Cannot download connector templates when raw.githubusercontent.com is blocked

[yT0n1]

Describe the bug

Downloading connector templates from the Marketplace fails when the customer environment blocks outbound access to raw.githubusercontent.com.

The Marketplace can be reachable and connector listings can load, but the connector download fails because many connector and blueprint resources are hosted on GitHub's raw-content endpoint.

Steps to reproduce

1. Download Desktop Modeler.
2. Configure outbound network restrictions that block raw.githubusercontent.com.
3. Open Modeler
4. Download of element templates fails. Same for c8ctl.

Expected behavior

The connector download should either:

• Succeed through a supported Camunda endpoint or configurable proxy/mirror, or
• Fail with a clear, actionable error identifying the required endpoint and the network configuration needed.

Actual behavior

The connector template download fails, even though the Marketplace itself may be accessible. Depending on the flow, users may see a generic upload/download or offline error without being told that the raw GitHub endpoint is blocked.

Impact

Self-Managed installations with restrictive outbound network policies cannot reliably install connector templates from the Marketplace. This particularly affects installations where Marketplace access is allowlisted but the underlying connector resource host is not.

Suggested direction

Consider one or more of the following:

• Proxy connector and blueprint resources through a Camunda-controlled endpoint or a proper artifact repository (eg. npm or artifactory, generally things that might be mirrored)
• Make the connector resource base URL configurable for Self-Managed deployments.
• ...

Related support tickets

• SUPPORT-28612
• SUPPORT-29034

Environment

• Product: Desktop Modeler, c8ctl
• Component:Marketplace connector templates
• Network: Restricted outbound access
• Affected resource host: raw.githubusercontent.com

[crobbins215]

🔗 Related context

Scoped description: The blocked host is not incidental to the Marketplace, it is what the Marketplace serves. This repo's root connector-templates.json is the index the Marketplace API consumes, and all 609 ref entries in it are absolute https://raw.githubusercontent.com/camunda/connectors/<commit-sha>/... URLs. That base URL is hard-coded in the generator at element-template-generator/uniquet/src/main/java/io/camunda/connector/uniquet/core/IndexWriter.java:57 and baked in at index build time by .github/workflows/RUN_UNIQUET.yml. Desktop Modeler fetches OOTB templates on startup and then every 24 hours via marketplace.cloud.camunda.io/api/v1/connectors and /connectors/{templateId}, whose response bodies carry those raw GitHub links for the client to follow, so allowlisting the Marketplace host alone still leaves the actual template download failing. Current behaviour is therefore: Marketplace reachable, listings load, download fails, with no error naming the host that was refused. Documented options today are workarounds only, namely disabling auto-fetch with the disable-connector-templates flag and supplying templates through the local search paths, or taking the per-release element-templates asset from a connectors GitHub release. Worth knowing before scoping: the "proxy through a Camunda endpoint" direction is partly built already, since marketplace-api moved OOTB links towards api/v1/ootb-connector/{connector-id}/latest/{name}.json, so the remaining question may be whether that endpoint streams the template body or still redirects the client to raw.githubusercontent.com. Note also that the fix likely lands mostly outside this repo, in marketplace-api/camunda-hub and Modeler, with this repo owning the index generation and the base URL it emits.

Feature request: Covered in Productboard as WIP: Build Connector Templates in an Offline Environment, currently at "New idea", owned by Bastian Körber. The adjacent Camunda-Provided Connector Templates in the Desktop Modeler is marked Done and is useful background on what Modeler already bundles.

Prior discussion: The same restricted-network scenario was answered in #ask-modeler in April 2025, where the only two options offered to the customer were allowlisting the Marketplace endpoints or shipping templates alongside the executable with fetching disabled. The proxy direction was proposed in #team-connectors in July 2025: resolve by connector ID against connector-templates.json and expose /ootb-connectors/{element-template-id}/latest, which fetches from GitHub server side so clients get stable Camunda-hosted links.

💬 Suggested prompt for working this issue:

You are a Camunda Connectors engineer working on issue #8339 in the connectors-experience backlog.
Issue: Cannot download connector templates when raw.githubusercontent.com is blocked
What's needed: Self-Managed environments that block raw.githubusercontent.com cannot install connector templates, because every ref in the repo's root connector-templates.json (609 of them) is an absolute raw GitHub URL that the Marketplace API passes to the client to fetch. Decide and implement one of: (a) serve template bodies through a Camunda-controlled endpoint so no client ever contacts GitHub, building on the existing api/v1/ootb-connector/{connector-id}/latest/{name}.json work in marketplace-api, (b) make the resource base URL configurable for Self-Managed so it can point at a mirror or artifact repository, or (c) at minimum, fail with an error that names the blocked host and the endpoints that must be reachable. First confirm which hop actually fails, that is whether the current ootb-connector endpoint returns the template body or redirects to raw.githubusercontent.com, since that determines whether this is a connectors-repo change at all.
Relevant docs: https://docs.camunda.io/docs/components/modeler/desktop-modeler/use-connectors/ (automatic fetching, its 24 hour cycle, and the disable-connector-templates flag), https://docs.camunda.io/docs/components/modeler/desktop-modeler/element-templates/configuring-templates/ (local search paths, the current manual workaround), https://docs.camunda.io/docs/components/modeler/web-modeler/modeling/camunda-marketplace/ (Web Modeler download flow), https://docs.camunda.io/docs/self-managed/components/connectors/http-proxy-configuration/ (existing proxy configuration pattern for connectors, useful precedent for a configurable option)
Relevant files: connector-templates.json (the generated index the Marketplace consumes; all refs are raw GitHub URLs), element-template-generator/uniquet/src/main/java/io/camunda/connector/uniquet/core/IndexWriter.java:57 (hard-codes the https://raw.githubusercontent.com/camunda/connectors/<sha>/ base), element-template-generator/uniquet/README.md, .github/workflows/RUN_UNIQUET.yml (regenerates the index). The serving side lives in marketplace-api/camunda-hub rather than here, so expect a cross-repo change.
Constraints: Follow existing code style. Any base-URL change must keep existing refs resolvable for already-published templates, since the index is commit-pinned. Confirm which component performs the failing fetch before changing the index format, and flag anything uncertain rather than guessing.

---

Generated by Claude Code