diff --git a/data/templates/system/proxy.j2 b/data/templates/system/proxy.j2
new file mode 100644
index 000000000..215c4c5c2
--- /dev/null
+++ b/data/templates/system/proxy.j2
@@ -0,0 +1,7 @@
+# generated by system-proxy.py
+{% if url is vyos_defined and port is vyos_defined %}
+{# remove http:// prefix so we can inject a username/password if present #}
+export http_proxy=http://{{ username ~ ':' ~ password ~ '@' if username is vyos_defined and password is vyos_defined }}{{ url | replace('http://', '') }}:{{ port }}
+export https_proxy=$http_proxy
+export ftp_proxy=$http_proxy
+{% endif %}
diff --git a/src/conf_mode/system-proxy.py b/src/conf_mode/system-proxy.py
index 02536c2ab..079c43e7e 100755
--- a/src/conf_mode/system-proxy.py
+++ b/src/conf_mode/system-proxy.py
@@ -1,95 +1,71 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018 VyOS maintainers and contributors
+# Copyright (C) 2018-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-#
 
-import sys
 import os
-import re
 
-from vyos import ConfigError
-from vyos.config import Config
+from sys import exit
 
+from vyos.config import Config
+from vyos.template import render
+from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
 proxy_def = r'/etc/profile.d/vyos-system-proxy.sh'
 
-
-def get_config():
-    c = Config()
-    if not c.exists('system proxy'):
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'proxy']
+    if not conf.exists(base):
         return None
 
-    c.set_level('system proxy')
+    proxy = conf.get_config_dict(base, get_first_key=True)
+    return proxy
 
-    cnf = {
-        'url': None,
-      'port': None,
-      'usr': None,
-      'passwd': None
-    }
+def verify(proxy):
+    if not proxy:
+        return
 
-    if c.exists('url'):
-        cnf['url'] = c.return_value('url')
-    if c.exists('port'):
-        cnf['port'] = c.return_value('port')
-    if c.exists('username'):
-        cnf['usr'] = c.return_value('username')
-    if c.exists('password'):
-        cnf['passwd'] = c.return_value('password')
+    if 'url' not in proxy or 'port' not in proxy:
+        raise ConfigError('Proxy URL and port require a value')
 
-    return cnf
+    if ('username' in proxy and 'password' not in proxy) or \
+       ('username' not in proxy and 'password' in proxy):
+       raise ConfigError('Both username and password need to be defined!')
 
+def generate(proxy):
+    if not proxy:
+        if os.path.isfile(proxy_def):
+            os.unlink(proxy_def)
+        return
 
-def verify(c):
-    if not c:
-        return None
-    if not c['url'] or not c['port']:
-        raise ConfigError("proxy url and port requires a value")
-    elif c['usr'] and not c['passwd']:
-        raise ConfigError("proxy password requires a value")
-    elif not c['usr'] and c['passwd']:
-        raise ConfigError("proxy username requires a value")
-
+    render(proxy_def, 'system/proxy.j2', proxy, permission=0o755)
 
-def generate(c):
-    if not c:
-        return None
-    if not c['usr']:
-        return str("export http_proxy={url}:{port}\nexport https_proxy=$http_proxy\nexport ftp_proxy=$http_proxy"
-                   .format(url=c['url'], port=c['port']))
-    else:
-        return str("export http_proxy=http://{usr}:{passwd}@{url}:{port}\nexport https_proxy=$http_proxy\nexport ftp_proxy=$http_proxy"
-                   .format(url=re.sub('http://', '', c['url']), port=c['port'], usr=c['usr'], passwd=c['passwd']))
-
-
-def apply(ln):
-    if not ln and os.path.exists(proxy_def):
-        os.remove(proxy_def)
-    else:
-        open(proxy_def, 'w').write(
-            "# generated by system-proxy.py\n{}\n".format(ln))
+def apply(proxy):
+    pass
 
 if __name__ == '__main__':
     try:
         c = get_config()
         verify(c)
-        ln = generate(c)
-        apply(ln)
+        generate(c)
+        apply(c)
     except ConfigError as e:
         print(e)
-        sys.exit(1)
+        exit(1)