Merge pull request 'feat(squid): add SSL-bump caching forward-proxy deployment' (#4) from feat/squid-proxy into main

Reviewed-on: #4

automations.sh

@@ -62,7 +62,7 @@ fi
 . "$ROOT/scripts/lib.sh"
 load_globals
 
-DEPLOYMENTS=(pocket-id beszel headscale webfinger simplex)
+DEPLOYMENTS=(pocket-id beszel headscale webfinger squid simplex)
 SCRIPTS=(setup-host harden-ssh harden-jumphost sshuser auto-update)
 
 # ----------------------------------------------------------------------------
@@ -108,6 +108,11 @@ ask_deployment_vars() {
             ask ISSUER_URL    "OIDC issuer URL (e.g. https://auth.example.com)"
             ask REDIRECT_URL  "Redirect target for other traffic (e.g. https://example.org)"
             ask ACME_EMAIL    "Let's Encrypt email" ;;
+        squid)
+            ask TRUSTED_CIDR      "Trusted client CIDR(s) allowed to use the proxy (e.g. 100.64.0.0/10)"
+            ask BIND_ADDR         "Host IP to bind the proxy on (blank = 0.0.0.0)" optional
+            ask CACHE_SIZE_MB     "On-disk cache size in MB (blank = 5000)" optional
+            ask CACHE_ONLY_LISTED "Cache ONLY listed domains? (1=yes, blank=boost mode)" optional ;;
         simplex)
             ask DOMAIN     "Apex domain (creates smp.DOMAIN, xftp.DOMAIN)"
             ask ACME_EMAIL "Let's Encrypt email"