Compare commits
29 Commits
Author | SHA1 | Date |
---|---|---|
Dmitry Belyaev | 8aab792bc1 | |
dependabot[bot] | 7ea8a5793f | |
Dmitry Belyaev | a3b674e1d5 | |
Dmitry Belyaev | 2bd55e0a98 | |
Dmitry Belyaev | fb56ae5164 | |
dependabot[bot] | bb4a85b410 | |
Dmitry Belyaev | abfd29ad78 | |
Dmitry Belyaev | 16e644983a | |
Dmitry Belyaev | 33429ba79f | |
Dmitry Belyaev | 05d3fc71a7 | |
Dmitry Belyaev | 19ecd62b08 | |
Dmitry Belyaev | 4eb3c96208 | |
dependabot[bot] | c1b8ceee1c | |
dependabot[bot] | f504923719 | |
Dmitry Belyaev | 12abc8228d | |
dependabot[bot] | 3ceca4d5f2 | |
dependabot[bot] | 0e54ff03de | |
Dmitry Belyaev | dd877b801a | |
dependabot[bot] | 6db980e029 | |
Dmitry Belyaev | 2420794090 | |
dependabot[bot] | 7a1ebcb1ac | |
dependabot[bot] | 93898b83e2 | |
Dmitry Belyaev | 291ca028a1 | |
dependabot[bot] | 0f8b8450c4 | |
dependabot[bot] | a9d2a11911 | |
dependabot[bot] | a9042a350a | |
dependabot[bot] | 558b4f3518 | |
dependabot[bot] | b209dc2c5b | |
dependabot[bot] | 20ba07b326 |
|
@ -23,23 +23,23 @@ jobs:
|
|||
test:
|
||||
runs-on: ubuntu-20.04
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v2
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v2
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Login to DockerHub
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@v2
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
username: b4tman
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Cache Docker layers
|
||||
uses: actions/cache@v3.3.1
|
||||
uses: actions/cache@v4.0.2
|
||||
with:
|
||||
path: /tmp/.buildx-cache
|
||||
key: ${{ runner.os }}-buildx-${{ github.sha }}
|
||||
|
@ -47,7 +47,7 @@ jobs:
|
|||
${{ runner.os }}-buildx-
|
||||
|
||||
- name: Build squid image
|
||||
uses: docker/build-push-action@v4
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
push: false
|
||||
|
@ -65,23 +65,48 @@ jobs:
|
|||
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
|
||||
|
||||
- name: Test image
|
||||
run: docker compose -f docker-compose.test.yml up --pull never sut
|
||||
run: |
|
||||
set -ex
|
||||
docker compose -f docker-compose.test.yml up --pull never sut --exit-code-from sut
|
||||
docker compose -f docker-compose.test.yml down
|
||||
|
||||
- name: Build 'ssl-bump' image
|
||||
- name: set base image for 'ssl-bump'
|
||||
run: |
|
||||
sed -i "s%FROM b4tman/squid%FROM $TEST_TAG%" ssl-bump/Dockerfile
|
||||
docker build ssl-bump
|
||||
|
||||
- name: Build 'ssl-bump' image
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
push: false
|
||||
load: true
|
||||
tags: ${{ env.TEST_TAG }}-ssl-bump
|
||||
cache-from: type=local,src=/tmp/.buildx-cache
|
||||
cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
|
||||
|
||||
# Temp fix
|
||||
# https://github.com/docker/build-push-action/issues/252
|
||||
# https://github.com/moby/buildkit/issues/1896
|
||||
- name: Move cache
|
||||
run: |
|
||||
rm -rf /tmp/.buildx-cache
|
||||
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
|
||||
|
||||
- name: Test 'ssl-bump' image
|
||||
run: |
|
||||
set -ex
|
||||
TEST_TAG="${TEST_TAG}-ssl-bump" docker compose -f docker-compose.test.yml up --pull never sut --exit-code-from sut
|
||||
docker compose -f docker-compose.test.yml down
|
||||
push:
|
||||
needs: test
|
||||
runs-on: ubuntu-20.04
|
||||
if: github.event_name != 'pull_request'
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Docker meta
|
||||
id: meta
|
||||
uses: docker/metadata-action@v4
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: |
|
||||
b4tman/squid
|
||||
|
@ -95,7 +120,7 @@ jobs:
|
|||
|
||||
- name: Docker meta (ssl-bump)
|
||||
id: meta_ssl_bump
|
||||
uses: docker/metadata-action@v4
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: |
|
||||
b4tman/squid
|
||||
|
@ -110,7 +135,7 @@ jobs:
|
|||
|
||||
- name: Docker meta (ssl-bump ghcr)
|
||||
id: meta_ssl_bump_ghcr
|
||||
uses: docker/metadata-action@v4
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: |
|
||||
ghcr.io/b4tman/squid-ssl-bump
|
||||
|
@ -122,13 +147,13 @@ jobs:
|
|||
type=semver,pattern={{major}}.{{minor}}
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v2
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v2
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Cache Docker layers
|
||||
uses: actions/cache@v3.3.1
|
||||
uses: actions/cache@v4.0.2
|
||||
with:
|
||||
path: /tmp/.buildx-cache
|
||||
key: ${{ runner.os }}-buildx-${{ github.sha }}
|
||||
|
@ -136,20 +161,20 @@ jobs:
|
|||
${{ runner.os }}-buildx-
|
||||
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v2
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
username: b4tman
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Login to GHCR
|
||||
uses: docker/login-action@v2
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.repository_owner }}
|
||||
password: ${{ secrets.CR_PAT }}
|
||||
|
||||
- name: Build squid image
|
||||
uses: docker/build-push-action@v4
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
|
@ -168,7 +193,7 @@ jobs:
|
|||
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
|
||||
|
||||
- name: Build 'ssl-bump' image
|
||||
uses: docker/build-push-action@v4
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: ssl-bump
|
||||
push: true
|
||||
|
@ -188,7 +213,7 @@ jobs:
|
|||
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
|
||||
|
||||
- name: Build 'ssl-bump' image for ghcr
|
||||
uses: docker/build-push-action@v4
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: ssl-bump
|
||||
push: true
|
||||
|
|
|
@ -18,7 +18,7 @@ jobs:
|
|||
pull-requests: write
|
||||
|
||||
steps:
|
||||
- uses: actions/stale@v8
|
||||
- uses: actions/stale@v9
|
||||
with:
|
||||
days-before-stale: 182
|
||||
days-before-close: 7
|
||||
|
|
18
Dockerfile
18
Dockerfile
|
@ -1,6 +1,6 @@
|
|||
FROM alpine:3.18.3 as build
|
||||
FROM alpine:3.19.1 as build
|
||||
|
||||
ARG SQUID_VER=6.3
|
||||
ARG SQUID_VER=6.9
|
||||
|
||||
RUN set -x && \
|
||||
apk add --no-cache \
|
||||
|
@ -106,7 +106,7 @@ RUN sed -i '1s;^;include /etc/squid/conf.d/*.conf\n;' /etc/squid/squid.conf && \
|
|||
|
||||
# --- --- --- --- --- --- --- --- ---
|
||||
|
||||
FROM alpine:3.18.3
|
||||
FROM alpine:3.19.1
|
||||
|
||||
ENV SQUID_CONFIG_FILE /etc/squid/squid.conf
|
||||
ENV TZ Europe/Moscow
|
||||
|
@ -119,13 +119,16 @@ RUN apk add --no-cache \
|
|||
libstdc++ \
|
||||
heimdal-libs \
|
||||
libcap \
|
||||
libltdl
|
||||
libltdl \
|
||||
tzdata
|
||||
|
||||
COPY --from=build /etc/squid/ /etc/squid/
|
||||
COPY --from=build /usr/lib/squid/ /usr/lib/squid/
|
||||
COPY --from=build /usr/share/squid/ /usr/share/squid/
|
||||
COPY --from=build /usr/sbin/squid /usr/sbin/squid
|
||||
COPY --from=build /usr/bin/squidclient /usr/bin/squidclient
|
||||
|
||||
COPY --chmod=755 run.sh /
|
||||
|
||||
RUN install -d -o squid -g squid \
|
||||
/var/cache/squid \
|
||||
|
@ -138,14 +141,9 @@ RUN install -d -o squid -g squid \
|
|||
touch /etc/squid/conf.d/placeholder.conf
|
||||
COPY squid-log.conf /etc/squid/conf.d.tail/
|
||||
|
||||
RUN set -x && \
|
||||
apk add --no-cache --virtual .tz alpine-conf tzdata && \
|
||||
/sbin/setup-timezone -z $TZ && \
|
||||
apk del .tz
|
||||
|
||||
VOLUME ["/var/cache/squid"]
|
||||
EXPOSE 3128/tcp
|
||||
|
||||
USER squid
|
||||
|
||||
CMD ["sh", "-c", "rm -f /var/run/squid/squid.pid ; /usr/sbin/squid -f ${SQUID_CONFIG_FILE} --foreground -z && exec /usr/sbin/squid -f ${SQUID_CONFIG_FILE} --foreground -YCd 1"]
|
||||
CMD ["/run.sh"]
|
||||
|
|
|
@ -2,6 +2,8 @@ version: '2.3'
|
|||
services:
|
||||
proxy:
|
||||
image: "${TEST_TAG}"
|
||||
volumes:
|
||||
- './test_localnet.conf:/etc/squid/conf.d/test_localnet.conf:ro'
|
||||
healthcheck:
|
||||
test: ["CMD", "sh", "-exc", "squidclient -T 3 mgr:info 2> /dev/null | grep -qF '200 OK'"]
|
||||
interval: 5s
|
||||
|
|
|
@ -0,0 +1,14 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -x
|
||||
|
||||
# force remove pid
|
||||
if [ -e /var/run/squid/squid.pid ]; then
|
||||
rm -f /var/run/squid/squid.pid
|
||||
fi
|
||||
|
||||
# init cache
|
||||
/usr/sbin/squid -f "${SQUID_CONFIG_FILE}" --foreground -z
|
||||
|
||||
# run squid
|
||||
exec /usr/sbin/squid -f "${SQUID_CONFIG_FILE}" --foreground -YCd 1
|
BIN
squid-keys.asc
BIN
squid-keys.asc
Binary file not shown.
|
@ -1,4 +1,9 @@
|
|||
FROM b4tman/squid
|
||||
|
||||
COPY run.sh /
|
||||
USER root
|
||||
CMD ["sh", "-c", "(test -d /var/cache/squid/ssl_db || /usr/lib/squid/security_file_certgen -c -s /var/cache/squid/ssl_db -M 4MB) && /usr/sbin/squid -f ${SQUID_CONFIG_FILE} --foreground -z && exec /usr/sbin/squid -f ${SQUID_CONFIG_FILE} --foreground -YCd 1"]
|
||||
RUN chmod 755 /run.sh
|
||||
|
||||
USER squid
|
||||
|
||||
CMD ["/run.sh"]
|
||||
|
|
|
@ -0,0 +1,14 @@
|
|||
#!/bin/sh
|
||||
|
||||
set -x
|
||||
|
||||
# init ssl_db
|
||||
if [ ! -d /var/cache/squid/ssl_db ]; then
|
||||
/usr/lib/squid/security_file_certgen -c -s /var/cache/squid/ssl_db -M 4MB
|
||||
fi
|
||||
|
||||
# init cache
|
||||
/usr/sbin/squid -f "${SQUID_CONFIG_FILE}" --foreground -z
|
||||
|
||||
# run squid
|
||||
exec /usr/sbin/squid -f "${SQUID_CONFIG_FILE}" --foreground -YCd 1
|
|
@ -0,0 +1,11 @@
|
|||
acl localnet1 src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)
|
||||
acl localnet1 src 10.0.0.0/8 # RFC 1918 local private network (LAN)
|
||||
acl localnet1 src 100.64.0.0/10 # RFC 6598 shared address space (CGN)
|
||||
acl localnet1 src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines
|
||||
acl localnet1 src 172.16.0.0/12 # RFC 1918 local private network (LAN)
|
||||
acl localnet1 src 192.168.0.0/16 # RFC 1918 local private network (LAN)
|
||||
acl localnet1 src fc00::/7 # RFC 4193 local private network range
|
||||
acl localnet1 src fe80::/10 # RFC 4291 link-local (directly plugged) machines
|
||||
|
||||
http_access allow localnet1
|
||||
http_access allow localhost manager
|
Loading…
Reference in New Issue