY: http://proxy:8080
== Compilation error in file lib/mdex/native.ex ==
** (RuntimeError) Error while downloading precompiled NIF: couldn't fetch NIF from https://github.com/leandrocp/mdex/releases/download/v0.1.14/libcomrak_nif-v0.1.14-nif-2.15-x86_64-unknown-linux-gnu.so.tar.gz: {:ok, {{~c"HTTP/1.1", 503, ~c"Service Unavailable"}, [{~c"date", ~c"Mon, 08 Sep 2025 12:29:12 GMT"}, {~c"server", ~c"envoy"}, {~c"content-length", ~c"85"}, {~c"content-type", ~c"text/plain"}], "upstream connect error or disconnect/reset before headers. reset reason: remote reset"}}.
You can force the project to build from scratch with:
config :rustler_precompiled, :force_build, mdex: true
In order to force the build, you also need to add Rustler as a dependency in your `mix.exs`:
{:rustler, ">= 0.0.0", optional: true}
lib/mdex/native.ex:9: (module)
could not compile dependency :mdex, "mix compile" failed. Errors may have been logged above. You can recompile this dependency with "mix deps.compile mdex --force", update it with "mix deps.update mdex" or clean it with "mix deps.clean mdex"
AFAIK it’s a requirement. All traffic runs through the proxy for security reasons:
Environments run behind an HTTP/HTTPS network proxy for security and abuse prevention purposes. All outbound internet traffic passes through this proxy.
Cloud environments – Codex web | OpenAI Developers (source)
For more context, this is an issue during the “install dependency” phase where internet access is enabled by default.
I see. Well, HTTP 503 can mean anything really, I’ve seen it used in cases where it was actually HTTP 400. No idea, sorry. Don’t have enough context.
I had the following in my setup script from a combination of several answers, which make the agent seemingly running tests and formatting.
install -Dm644 "$CODEX_PROXY_CERT" /usr/local/share/ca-certificates/codex-proxy.crt
update-ca-certificates
echo 'export ERL_SSL_CACERTFILE=/etc/ssl/certs/ca-certificates.crt' >> ~/.bashrc
echo 'export HEX_CACERTS_PATH=/etc/ssl/certs/ca-certificates.crt' >> ~/.bashrc
export ERL_SSL_CACERTFILE=/etc/ssl/certs/ca-certificates.crt
export HEX_CACERTS_PATH=/etc/ssl/certs/ca-certificates.crt
# Downloading patched hex
mix archive.install --force github 650health/hex branch latest
# Install rebar3 manually.
curl -L -o rebar3 https://s3.amazonaws.com/rebar3/rebar3
chmod +x ./rebar3
./rebar3 local install
export PATH=/root/.cache/rebar3/bin:$PATH
mix local.rebar rebar3 $(which rebar3)
mix deps.get
And just the following in my maintenance script.
mix deps.get
I had to enable full internet access though, as it seems that some dependencies were still fetched after the setup step.
The underlying bug has been fixed in OTP and Elixir will work in Codex Cloud with the latest Erlang patches.
We patched erlang/otp httpc module. It has been released in OTP 28.1, 27.3.4.3 and 26.2.5.15. mix deps.get now works as expected since httpc no longer sends the te header for default GET requests.
Thanks @Damirados for the sample using Mise en Place. This works:
# make sure mise + its shims are on PATH now and later
echo 'export PATH=$HOME/.local/bin:$PATH' >> ~/.bashrc
echo 'export PATH=$HOME/.local/share/mise/shims:$PATH' >> ~/.bashrc
echo 'export HEX_CACERTS_PATH=$CODEX_PROXY_CERT' >> ~/.bashrc
export PATH=$HOME/.local/bin:$PATH
export PATH=$HOME/.local/share/mise/shims:$PATH
export HEX_CACERTS_PATH=$CODEX_PROXY_CERT
mise use --global erlang@28.1
mise use --global elixir@1.18.4-otp-28
mix deps.get
mix deps.compile
mix compile
I am still not able to compile, this time due to Cldr it seems.
== Compilation error in file lib/professional_profiles/cldr.ex ==
** (CaseClauseError) no case clause matching: {:error, {:failed_connect, [{:to_address, {~c"raw.githubusercontent.com", 443}}, {:tls, [verify: :verify_peer, cacertfile: ~c"/workspace/app-professional-profiles/_build/test/lib/castore/priv/cacerts.pem", depth: 4, ciphers: [%{prf: :sha256, mac: :aead, cipher: :aes_128_gcm, key_exchange: :any}, %{prf: :sha384, mac: :aead, cipher: :aes_256_gcm, key_exchange: :any}, %{prf: :sha256, mac: :aead, cipher: :chacha20_poly1305, key_exchange: :any}, %{prf: :sha256, mac: :aead, cipher: :aes_128_gcm, key_exchange: :ecdhe_ecdsa}, %{prf: :sha256, mac: :aead, cipher: :aes_128_gcm, key_exchange: :ecdhe_rsa}, %{prf: :sha384, mac: :aead, cipher: :aes_256_gcm, key_exchange: :ecdh_ecdsa}, %{prf: :sha384, mac: :aead, cipher: :aes_256_gcm, key_exchange: :ecdh_rsa}, %{prf: :sha256, mac: :aead, cipher: :chacha20_poly1305, key_exchange: :ecdhe_ecdsa}, %{prf: :sha256, mac: :aead, cipher: :chacha20_poly1305, key_exchange: :ecdhe_rsa}, %{prf: :sha256, mac: :aead, cipher: :aes_128_gcm, key_exchange: :dhe_rsa}, %{prf: :sha384, mac: :aead, cipher: :aes_256_gcm, key_exchange: :dhe_rsa}], versions: [:"tlsv1.2", :"tlsv1.3"], eccs: [:secp384r1, :secp256r1], reuse_sessions: true, server_name_indication: ~c"raw.githubusercontent.com", secure_renegotiate: true, customize_hostname_check: [match_fun: #Function<6.112534691/2 in :public_key.pkix_verify_hostname_match_fun/1>]], {:tls_alert, {:unknown_ca, ~c"TLS client: In state wait_cert_cr at ssl_handshake.erl:2183 generated CLIENT ALERT: Fatal - Unknown CA\n"}}}]}}
(cldr_utils 2.28.3) lib/cldr/http/http.ex:281: Cldr.Http.get_with_headers/2
(cldr_utils 2.28.3) lib/cldr/http/http.ex:120: Cldr.Http.get/2
(ex_cldr 2.43.1) lib/cldr/install.ex:104: Cldr.Install.do_install_locale_name/3
(elixir 1.18.4) lib/enum.ex:987: Enum."-each/2-lists^foreach/1-0-"/2
(ex_cldr 2.43.1) lib/cldr/install.ex:29: Cldr.Install.install_known_locale_names/1
(ex_cldr 2.43.1) lib/cldr.ex:102: Cldr.install_locales/1
(ex_cldr 2.43.1) expanding macro: Cldr.Backend.Compiler.__before_compile__/1
lib/professional_profiles/cldr.ex:1: ProfessionalProfiles.Cldr (module)
This is my ”setup”
cd /workspace/app-professional-profiles
mise install
echo 'export PATH=$HOME/.local/bin:$PATH' >> ~/.bashrc
echo 'export PATH=$HOME/.local/share/mise/shims:$PATH' >> ~/.bashrc
echo 'export HEX_CACERTS_PATH=$CODEX_PROXY_CERT' >> ~/.bashrc
export PATH=$HOME/.local/bin:$PATH
export PATH=$HOME/.local/share/mise/shims:$PATH
export HEX_CACERTS_PATH=$CODEX_PROXY_CERT
# Activate mise for the current session
eval "$(mise activate -q bash)"
mix local.hex --force
mix deps.get
mix test
ex_cldr uses Erlang’s :httpc module to download configured locales at compile time. The error seems to be CLIENT ALERT: Fatal - Unknown CA which is a surprise to me - I’m not even sure which CA is in effect at the time you are compiling (and I am far from knowledgable about CAs). I’ve fixed the case clause error on the development branch but that doesn’t resolve the underlying error.
Ultimately it is Cldr.Http.get/2 that does the work and it has two options you might try to see if you can at least get around the error for now:
CLDR_UNSAFE_HTTPS=true (not recommended for production)config.exs since it’s required for compile time) a different certificate store and see if that connects as expected. The error message indicates you have castore configured and it’s using that libraries certificate store - which is very common. Maybe you can see if there is a later version than what you have installed? There was a new version on August 12th.iex> `Cldr.Http.get("Cldr.Http.get("https://raw.githubusercontent.com/elixir-cldr/cldr/refs/tags/v2.43.2/priv/cldr/locales/en.json")")`
These options are discussed in the documentation but added here to make it hopefully easier for you to access:
If the environment variable CLDR_UNSAFE_HTTPS is
set to anything other than FALSE, false, nil
or NIL then no peer verification of certificates
is performed. Setting this variable is not recommended
but it may be required where peer verification fails for
unidentified reasons. Please open an issue
if this occurs.
In order to keep dependencies to a minimum,
get/1 attempts to locate an already installed
certificate store. It will try to locate a
store in the following order which is intended
to satisfy most host systems. The certificate
store is expected to be a path name on the
host system.
# A certificate store configured by the
# developer
Application.get_env(:ex_cldr, :cacertfile)
# Populated if hex package `CAStore` is configured
CAStore.file_path()
# Populated if hex package `certfi` is configured
:certifi.cacertfile()
# Debian/Ubuntu/Gentoo etc.
"/etc/ssl/certs/ca-certificates.crt",
# Fedora/RHEL 6
"/etc/pki/tls/certs/ca-bundle.crt",
# OpenSUSE
"/etc/ssl/ca-bundle.pem",
# OpenELEC
"/etc/pki/tls/cacert.pem",
# CentOS/RHEL 7
"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem",
# Open SSL on MacOS
"/usr/local/etc/openssl/cert.pem",
# MacOS & Alpine Linux
"/etc/ssl/cert.pem"