# Mode forward proxy ##http_port {{ ansible_default_ipv4.address }}:{{ fwdport }} ##http_port [{{ ansible_default_ipv6.address }}]:{{ fwdport }} # Mode reverse proxy {% if auxport is defined %} {% for item in auxport %} http_port 127.0.0.1:{{ item }} accel ignore-cc http_port [::1]:{{ item }} accel ignore-cc {% endfor %} {% endif %} {% for item in iface %} http_port {{ item }}:{{ revport }} accel ignore-cc https_port {{ item }}:{{ revports }} accel ignore-cc \ cert=/etc/pki/tls/certs/casperlefantom.{{ crtversion }}.crt \ key=/etc/pki/tls/private/casperlefantom.{{ crtversion }}.key \ tls-dh=secp256k1:/etc/pki/tls/certs/dhparam-4096.pem \ crlfile=/etc/pki/tls/certs/crt-crl.pem \ cipher=HIGH:!aNULL:!MD5:!RC4 \ options=NO_SSLv3,CIPHER_SERVER_PREFERENCE \ sslflags=DELAYED_AUTH {% endfor %} {% for peer in peers %} cache_peer 127.0.0.1 parent {{ peer.0 }} 0 no-query originserver no-digest name={{ peer.1 }} acl {{ peer.2 }} dstdomain {{ peer.3 }} cache_peer_access {{ peer.1 }} allow {{ peer.2 }} http_access allow {{ peer.2 }} {% endfor %} {% for peer in peerssl %} cache_peer 127.0.0.1 parent {{ peer.0 }} 0 no-query originserver no-digest \ tls \ sslflags=DONT_VERIFY_PEER \ name={{ peer.1 }} acl {{ peer.2 }} dstdomain {{ peer.3 }} cache_peer_access {{ peer.1 }} allow {{ peer.2 }} http_access allow {{ peer.2 }} {% endfor %} # remove headers reply_header_access Allow allow all reply_header_access WWW-Authenticate allow all reply_header_access Proxy-Authenticate allow all reply_header_access Cache-Control allow all reply_header_access Content-Encoding allow all reply_header_access Content-Length allow all reply_header_access Content-Type allow all reply_header_access Date allow all reply_header_access Expires allow all reply_header_access Last-Modified allow all reply_header_access Location allow all reply_header_access Pragma allow all reply_header_access Content-Language allow all reply_header_access Retry-After allow all reply_header_access Title allow all reply_header_access Content-Disposition allow all reply_header_access Connection allow all reply_header_access Link allow all reply_header_access Etag allow all reply_header_access Keep-Alive allow all reply_header_access Transfer-Encoding allow all reply_header_access X-Robots-Tag allow all reply_header_access Accept-Ranges allow all reply_header_access Set-Cookie allow all reply_header_access X-Frame-Options allow all reply_header_access Referrer-Policy allow all reply_header_access Content-Security-Policy allow all reply_header_access X-Pingback allow all reply_header_access All deny all # logs access_log syslog:daemon.info \ logformat=combined cache_store_log syslog:daemon.info debug_options ALL,2 # infos admin cache_mgr {{ email }} visible_hostname {{ ansible_hostname }}.casperlefantom.net httpd_suppress_version_string on # augmenter la taille des objets maximum_object_size 6 MB cache_dir aufs /var/spool/squid 2048 16 256 # # Recommended minimum configuration: # # Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing # should be allowed acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN) acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN) acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN) acl localhet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN) acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN) acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT # # Recommended minimum Access Permission configuration: # # Deny requests to certain unsafe ports http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # Only allow cachemgr access from localhost http_access allow localhost manager http_access deny manager # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user #http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # # Example rule allowing access from your local networks. # Adapt localnet in the ACL section to list your (internal) IP networks # from where browsing should be allowed ##http_access allow localnet http_access allow localhost # And finally deny all other access to this proxy http_access deny all # Squid normally listens to port 3128 ##http_port 3128 # Uncomment and adjust the following to add a disk cache directory. #cache_dir ufs /var/spool/squid 100 16 256 # Leave coredumps in the first cache dir coredump_dir /var/spool/squid # # Add any of your own refresh_pattern entries above these. # refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320