diff --git a/Dockerfile b/Dockerfile index 4b9de9e..7a94a0f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -99,11 +99,13 @@ RUN adduser --no-create-home --uid 1161 --group --system squid \ && echo "cache_log /var/log/squid/cache.log" >> /etc/squid/squid.conf \ && echo "cache_effective_user squid" >> /etc/squid/squid.conf \ # Packages dependencies installation for running and clean again - && apt-get update && apt-get install -y --no-install-recommends ca-certificates net-tools rsync libexpat1 libltdl7 libxml2 openssl ca-certificates libldap-2.4-2 libecap3 libcap2 libdb5.3 libatomic1 dumb-init procps \ + && apt-get update && apt-get install -y --no-install-recommends ca-certificates net-tools rsync libexpat1 libltdl7 libxml2 openssl ca-certificates libldap-2.4-2 libecap3 libcap2 libdb5.3 libatomic1 dumb-init procps inotify-tools \ && apt-get auto-remove -y && apt-get clean autoclean \ && rm -rf /var/lib/apt/lists/* && rm -Rf /tmp/* COPY run.sh / -RUN chmod +x /run.sh +COPY autoreload.sh / +COPY sup.sh.sh / +RUN chmod +x /run.sh /autoreload.sh /sup.sh HEALTHCHECK CMD squidclient mgr:info | grep "HTTP/1.1 200 OK" || exit 1 EXPOSE 3128 ENTRYPOINT ["dumb-init"] diff --git a/README.md b/README.md index b57c202..6f728e9 100644 --- a/README.md +++ b/README.md @@ -42,6 +42,24 @@ docker-compose up --scale squid=4 -d - 1161 +**Persistence** + +For the cache to preserve its state should mount a volume /var/spool/squid as volume + +**Optionals environment variables** + +# If all hosts are down, squid stop +- supgethosts=https://www.google.com https://www.facebook.com https://www.orange.fr https://www.free.fr +# If ICAP server is down, squid stop +- supicaphost=e2guardian +- supicapport=1344 +# If a file is changed/delete/created squid reload +- autoreload=/etc/squid + +**docker-compose** + +https://gitlab.com/fredbcode/docker-compose + **Supported architectures:** - adm64, armv8 diff --git a/docker-compose/docker-compose.yml b/docker-compose/docker-compose.yml new file mode 100644 index 0000000..d9c8b9f --- /dev/null +++ b/docker-compose/docker-compose.yml @@ -0,0 +1,23 @@ +version: "3.3" +services: + squid: + image: fredbcode/squid:latest + ports: + - 3128-3150:3128 + environment: + - TZ=Europe/Paris + # Sup + - supgethosts=https://www.google.com https://www.facebook.com https://www.orange.fr https://www.free.fr + - supicaphost=e2guardian + - supicapport=1344 + - autoreload=/etc/squid + volumes: + - ./squid:/etc/squid + logging: + options: + max-size: "100m" + max-file: "3" + volumes: + - cache:/var/spool/squid +volumes: + cache: diff --git a/docker-compose/squid/squid.conf b/docker-compose/squid/squid.conf new file mode 100644 index 0000000..bab48ec --- /dev/null +++ b/docker-compose/squid/squid.conf @@ -0,0 +1,79 @@ +# +# Recommended minimum configuration: +# + +# Example rule allowing access from your local networks. +# Adapt to list your (internal) IP networks from where browsing +# should be allowed +acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) +acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) +acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) +acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines +acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) +acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) +acl localnet src fc00::/7 # RFC 4193 local private network range +acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines + +acl SSL_ports port 443 +acl Safe_ports port 80 # http +acl Safe_ports port 21 # ftp +acl Safe_ports port 443 # https +acl Safe_ports port 70 # gopher +acl Safe_ports port 210 # wais +acl Safe_ports port 1025-65535 # unregistered ports +acl Safe_ports port 280 # http-mgmt +acl Safe_ports port 488 # gss-http +acl Safe_ports port 591 # filemaker +acl Safe_ports port 777 # multiling http + +# +# Recommended minimum Access Permission configuration: +# +# Deny requests to certain unsafe ports +http_access deny !Safe_ports + +# Deny CONNECT to other than secure SSL ports +http_access deny CONNECT !SSL_ports + +# Only allow cachemgr access from localhost +http_access allow localhost manager +http_access deny manager + +# We strongly recommend the following be uncommented to protect innocent +# web applications running on the proxy server who think the only +# one who can access services on "localhost" is a local user +#http_access deny to_localhost + +# +# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS +# + +# Example rule allowing access from your local networks. +# Adapt localnet in the ACL section to list your (internal) IP networks +# from where browsing should be allowed +http_access allow localnet +http_access allow localhost + +# And finally deny all other access to this proxy +http_access deny all + +# Squid normally listens to port 3128 +http_port 3128 + +# Uncomment and adjust the following to add a disk cache directory. +#cache_dir ufs /var/cache/squid 100 16 256 + +# Leave coredumps in the first cache dir +coredump_dir /var/cache/squid + +# +# Add any of your own refresh_pattern entries above these. +# +refresh_pattern ^ftp: 1440 20% 10080 +refresh_pattern ^gopher: 1440 0% 1440 +refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 +refresh_pattern . 0 20% 4320 +cache_dir diskd /var/cache/squid/${service_name} 130 51 51 +access_log stdio:/var/log/squid/access.log +cache_log /var/log/squid/cache.log +cache_effective_user squid diff --git a/run.sh b/run.sh index eb98b69..e8a1770 100644 --- a/run.sh +++ b/run.sh @@ -1,5 +1,6 @@ #!/bin/bash -set -vx +# + 48h +LIMIT="-cmin +2880" if [ -e "/run/squid.pid" ];then echo "Squid pid: Already running ?" @@ -8,28 +9,21 @@ if [ -e "/run/squid.pid" ];then exit 1 fi -# Check si Au demarrage le cache contient des repertoires pas utilisés depuis plus de $LIMIT -FINDTIME=$(find /var/spool/squid/$HOSTNAME/* -maxdepth 0 -type d $LIMIT | wc -l) -# Combien de rep global -NOWREP=$(find /var/spool/squid/$HOSTNAME/* -maxdepth 0 -type d | wc -l) +chown -R squid /var/log/squid -# Not exist or too old -if [ ! -d "/var/spool/squid/$HOSTNAME" ] || [ $FINDTIME == $NOWREP ];then -# On genere/regenere - squid -z -n $HOSTNAME - sleep 1 -else -# Remet à zero la date du rep de cache pour le prochain check - touch "/var/spool/squid/$HOSTNAME" +# check sup once before starting +# if env sup + +/sup.sh + +if [ $(grep -c "\-s\ /certs" /etc/squid/squid.conf) -ne 0 ];then + if [ ! -d /certs/ssl_db ]; then + /usr/lib/squid/security_file_certgen -c -s /certs/ssl_db -M 600MB + fi + chown -R squid:squid /certs fi -while test -e /var/run/squid.pid -do - echo "cache is generated/checked" - sleep 1 -done - -# Find and remove old useless caches directories (not used after "LIMIT" value). sleep is only used to wait other containers are well started. -mkdir /tmp/empty -sleep 20 && find /var/cache/squid/* -maxdepth 0 -type d $LIMIT -exec rsync -a -v --delete /tmp/empty/ {}/ \; && rm -d /var/cache/squid/* 2>/dev/null & +echo "Starting: squid" +# Run autoreload: IN BACKGROUND +/autoreload.sh & diff --git a/sup.sh b/sup.sh new file mode 100644 index 0000000..6dc17f1 --- /dev/null +++ b/sup.sh @@ -0,0 +1,56 @@ +#!/bin/bash +PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin +# variables +date=$(date +%d-%m-%Y_%w) +# Remove buggy cache and restart + +cachedirconf=$(grep cache_dir /etc/squid/squid.conf | grep -v "#" | cut -d " " -f5) +cachedir=$(ls /var/spool/squid/$HOSTNAME | wc -l) + +if [ $cachedirconf -gt $cachedir ] && [ -d "/var/spool/squid/$HOSTNAME" ]; then +# corrupted caches + echo "CACHE IS CORRUPED: try to autorepair" + rsync -a -v --delete /tmp/empty/ /var/spool/squid/$HOSTNAME + rm -Rf /var/spool/squid/$HOSTNAME +# restart for regenerating cache after + squid -k kill +fi + +if [ -z "$supgethosts" ] && [ -z "$supicaphost" ]; then + echo "SUP: NO SUP" + exit 0 +fi + +if [ -n "$supgethosts" ]; then + for i in ${supgethosts[@]} + do + echo "CHECK: $i" + curl -s -o /dev/null --connect-timeout 5 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/96.0" $i + if [ $? = 0 ];then + echo "SUP: ACCESS ok $i" + if [ -z "$supicaphost" ]; then + exit 0 + else + break + fi + else + echo "SUP: ERROR $i" + fi + done +fi + +if [ -n "$supicaphost" ]; then + c-icap-client -i $supicaphost -p $supicapport -s request > /tmp/test-icap-e2g-orion 2>&1 + grep "200 OK" /tmp/test-icap-e2g-orion >/dev/null + if [ $? = 0 ];then + echo "SUP ICAP: ACCESS ICAP ok $supicaphost" + exit 0 + else + echo "SUP ICAP: ERROR $supicaphost" + fi +fi + +# Sup error because no OK before +echo "SUP ERROR" +squid -k shutdown +exit 1