From cfde3422eec045100cb18113f7817e9d7052f2b8 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 26 Dec 2022 11:33:35 +0100 Subject: [PATCH] Update docker-compose: Multiple squid proxy instances running on the same host, with load balacing, web & dns filtering (dnsmasq/e2guardian) --- README.md | 2 + docker-compose/dnsmasq/dnsmasq.conf | 1 + docker-compose/docker-compose.yml | 123 ++++++++++++++++++++++++++-- docker-compose/haproxy/haproxy.cfg | 58 +++++++++++++ docker-compose/squid/squid.conf | 5 ++ 5 files changed, 184 insertions(+), 5 deletions(-) create mode 100644 docker-compose/haproxy/haproxy.cfg diff --git a/README.md b/README.md index 6c74f50..44c2715 100644 --- a/README.md +++ b/README.md @@ -75,6 +75,8 @@ _If a file is changed/deleted/created squid reloads_ https://gitlab.com/fredbcode-images/squid/-/tree/master/docker-compose +Multiple squid proxy instances running on the same host, with load balacing, web & dns filtering (dnsmasq/e2guardian) + **Supported architectures:** - amd64, armv8 diff --git a/docker-compose/dnsmasq/dnsmasq.conf b/docker-compose/dnsmasq/dnsmasq.conf index 4470562..6230d34 100644 --- a/docker-compose/dnsmasq/dnsmasq.conf +++ b/docker-compose/dnsmasq/dnsmasq.conf @@ -879,3 +879,4 @@ address=/m.youtube.com/216.239.38.119 address=/youtubei.googleapis.com/216.239.38.119 address=/youtube.googleapis.com/216.239.38.119 address=/www.youtube-nocookie.com/216.239.38.119 +server=1.1.1.1 diff --git a/docker-compose/docker-compose.yml b/docker-compose/docker-compose.yml index 3830d34..ab86725 100644 --- a/docker-compose/docker-compose.yml +++ b/docker-compose/docker-compose.yml @@ -1,9 +1,7 @@ version: "3.3" services: - squid: + squid1: image: fredbcode/squid:latest - ports: - - 3128-3150:3128 environment: - TZ=Europe/Paris # Sup @@ -13,7 +11,97 @@ services: - autoreload=/etc/squid volumes: - ./squid:/etc/squid:ro - - cache:/var/spool/squid + - cache1:/var/spool/squid + depends_on: + - haproxy + - dns + logging: + options: + max-size: "100m" + max-file: "3" + restart: always + labels: + # purge memory + deck-chores.squidrestart.command: sh -c 'squid -k shutdown' + deck-chores.squidrestart.cron: "* * * * * 00 00 00" + networks: + - webfilter + dns: + - 172.20.7.10 + + squid2: + image: fredbcode/squid:latest + environment: + - TZ=Europe/Paris + # Sup + - supgethosts=https://www.google.com https://www.facebook.com https://www.orange.fr https://www.free.fr + - supicaphost=e2guardian + - supicapport=1344 + - autoreload=/etc/squid + volumes: + - ./squid:/etc/squid:ro + - cache2:/var/spool/squid + depends_on: + - haproxy + - dns + logging: + options: + max-size: "100m" + max-file: "3" + restart: always + labels: + # purge memory + deck-chores.squidrestart.command: sh -c 'squid -k shutdown' + deck-chores.squidrestart.cron: "* * * * * 00 00 00" + networks: + - webfilter + dns: + - 172.20.7.10 + + squid3: + image: fredbcode/squid:latest + environment: + - TZ=Europe/Paris + # Sup + - supgethosts=https://www.google.com https://www.facebook.com https://www.orange.fr https://www.free.fr + - supicaphost=e2guardian + - supicapport=1344 + - autoreload=/etc/squid + volumes: + - ./squid:/etc/squid:ro + - cache3:/var/spool/squid + depends_on: + - haproxy + - dns + logging: + options: + max-size: "100m" + max-file: "3" + restart: always + labels: + # purge memory + deck-chores.squidrestart.command: sh -c 'squid -k shutdown' + deck-chores.squidrestart.cron: "* * * * * 00 00 00" + networks: + - webfilter + dns: + - 172.20.7.10 + + squid4: + image: fredbcode/squid:latest + environment: + - TZ=Europe/Paris + # Sup + - supgethosts=https://www.google.com https://www.facebook.com https://www.orange.fr https://www.free.fr + - supicaphost=e2guardian + - supicapport=1344 + - autoreload=/etc/squid + volumes: + - ./squid:/etc/squid:ro + - cache4:/var/spool/squid + depends_on: + - haproxy + - dns logging: options: max-size: "100m" @@ -36,6 +124,9 @@ services: healthcheck: disable: true restart: unless-stopped + depends_on: + - haproxy + - dns volumes: - ./e2guardian/:/etc/e2guardian:ro labels: @@ -45,6 +136,21 @@ services: networks: - webfilter + haproxy: + image: haproxy:latest + ports: + - "3128:3128" + volumes: + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + - ./haproxy:/usr/local/etc/haproxy/haproxy.cfg:ro + logging: + options: + max-size: "100m" + max-file: "3" + networks: + - webfilter + # DNS Filtering (safe search enabled) dns: restart: always @@ -53,6 +159,10 @@ services: - ./dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf cap_add: - NET_ADMIN + logging: + options: + max-size: "100m" + max-file: "3" networks: webfilter: ipv4_address: 172.20.7.10 @@ -76,4 +186,7 @@ networks: - subnet: 172.20.7.0/24 volumes: - cache: + cache1: + cache2: + cache3: + cache4: diff --git a/docker-compose/haproxy/haproxy.cfg b/docker-compose/haproxy/haproxy.cfg new file mode 100644 index 0000000..b9dd610 --- /dev/null +++ b/docker-compose/haproxy/haproxy.cfg @@ -0,0 +1,58 @@ +global + # to have these messages end up in /var/log/haproxy.log you will + # need to: + # + # 1) configure syslog to accept network log events. This is done + # by adding the '-r' option to the SYSLOGD_OPTIONS in + # /etc/sysconfig/syslog + # + # 2) configure local2 events to go to the /var/log/haproxy.log + # file. A line like the following can be added to + # /etc/sysconfig/syslog + # + # local2.* /var/log/haproxy.log + # + log 127.0.0.1 local0 notice + user haproxy + group haproxy + # turn on stats unix socket + stats socket /var/lib/haproxy/stats + +defaults + log global + retries 3 + timeout queue 1m +# First cnx + timeout connect 10s +# Activity cnx + timeout client 2m + timeout server 2m + option abortonclose + +frontend stats + maxconn 500 + mode http + option httplog + bind *:80 + stats enable + stats hide-version + stats uri /stats + +# main frontend which proxys to the backends +#--------------------------------------------------------------------- +frontend proxy + bind *:3128 + default_backend squid + +#--------------------------------------------------------------------- +# round robin balancing between the various backends +#--------------------------------------------------------------------- +backend squid + balance leastconn + mode http + option httpclose + option forwardfor + server s1 squid1:3128 check + server s2 squid2:3128 check + server s3 squid3:3128 check + server s4 squid4:3128 check diff --git a/docker-compose/squid/squid.conf b/docker-compose/squid/squid.conf index 71eb760..00c7b97 100644 --- a/docker-compose/squid/squid.conf +++ b/docker-compose/squid/squid.conf @@ -89,3 +89,8 @@ cache_dir diskd /var/cache/squid/${service_name} 130 51 51 access_log stdio:/var/log/squid/access.log cache_log /var/log/squid/cache.log cache_effective_user squid +follow_x_forwarded_for allow all +# Remove identifying headers +request_header_access Cache-Control deny all +request_header_access Via deny all +request_header_access X-Forwarded-For deny all