First, there is no such reference to proxy/proxying being mentioned in the AGPL, so whether or not a proxy is used in the chain that allows an external user to access features of an AGPL-licensed package does not make much of a difference to me. For instance network traffic will likely go through several routers and proxies even if I am not using a fronting proxy myself.
- Is this legal [when used unmodified]?
Yes, there is no reason why this would not be OK. But I guess the implied question may be what should I do then to comply with the AGPL?. If there is any notice or link or mechanism in the original software that ends up in the packets that I proxy, I would keep these and make these available to my end users in a way that is equivalent to a non-proxied access. I would also (though it is not a clear requirement when the code is used unmodified) provide some credits notice and the license text of the AGPL in the UI of my app.
After the company makes changes to the AGPL software on server A,
2.Is it then legal?
3.Does the company need to release the changes it made back to the community?
It was OK before and it is still OK now: proxying does not have any impact IMHO. But the modification of the AGPLv3-licensed code will likely trigger the extra requirements of section 13 "Remote Network Interaction".
[...] if you modify the Program, your modified version must prominently offer all
users interacting with it remotely through a computer network (if your version
supports such interaction) an opportunity to receive the Corresponding Source
of your version by providing access to the Corresponding Source from a network
server at no charge, through some standard or customary means of facilitating
copying of software.[...]
Therefore, and again IMHO irrespective of proxying, I would notify my users of the modifications (in addition to what I was doing without the mods as explained above) and I would provide them with a mechanism to get access to source code that includes my modifications, most likely with a link to download an archive of the corresponding source code. Here I would not worry about the community at large (though it would be a nice thing to do) but instead ensure that my users have access to this download.
Just as a follow up. In the Preamble of the AGPL it is said: Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version. Since in this example server A is not publicly accessible, wouldn't allow this the hypothetical company to keep it's changes for itself?
The AGPL "Preamble" is not part of the T&C but is not something to ignore entirely. Yet this is a different context we have here: say I use a modified version of MongoDB strictly internally in my organization: I have no special obligations IMHO.
If this becomes available externally outside my organization, such as to a customer this is no longer internal use, even if this is not "public" use in the sense that only my customers can access it and not the "general public".