diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..bbdc71e --- /dev/null +++ b/Dockerfile @@ -0,0 +1,123 @@ +FROM registry.cer.ssaim.dnum.minint.fr/images/internet/debian:buster + +ENV SQUID_CACHE_DIR=/var/spool/squid \ + SQUID_LOG_DIR=/var/log/squid \ + SQUID_USER=proxy \ + SQUID_VERSION=4.14 + +WORKDIR /tmp + +RUN apt-get update && apt-get --no-install-recommends -y build-dep squid && apt-get install --no-install-recommends -y wget tar xz-utils libssl-dev libssl1.1 \ + && mkdir squid && wget http://www.squid-cache.org/Versions/v4/squid-$SQUID_VERSION.tar.xz \ + && tar -C squid --strip-components=1 -xvf squid-$SQUID_VERSION.tar.xz \ + && cd squid \ + && ./configure \ + --prefix=/usr \ + --datadir=/usr/share \ + --build=x86_64-linux-gnu \ + --enable-cache-digests \ + --includedir=/usr/include \ + --program-prefix= \ + --libdir=/usr/lib \ + --libexecdir=/usr/lib/squid \ + --localstatedir=/var \ + --sharedstatedir=/usr/com \ + --mandir=/usr/share/man \ + --infodir=/usr/share/info \ + --enable-icap-client \ + --enable-icap-support \ + --enable-async-io \ + --with-pthreads \ + --bindir=/usr/sbin \ + --sbindir=/usr/sbin \ + --with-squid=/usr/lib/squid \ + --disable-ipv6 \ + --enable-ltdl-convenience \ + --disable-ident-lookups \ + --enable-http-violations \ + build_alias="x86_64-linux-gnu" \ + CFLAGS="-g -O2 -g -Wall -O2" \ + LDFLAGS= \ + CPPFLAGS= \ + CXXFLAGS="-g -O2 -g -Wall -O2" \ + --without-netfilter-conntrack \ + --disable-arch-native \ + --enable-follow-x-forwarded-for \ + --enable-ssl \ + --enable-ssl-crtd \ + --with-openssl \ + --enable-storeio="aufs,diskd,ufs" \ + --exec-prefix=/usr \ + --enable-auth-basic="LDAP" \ + --enable-auth-digest="LDAP" \ + --enable-auth-ntlm \ + --enable-auth-negotiate \ + --with-krb5-config=no \ + --without-mit-krb5 \ + --enable-icap-client \ + --sysconfdir=/etc/squid \ + --with-filedescriptors=48000 \ + --enable-delay-pools \ + --with-large-files \ + --enable-removal-policies="lru,heap" \ + && make \ +# Instal + && cd /tmp/squid && apt-get install --no-install-recommends -y libxml2 ca-certificates \ + && adduser --no-create-home --uid 1161 --group --system squid \ + && mkdir -p /usr/lib/squid/errors/French \ + && mkdir -p /usr/lib/squid/icons \ + && mkdir /etc/squid/ \ + && mkdir -p /var/spool/squid \ + && mkdir -p /var/log/squid \ + && cp src/auth/basic/LDAP/basic_ldap_auth /usr/lib/squid/ \ + && cp src/auth/digest/LDAP/digest_ldap_auth /usr/lib/squid/ \ + && cp src/log/DB/log_db_daemon /usr/lib/squid/ \ + && cp src/log/file/log_file_daemon /usr/lib/squid/ \ + && cp src/unlinkd /usr/lib/squid/ \ + && cp src/http/url_rewriters/LFS/url_lfs_rewrite /usr/lib/squid/ \ + && cp src/http/url_rewriters/fake/url_fake_rewrite /usr/lib/squid/ \ + && cp src/http/url_rewriters/fake/url_fake_rewrite.sh /usr/lib/squid/ \ + && cp src/mime.conf.default /usr/lib/squid/ \ + && cp src/security/cert_validators/fake/security_fake_certverify /usr/lib/squid/ \ + && cp src/security/cert_generators/file/security_file_certgen /usr/lib/squid/ \ + && cp src/acl/external/delayer/ext_delayer_acl /usr/lib/squid/ \ + && cp src/acl/external/SQL_session/ext_sql_session_acl /usr/lib/squid/ \ + && cp src/acl/external/wbinfo_group/ext_wbinfo_group_acl /usr/lib/squid/ \ + && cp src/acl/external/LDAP_group/ext_ldap_group_acl /usr/lib/squid/ \ + && cp src/acl/external/eDirectory_userip/ext_edirectory_userip_acl /usr/lib/squid/ \ + && cp src/acl/external/unix_group/ext_unix_group_acl /usr/lib/squid/ \ + && cp src/store/id_rewriters/file/storeid_file_rewrite /usr/lib/squid/ \ + && cp src/DiskIO/DiskDaemon/diskd /usr/lib/squid/ \ + && cp -r icons/silk/ /usr/lib/squid/icons/silk/ \ + && cp icons/*.png /usr/lib/squid/icons/ \ + # Audit de secu 05-03-2020 : on enleve les reference au MI et a squid dans les pages d'erreur + && sed -i "s/Générée le %T par %h (%s)/Générée le %T par %h/g" errors/fr/* \ + && sed -i 's/Votre administrateur proxy est %w<\/a>/Veuillez contacter le support SSI/g' errors/fr/* \ + && sed -i "/SN.png/d" errors/errorpage.css \ + && sed -i "s/background: url('http:\/\/www.squid-cache.org\/Artwork\/SN.png') no-repeat left;/\/\* background: url('http:\/\/www.squid-cache.org\/Artwork\/SN.png') no-repeat left; \*\//g" errors/errorpage.css \ + && cp errors/fr/* /usr/lib/squid/errors/French/ \ + && cp errors/errorpage.css /etc/squid \ + && cp src/squid /usr/sbin/ \ + && cp tools/squidclient/squidclient /usr/sbin/ \ + && cp src/mime.conf.default /etc/squid/mime.conf \ + && cp tools/systemd/squid.service /lib/systemd/system/ \ + && chown -Rf squid /etc/squid \ + && chown -Rf squid /usr/lib/squid \ + && chown -Rf squid /var/log/squid \ + && chown -Rf squid /var/spool/squid \ + && rm /etc/localtime \ + && ln -s /usr/share/zoneinfo/Europe/Paris /etc/localtime \ +# Clean + && apt-get remove -y --purge libssl-dev wget make gcc g++ xz-utils libldap2-dev libpam0g-dev libdb-dev cdbs libsasl2-dev debhelper libcppunit-dev libkrb5-dev comerr-dev libcap2-dev libecap3-dev libexpat1-dev libxml2-dev autotools-dev libltdl-dev dpkg-dev pkg-config libnetfilter-conntrack-dev nettle-dev libgnutls28-dev lsb-release libldap2-dev libpam0g-dev libdb-dev cdbs libsasl2-dev debhelper libcppunit-dev libkrb5-dev comerr-dev libcap2-dev libecap3-dev libexpat1-dev libxml2-dev autotools-dev libltdl-dev dpkg-dev pkg-config libnetfilter-conntrack-dev nettle-dev libgnutls28-dev lsb-release \ + && apt-get auto-remove -y && apt-get clean autoclean \ +# Remove for first layer + && rm -rf /var/lib/apt/lists/* && rm -Rf /tmp/* && rm -Rf /var/cache/* +# Packages dependencies installation for running and clean again +RUN apt-get update && apt-get install -y --no-install-recommends net-tools rsync libexpat1 libltdl7 libxml2 openssl ca-certificates libldap-2.4-2 libecap3 libdb5.3 libatomic1 \ + && rm -rf /var/lib/apt/lists/* && rm -Rf /tmp/* + +RUN chmod +x /run.sh && rm /etc/localtime +HEALTHCHECK CMD squidclient -p 3128 || exit 1 +EXPOSE 3128 +ENTRYPOINT ["/run.sh"] + diff --git a/run.sh b/run.sh new file mode 100644 index 0000000..db54b98 --- /dev/null +++ b/run.sh @@ -0,0 +1,30 @@ +#!/bin/sh +set -vx +# remove previous pid (if exist) after crash +rm /var/run/squid.pid + +LIMIT="-cmin +5" +FINDTIME=$(find /var/spool/squid/$HOSTNAME/* -maxdepth 0 -type d $LIMIT) + +chown -R squid /var/log/squid + +# Si le cache n'existe pas OU rep trop ANCIEN +if [ ! -d "/var/spool/squid/$HOSTNAME" ] || [ ! -z $FINDTIME ];then + squid -z -n $HOSTNAME + sleep 1 +else + touch "/var/spool/squid/$HOSTNAME" +fi + +while test -e /var/run/squid.pid +do + echo "cache is generated/checked" + sleep 1 +done + +# Find and remove old useless caches directories (not used after limit). Sleep is here to wait for all containers to start. +mkdir /tmp/empty +sleep 20 && find /var/spool/squid/* -maxdepth 0 -type d $LIMIT -exec rsync -a -v --delete /tmp/empty/ {}/ \; && rm -d /var/spool/squid/* 2>/dev/null & + +squid -N -n $HOSTNAME +