57_Wolve
e7ba68790b
New deployments/squid/: an explicit forward proxy with SSL-bump TLS interception (local CA, generated on first deploy) and hostname-targeted static-content caching. Unlike the other stacks it is a forward proxy, not a Caddy/Let's-Encrypt inbound site. - Self-built minimal Alpine image (apk squid ships ssl-bump); entrypoint renders squid.conf and generates the cache policy from the domain lists. - Wildcard hostname caching (cache-domains.txt leading-dot + optional cache-domains.regex); boost vs strict-allowlist toggle (CACHE_ONLY_LISTED). - Storage gate never caches HTML or dynamic content; query strings exempt on boosted domains so versioned static assets still cache. - splice-domains.txt passthrough for pinned/banking domains. - Deny-by-default http_access (TRUSTED_CIDR) + BIND_ADDR pinning; CA key 0600 on host, never embedded, git-ignored. - Wired into automations.sh, README, .gitignore; cloud-init for fresh VMs.
38 lines
1.5 KiB
Plaintext
38 lines
1.5 KiB
Plaintext
# ── Secrets / runtime config ────────────────────────────────────────────────
|
|
# Populated env / config files (keep the *.example templates).
|
|
.env
|
|
**/.env
|
|
globals/globals.env
|
|
ssh-notify.conf
|
|
auto-update.conf
|
|
!*.env.example
|
|
!**/.env.example
|
|
!*.conf.example
|
|
|
|
# ── Private keys (NEVER commit) ─────────────────────────────────────────────
|
|
# age identities and SSH private keys. globals/age-pubkey.txt and
|
|
# globals/authorized_keys are PUBLIC and intentionally tracked.
|
|
*-private-key.txt
|
|
*age-key*
|
|
*.age.key
|
|
id_ed25519
|
|
id_ed25519_*
|
|
*.pem
|
|
|
|
# Squid TLS-interception CA -- generated on the host at deploy time, never
|
|
# committed (the private key can MITM any client that trusts it).
|
|
deployments/squid/ssl/
|
|
|
|
# ── Backups ─────────────────────────────────────────────────────────────────
|
|
*.tar.gz.age
|
|
*-backup-*.tar.gz*
|
|
|
|
# ── Build output ────────────────────────────────────────────────────────────
|
|
dist/
|
|
|
|
# ── Editor / OS noise ───────────────────────────────────────────────────────
|
|
*.tmp
|
|
*.swp
|
|
.DS_Store
|
|
Thumbs.db
|