57_Wolve
e7ba68790b
New deployments/squid/: an explicit forward proxy with SSL-bump TLS interception (local CA, generated on first deploy) and hostname-targeted static-content caching. Unlike the other stacks it is a forward proxy, not a Caddy/Let's-Encrypt inbound site. - Self-built minimal Alpine image (apk squid ships ssl-bump); entrypoint renders squid.conf and generates the cache policy from the domain lists. - Wildcard hostname caching (cache-domains.txt leading-dot + optional cache-domains.regex); boost vs strict-allowlist toggle (CACHE_ONLY_LISTED). - Storage gate never caches HTML or dynamic content; query strings exempt on boosted domains so versioned static assets still cache. - splice-domains.txt passthrough for pinned/banking domains. - Deny-by-default http_access (TRUSTED_CIDR) + BIND_ADDR pinning; CA key 0600 on host, never embedded, git-ignored. - Wired into automations.sh, README, .gitignore; cloud-init for fresh VMs.
43 lines
1.1 KiB
Plaintext
43 lines
1.1 KiB
Plaintext
# cache-domains.txt
|
|
#
|
|
# Hostnames to cache aggressively (long TTL + force-cache, overriding
|
|
# Cache-Control: private/no-store). One entry per line; a LEADING DOT matches
|
|
# the domain and all subdomains (.ubuntu.com matches archive.ubuntu.com,
|
|
# security.ubuntu.com, ...). For wildcards INSIDE a label, use
|
|
# cache-domains.regex instead.
|
|
#
|
|
# These are BUMPED (decrypted) so HTTPS bodies can be cached -- do not also
|
|
# list them in splice-domains.txt. HTML and dynamic content are still skipped
|
|
# even here (see the storage gate); only static objects are stored.
|
|
#
|
|
# Defaults target high-bandwidth distro / package / container mirrors for a
|
|
# fleet of VMs. Trim or extend for your environment.
|
|
|
|
# ── Debian / Ubuntu ──
|
|
.ubuntu.com
|
|
.debian.org
|
|
.launchpad.net
|
|
|
|
# ── Alpine ──
|
|
.alpinelinux.org
|
|
|
|
# ── RHEL family (Alma / Rocky / Fedora / EPEL) ──
|
|
.almalinux.org
|
|
.rockylinux.org
|
|
.fedoraproject.org
|
|
.centos.org
|
|
|
|
# ── Container registries (layer blobs) ──
|
|
.docker.io
|
|
.docker.com
|
|
.ghcr.io
|
|
.quay.io
|
|
.gcr.io
|
|
.k8s.io
|
|
|
|
# ── Language package registries ──
|
|
.pypi.org
|
|
.pythonhosted.org
|
|
.npmjs.org
|
|
.crates.io
|