57_Wolve
e7ba68790b
New deployments/squid/: an explicit forward proxy with SSL-bump TLS interception (local CA, generated on first deploy) and hostname-targeted static-content caching. Unlike the other stacks it is a forward proxy, not a Caddy/Let's-Encrypt inbound site. - Self-built minimal Alpine image (apk squid ships ssl-bump); entrypoint renders squid.conf and generates the cache policy from the domain lists. - Wildcard hostname caching (cache-domains.txt leading-dot + optional cache-domains.regex); boost vs strict-allowlist toggle (CACHE_ONLY_LISTED). - Storage gate never caches HTML or dynamic content; query strings exempt on boosted domains so versioned static assets still cache. - splice-domains.txt passthrough for pinned/banking domains. - Deny-by-default http_access (TRUSTED_CIDR) + BIND_ADDR pinning; CA key 0600 on host, never embedded, git-ignored. - Wired into automations.sh, README, .gitignore; cloud-init for fresh VMs.
31 lines
983 B
Plaintext
31 lines
983 B
Plaintext
# splice-domains.txt
|
|
#
|
|
# Domains Squid must NOT decrypt. With SSL-bump, "splice" = transparent
|
|
# passthrough: the client's TLS goes straight to the origin, so these are
|
|
# NOT cached and NOT inspected. Use for cert-pinned apps, banking, app-store /
|
|
# OS update channels, and anything that breaks under interception.
|
|
#
|
|
# One entry per line; a LEADING DOT matches all subdomains (.apple.com matches
|
|
# www.apple.com, gs.apple.com, ...). Full-line "#" comments only.
|
|
#
|
|
# IMPORTANT: do not also list a domain here AND in cache-domains.txt -- splice
|
|
# wins, so it would never cache. Tune this list for your environment.
|
|
|
|
# ── OS / app-store update channels (commonly cert-pinned) ──
|
|
.apple.com
|
|
.icloud.com
|
|
.mzstatic.com
|
|
.windowsupdate.com
|
|
.update.microsoft.com
|
|
.android.clients.google.com
|
|
.play.googleapis.com
|
|
|
|
# ── Banking / payments (examples -- add your own) ──
|
|
.paypal.com
|
|
.stripe.com
|
|
|
|
# ── Messaging / pinned services ──
|
|
.whatsapp.net
|
|
.signal.org
|
|
.telegram.org
|