Skip to content

Commit 661eaba

Browse files
robbinparrishrobbinparrish
committed
Initial commit for squid-proxy-deployment.
0 parents  commit 661eaba

20 files changed

+533
-0
lines changed

‎.dockerignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.git*

‎.gitignore

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#
2+
# .gitignore file - Ignore everything and recursive allow them.
3+
#
4+
5+
#
6+
# Ignore everything.
7+
#
8+
*
9+
10+
#
11+
# Recursive allow.
12+
#
13+
!.gitignore
14+
!README.md
15+
!docker-compose.yml
16+
!Dockerfile
17+
!.dockerignore
18+
!configs
19+
!configs/
20+
!configs/automatic-backup/
21+
!configs/automatic-backup/squid-proxy-deployment-backup.*
22+
!configs/automatic-backup/README.md
23+
!configs/backup-and-restore.md
24+
!configs/upgrading-squid.md
25+
!configs/user-based-authentication.md
26+
!configs/certificate-based-authentication.md
27+
!configs/site-based-access.md
28+
!configs/caching-configuration.md
29+
!configs/squid.conf
30+
!configs/squid.conf.d
31+
!configs/squid.conf.d/*.conf

‎Dockerfile

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
FROM alpine:3.19
2+
3+
ENV TZ=UTC
4+
5+
RUN apk update && \
6+
apk add --no-cache \
7+
squid openssl ca-certificates curl wget \
8+
apache2-utils tar zip unzip gzip && \
9+
mkdir -p /etc/squid/conf.d/ && \
10+
touch /etc/squid/conf.d/00-default.conf && \
11+
addgroup squid tty
12+
13+
ADD configs/squid.conf /etc/squid/squid.conf
14+
15+
ENV HOME /etc/squid
16+
WORKDIR /etc/squid
17+
18+
CMD squid -k parse && \
19+
if [ -f /var/run/squid.pid ] ; then rm -f /var/run/squid.pid ; else true ; fi && \
20+
if [ ! -d /var/spool/squid/00 ] ; then squid -N -f /etc/squid/squid.conf -z ; else true ; fi && \
21+
squid -f /etc/squid/squid.conf -NYC

‎README.md

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
## Disclaimer.
2+
The content on this account/repository provided solely for educational and informational purposes.
3+
It is not intended for use in making any kind of business, investment and/or legal decisions.
4+
Although every effort has been made to keep the information up-to-date and accurate, no representations and/or warranties, express and/or implied, completeness, accuracy, reliability, suitability, and/or availability of the content.
5+
6+
## Squid.
7+
This can be used to setup a Squid Server as a Forwarding and Caching Proxy.
8+
Squid - https://www.squid-cache.org/Doc/
9+
10+
## Docker Compose Version.
11+
Always validate that [docker-compose](https://github.com/docker/compose/releases/) version is latest.
12+
If not then use the latest released version. As of updating this document `v2.24.0` was latest released version.
13+
14+
### Starting the container.
15+
```bash
16+
docker-compose up -d
17+
```
18+
19+
### Checking the container logs.
20+
```bash
21+
docker-compose logs -f
22+
```
23+
24+
### Initial configuration validation.
25+
As the default configuration provided here is sufficient as it provides default access to private network. We can validate this with curl.
26+
```bash
27+
# Check that access is allowed for any website with port 80 (http) or 443 (https).
28+
# This should work.
29+
curl --proxy http://127.0.0.1:3128 http://SOME_HTTP_WEBSITE
30+
curl --proxy http://127.0.0.1:3128 https://SOME_HTTPS_WEBSITE
31+
32+
# Check that access is blocked for any website with some other ports (eg. 8443).
33+
# This should not work.
34+
curl --proxy http://127.0.0.1:3128 https://SOME_HTTPS_WEBSITE:8443
35+
```
36+
37+
### Additional configuration setup.
38+
39+
[Documentation Config](https://www.squid-cache.org/Doc/config/)
40+
41+
[Configure User based authentication](./configs/user-based-authentication.md)
42+
43+
[Configure Certificate based authentication](./configs/certificate-based-authentication.md)
44+
45+
[Configure Site based access](./configs/site-based-access.md)
46+
47+
[Configure Caching](./configs/caching-configuration.md)
48+
49+
[Backup and Restore](./configs/backup-and-restore.md)
50+
51+
[Upgrading Squid](./configs/upgrading-squid.md)

‎configs/automatic-backup/README.md

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Perform an automatic backup of Squid Deployment.
2+
3+
## Copy backup script.
4+
```bash
5+
cp -a squid-proxy-deployment-backup.sh /usr/bin/
6+
chmod +x /usr/bin/squid-proxy-deployment-backup.sh
7+
```
8+
9+
## Update the configuration path in the backup script.
10+
Update following in `/usr/bin/squid-proxy-deployment-backup.sh`
11+
```
12+
SQUID_DEPLOYMENT_DIR="${HOME}/squid-proxy-deployment"
13+
SQUID_DEPLOYMENT_BACKUP_PATH="${HOME}/squid-proxy-deployment-backup"
14+
```
15+
16+
## Copy systemd unit and timer files.
17+
```bash
18+
cp squid-proxy-deployment-backup.timer squid-proxy-deployment-backup.service /etc/systemd/system/
19+
```
20+
21+
## Enable the timer.
22+
```bash
23+
systemctl daemon-reload
24+
systemctl enable --now squid-proxy-deployment-backup.timer
25+
```

‎configs/automatic-backup/squid-proxy-deployment-backup.service

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[Unit]
2+
Description=Squid Deployment Backup
3+
4+
[Service]
5+
ExecStart=/usr/bin/squid-proxy-deployment-backup.sh

‎configs/automatic-backup/squid-proxy-deployment-backup.sh

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
# Path where the Squid deployment is configured.
4+
# NEED TO REPLACE THEASE TO CORRECT PATH.
5+
SQUID_DEPLOYMENT_DIR="${HOME}/squid-proxy-deployment"
6+
SQUID_DEPLOYMENT_BACKUP_PATH="${HOME}/squid-proxy-deployment-backup"
7+
8+
# Backup directory.
9+
BACKUP_TIME=$(date "+%d%m%Y%H%M%S")
10+
SQUID_DEPLOYMENT_BACKUP_DIR="${SQUID_DEPLOYMENT_BACKUP_PATH}/${BACKUP_TIME}"
11+
12+
cd "${SQUID_DEPLOYMENT_DIR}" || exit 1
13+
14+
# Backup configuration files.
15+
mkdir -p "${SQUID_DEPLOYMENT_BACKUP_DIR}"
16+
cp -av ./squid-data/cache-dir ./configs/squid.conf ./configs/squid.conf.d "${SQUID_DEPLOYMENT_BACKUP_DIR}"/
17+
sync
18+
19+
# Compress the backup.
20+
cd "${SQUID_DEPLOYMENT_BACKUP_PATH}" || exit 1
21+
tar -cvzf "${BACKUP_TIME}".tar.gz "${BACKUP_TIME}"
22+
rm -rf "${BACKUP_TIME}"
23+
sync

‎configs/automatic-backup/squid-proxy-deployment-backup.timer

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
[Unit]
2+
Description=Squid Deployment Backup
3+
4+
[Timer]
5+
# Run every night at 1 AM.
6+
OnCalendar=*-*-* 01:00:00
7+
Unit=squid-proxy-deployment-backup.service
8+
9+
[Install]
10+
WantedBy=timers.target

‎configs/backup-and-restore.md

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
## Backup and Restore.
2+
3+
### Backup Squid instance.
4+
Since Squid stores all data in the configuration files so we will just need to backup the all configuration files.
5+
6+
For the backup following directories must be `manually` backed up.
7+
```
8+
./squid-data/cache-dir
9+
./configs/squid.conf
10+
./configs/squid.conf.d
11+
```
12+
13+
#### Triggering Backup.
14+
Run following command to trigger the backup.
15+
This will copy all the configuration files in the `./squid-data/backups` directory.
16+
```bash
17+
cp -a ./squid-data/cache-dir ./configs/squid.conf ./configs/squid.conf.d ./squid-data/backups/
18+
```
19+
20+
#### Triggering Restore.
21+
Followings conditions must be met for restore.
22+
- A working Squid instance.
23+
24+
#### Restore.
25+
- Stop the Squid container.
26+
```bash
27+
docker-compose down squid
28+
```
29+
30+
- Restore/Copy the configuration files.
31+
```
32+
First remove existing directories.
33+
./squid-data/cache-dir
34+
./configs/squid.conf
35+
./configs/squid.conf.d
36+
37+
Now copy backed up directories.
38+
Copy cache-dir to ./squid-data/cache-dir
39+
Copy squid.conf to ./configs/squid.conf
40+
Copy squid.conf.d to ./configs/squid.conf.d
41+
```
42+
43+
### Stop all the container.
44+
```
45+
docker-compose down
46+
```
47+
48+
### Starting the container.
49+
```
50+
docker-compose up -d
51+
```
52+
53+
### Checking the container logs.
54+
```
55+
docker-compose logs -f
56+
```
57+
58+
[Automatic Backup Setup](./automatic-backup/README.md)

‎configs/caching-configuration.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
## Caching Configuration.
2+
3+
The default configuration provided here does not includes Caching functionality. This can be easily configured here.
4+
5+
### Enable Caching Configuration.
6+
First enable the caching in [Caching Configuration](./squid.conf.d/caching-configuration.conf) file. We will need to `uncomment` the lines those enable the caching.
7+
8+
### Create Cache directory..
9+
```bash
10+
docker-compose exec -it squid chown -R squid.squid /var/spool/squid
11+
```
12+
13+
### Restart the container.
14+
```bash
15+
docker-compose restart
16+
```
17+
18+
### Initial configuration validation.
19+
As this configuration enable the Caching of any contents. We can validate this with curl.
20+
```bash
21+
# Check the Caching storage information.
22+
du -sh ./squid-data/cache-dir/
23+
24+
# Download a file, the first time it will take some time.
25+
curl --proxy http://127.0.0.1:3128 SOME_FILE_URL -o SOME_FILE_NAME
26+
27+
# Download the same file again. this time it should get downloaded from Cached contents.
28+
curl --proxy http://127.0.0.1:3128 SOME_FILE_URL -o SOME_FILE_NAME
29+
30+
# Check the Caching storage information.
31+
du -sh ./squid-data/cache-dir/
32+
```
33+
34+
### Purging the Cache.
35+
```bash
36+
docker-compose exec -it squid rm -rf /var/spool/squid/*
37+
```

‎configs/certificate-based-authentication.md

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
## Certificate based authentication.
2+
3+
The default configuration provided here does not includes Certificate based authentication. This can be easily configured here.
4+
https://wiki.squid-cache.org/ConfigExamples/Intercept/SslBumpExplicit
5+
6+
For this we will need to create RootCA that will be used to intercept the SSL certificates of https sites.
7+
8+
### Generate RootCA.
9+
```bash
10+
openssl genrsa -out ./configs/squid.conf.d/Squid-RootCA.key 4096
11+
openssl req -x509 -new -nodes -key ./configs/squid.conf.d/Squid-RootCA.key -days 365 -out ./configs/squid.conf.d/Squid-RootCA.crt -subj '/CN=Squid Root CA/C=/ST=/L=/O=Squid RootCA'
12+
```
13+
14+
### Enable Certificate based authentication.
15+
First enable the certificate based authentication in [Certificate Based Authentication](squid.conf.d/certificate-based-authentication.conf) file. We will need to `uncomment` the lines those enable the authentication.
16+
17+
### Disable default configuration.
18+
We will need to comment out the default `http_port 3128` line in [Squid.conf](./squid.conf) file. Along with this, if requires then we can enable the [User based authentication](./user-based-authentication.md). This will make sure that every access must provide the user authentication. For https requests must provide the RootCA along with user authentication.
19+
20+
### Create SSL certificate database.
21+
```bash
22+
docker-compose exec -it squid /usr/lib/squid/security_file_certgen -c -s /etc/squid/conf.d/ssl_db -M 4MB
23+
docker-compose exec -it squid chown -R squid.squid /etc/squid/conf.d/ssl_db
24+
```
25+
26+
### Restart the container.
27+
```bash
28+
docker-compose restart
29+
```
30+
31+
### Initial configuration validation.
32+
As this configuration require a certificate based authentication. We can validate this with curl.
33+
```bash
34+
# Access a website with certificate authentication.
35+
# Here we can also check that certificate is issued by Squid-RootCA by using `-v` option in curl.
36+
# This should work.
37+
curl --proxy http://127.0.0.1:3128 --cacert configs/squid.conf.d/Squid-RootCA.crt https://SOME_HTTPS_WEBSITE
38+
39+
# Access a website without certificate authentication.
40+
# This should not work.
41+
curl --proxy http://127.0.0.1:3128 https://SOME_HTTPS_WEBSITE
42+
```

‎configs/site-based-access.md

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
## Site based access configuration.
2+
3+
The default configuration provided here does not includes site based access configuration. This can be easily configured here.
4+
5+
For this we can create some text files that will contains domain list which need to be either allowed or denied.
6+
7+
### Enable Site based access.
8+
First enable the site based access in [Site Based Access](./squid.conf.d/site-based-access.conf) file. We will need to `uncomment` the lines those enable the authentication.
9+
10+
### Enable site based access for private network.
11+
By default private network will be allowed to access squid server without any site based access. To enable site based access for private network comment out `http_access allow private-network` line in [Squid.conf](./squid.conf) file.
12+
13+
### Allowed domain list.
14+
Create a file that will contain all domain names which are in allowed list.
15+
```bash
16+
touch ./configs/squid.conf.d/allowed_urls.txt
17+
# Add all domain names in the file.
18+
```
19+
20+
### Denied domain list.
21+
Create a file that will contain all domain names which are in denied list.
22+
```bash
23+
touch ./configs/squid.conf.d/denied_urls.txt
24+
# Add all domain names in the file.
25+
```
26+
27+
### Restart the container.
28+
```bash
29+
docker-compose restart
30+
```
31+
32+
### Initial configuration validation.
33+
As this configuration allow and deny certain domain names. We can validate this with curl.
34+
```bash
35+
# Access a website from allowed list.
36+
# This should work.
37+
curl --proxy http://127.0.0.1:3128 https://SOME_ALLOWED_HTTPS_WEBSITE
38+
39+
# Access a website from denied list.
40+
# This should not work.
41+
curl --proxy http://127.0.0.1:3128 https://SOME_DENIED_HTTPS_WEBSITE
42+
```

0 commit comments

Comments
 (0)