Optionals environment variables
This commit is contained in:
fredbcode
parent
34fa8c473f
commit
b489568c82
@ -99,11 +99,13 @@ RUN adduser --no-create-home --uid 1161 --group --system squid \
|
||||
&& echo "cache_log /var/log/squid/cache.log" >> /etc/squid/squid.conf \
|
||||
&& echo "cache_effective_user squid" >> /etc/squid/squid.conf \
|
||||
# Packages dependencies installation for running and clean again
|
||||
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates net-tools rsync libexpat1 libltdl7 libxml2 openssl ca-certificates libldap-2.4-2 libecap3 libcap2 libdb5.3 libatomic1 dumb-init procps \
|
||||
&& apt-get update && apt-get install -y --no-install-recommends ca-certificates net-tools rsync libexpat1 libltdl7 libxml2 openssl ca-certificates libldap-2.4-2 libecap3 libcap2 libdb5.3 libatomic1 dumb-init procps inotify-tools \
|
||||
&& apt-get auto-remove -y && apt-get clean autoclean \
|
||||
&& rm -rf /var/lib/apt/lists/* && rm -Rf /tmp/*
|
||||
COPY run.sh /
|
||||
RUN chmod +x /run.sh
|
||||
COPY autoreload.sh /
|
||||
COPY sup.sh.sh /
|
||||
RUN chmod +x /run.sh /autoreload.sh /sup.sh
|
||||
HEALTHCHECK CMD squidclient mgr:info | grep "HTTP/1.1 200 OK" || exit 1
|
||||
EXPOSE 3128
|
||||
ENTRYPOINT ["dumb-init"]
|
||||
|
||||
18
README.md
18
README.md
@ -42,6 +42,24 @@ docker-compose up --scale squid=4 -d
|
||||
|
||||
- 1161
|
||||
|
||||
**Persistence**
|
||||
|
||||
For the cache to preserve its state should mount a volume /var/spool/squid as volume
|
||||
|
||||
**Optionals environment variables**
|
||||
|
||||
# If all hosts are down, squid stop
|
||||
- supgethosts=https://www.google.com https://www.facebook.com https://www.orange.fr https://www.free.fr
|
||||
# If ICAP server is down, squid stop
|
||||
- supicaphost=e2guardian
|
||||
- supicapport=1344
|
||||
# If a file is changed/delete/created squid reload
|
||||
- autoreload=/etc/squid
|
||||
|
||||
**docker-compose**
|
||||
|
||||
https://gitlab.com/fredbcode/docker-compose
|
||||
|
||||
**Supported architectures:**
|
||||
|
||||
- adm64, armv8
|
||||
|
||||
23
docker-compose/docker-compose.yml
Normal file
23
docker-compose/docker-compose.yml
Normal file
@ -0,0 +1,23 @@
|
||||
version: "3.3"
|
||||
services:
|
||||
squid:
|
||||
image: fredbcode/squid:latest
|
||||
ports:
|
||||
- 3128-3150:3128
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
# Sup
|
||||
- supgethosts=https://www.google.com https://www.facebook.com https://www.orange.fr https://www.free.fr
|
||||
- supicaphost=e2guardian
|
||||
- supicapport=1344
|
||||
- autoreload=/etc/squid
|
||||
volumes:
|
||||
- ./squid:/etc/squid
|
||||
logging:
|
||||
options:
|
||||
max-size: "100m"
|
||||
max-file: "3"
|
||||
volumes:
|
||||
- cache:/var/spool/squid
|
||||
volumes:
|
||||
cache:
|
||||
79
docker-compose/squid/squid.conf
Normal file
79
docker-compose/squid/squid.conf
Normal file
@ -0,0 +1,79 @@
|
||||
#
|
||||
# Recommended minimum configuration:
|
||||
#
|
||||
|
||||
# Example rule allowing access from your local networks.
|
||||
# Adapt to list your (internal) IP networks from where browsing
|
||||
# should be allowed
|
||||
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)
|
||||
acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN)
|
||||
acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN)
|
||||
acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines
|
||||
acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN)
|
||||
acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN)
|
||||
acl localnet src fc00::/7 # RFC 4193 local private network range
|
||||
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
|
||||
|
||||
acl SSL_ports port 443
|
||||
acl Safe_ports port 80 # http
|
||||
acl Safe_ports port 21 # ftp
|
||||
acl Safe_ports port 443 # https
|
||||
acl Safe_ports port 70 # gopher
|
||||
acl Safe_ports port 210 # wais
|
||||
acl Safe_ports port 1025-65535 # unregistered ports
|
||||
acl Safe_ports port 280 # http-mgmt
|
||||
acl Safe_ports port 488 # gss-http
|
||||
acl Safe_ports port 591 # filemaker
|
||||
acl Safe_ports port 777 # multiling http
|
||||
|
||||
#
|
||||
# Recommended minimum Access Permission configuration:
|
||||
#
|
||||
# Deny requests to certain unsafe ports
|
||||
http_access deny !Safe_ports
|
||||
|
||||
# Deny CONNECT to other than secure SSL ports
|
||||
http_access deny CONNECT !SSL_ports
|
||||
|
||||
# Only allow cachemgr access from localhost
|
||||
http_access allow localhost manager
|
||||
http_access deny manager
|
||||
|
||||
# We strongly recommend the following be uncommented to protect innocent
|
||||
# web applications running on the proxy server who think the only
|
||||
# one who can access services on "localhost" is a local user
|
||||
#http_access deny to_localhost
|
||||
|
||||
#
|
||||
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
|
||||
#
|
||||
|
||||
# Example rule allowing access from your local networks.
|
||||
# Adapt localnet in the ACL section to list your (internal) IP networks
|
||||
# from where browsing should be allowed
|
||||
http_access allow localnet
|
||||
http_access allow localhost
|
||||
|
||||
# And finally deny all other access to this proxy
|
||||
http_access deny all
|
||||
|
||||
# Squid normally listens to port 3128
|
||||
http_port 3128
|
||||
|
||||
# Uncomment and adjust the following to add a disk cache directory.
|
||||
#cache_dir ufs /var/cache/squid 100 16 256
|
||||
|
||||
# Leave coredumps in the first cache dir
|
||||
coredump_dir /var/cache/squid
|
||||
|
||||
#
|
||||
# Add any of your own refresh_pattern entries above these.
|
||||
#
|
||||
refresh_pattern ^ftp: 1440 20% 10080
|
||||
refresh_pattern ^gopher: 1440 0% 1440
|
||||
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
|
||||
refresh_pattern . 0 20% 4320
|
||||
cache_dir diskd /var/cache/squid/${service_name} 130 51 51
|
||||
access_log stdio:/var/log/squid/access.log
|
||||
cache_log /var/log/squid/cache.log
|
||||
cache_effective_user squid
|
||||
38
run.sh
38
run.sh
@ -1,5 +1,6 @@
|
||||
#!/bin/bash
|
||||
set -vx
|
||||
# + 48h
|
||||
LIMIT="-cmin +2880"
|
||||
|
||||
if [ -e "/run/squid.pid" ];then
|
||||
echo "Squid pid: Already running ?"
|
||||
@ -8,28 +9,21 @@ if [ -e "/run/squid.pid" ];then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check si Au demarrage le cache contient des repertoires pas utilisés depuis plus de $LIMIT
|
||||
FINDTIME=$(find /var/spool/squid/$HOSTNAME/* -maxdepth 0 -type d $LIMIT | wc -l)
|
||||
# Combien de rep global
|
||||
NOWREP=$(find /var/spool/squid/$HOSTNAME/* -maxdepth 0 -type d | wc -l)
|
||||
chown -R squid /var/log/squid
|
||||
|
||||
# Not exist or too old
|
||||
if [ ! -d "/var/spool/squid/$HOSTNAME" ] || [ $FINDTIME == $NOWREP ];then
|
||||
# On genere/regenere
|
||||
squid -z -n $HOSTNAME
|
||||
sleep 1
|
||||
else
|
||||
# Remet à zero la date du rep de cache pour le prochain check
|
||||
touch "/var/spool/squid/$HOSTNAME"
|
||||
# check sup once before starting
|
||||
# if env sup
|
||||
|
||||
/sup.sh
|
||||
|
||||
if [ $(grep -c "\-s\ /certs" /etc/squid/squid.conf) -ne 0 ];then
|
||||
if [ ! -d /certs/ssl_db ]; then
|
||||
/usr/lib/squid/security_file_certgen -c -s /certs/ssl_db -M 600MB
|
||||
fi
|
||||
chown -R squid:squid /certs
|
||||
fi
|
||||
|
||||
while test -e /var/run/squid.pid
|
||||
do
|
||||
echo "cache is generated/checked"
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Find and remove old useless caches directories (not used after "LIMIT" value). sleep is only used to wait other containers are well started.
|
||||
mkdir /tmp/empty
|
||||
sleep 20 && find /var/cache/squid/* -maxdepth 0 -type d $LIMIT -exec rsync -a -v --delete /tmp/empty/ {}/ \; && rm -d /var/cache/squid/* 2>/dev/null &
|
||||
echo "Starting: squid"
|
||||
# Run autoreload: IN BACKGROUND
|
||||
/autoreload.sh &
|
||||
|
||||
|
||||
56
sup.sh
Normal file
56
sup.sh
Normal file
@ -0,0 +1,56 @@
|
||||
#!/bin/bash
|
||||
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
|
||||
# variables
|
||||
date=$(date +%d-%m-%Y_%w)
|
||||
# Remove buggy cache and restart
|
||||
|
||||
cachedirconf=$(grep cache_dir /etc/squid/squid.conf | grep -v "#" | cut -d " " -f5)
|
||||
cachedir=$(ls /var/spool/squid/$HOSTNAME | wc -l)
|
||||
|
||||
if [ $cachedirconf -gt $cachedir ] && [ -d "/var/spool/squid/$HOSTNAME" ]; then
|
||||
# corrupted caches
|
||||
echo "CACHE IS CORRUPED: try to autorepair"
|
||||
rsync -a -v --delete /tmp/empty/ /var/spool/squid/$HOSTNAME
|
||||
rm -Rf /var/spool/squid/$HOSTNAME
|
||||
# restart for regenerating cache after
|
||||
squid -k kill
|
||||
fi
|
||||
|
||||
if [ -z "$supgethosts" ] && [ -z "$supicaphost" ]; then
|
||||
echo "SUP: NO SUP"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -n "$supgethosts" ]; then
|
||||
for i in ${supgethosts[@]}
|
||||
do
|
||||
echo "CHECK: $i"
|
||||
curl -s -o /dev/null --connect-timeout 5 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/96.0" $i
|
||||
if [ $? = 0 ];then
|
||||
echo "SUP: ACCESS ok $i"
|
||||
if [ -z "$supicaphost" ]; then
|
||||
exit 0
|
||||
else
|
||||
break
|
||||
fi
|
||||
else
|
||||
echo "SUP: ERROR $i"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [ -n "$supicaphost" ]; then
|
||||
c-icap-client -i $supicaphost -p $supicapport -s request > /tmp/test-icap-e2g-orion 2>&1
|
||||
grep "200 OK" /tmp/test-icap-e2g-orion >/dev/null
|
||||
if [ $? = 0 ];then
|
||||
echo "SUP ICAP: ACCESS ICAP ok $supicaphost"
|
||||
exit 0
|
||||
else
|
||||
echo "SUP ICAP: ERROR $supicaphost"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Sup error because no OK before
|
||||
echo "SUP ERROR"
|
||||
squid -k shutdown
|
||||
exit 1
|
||||
Loading…
x
Reference in New Issue
Block a user