API tools faq
paste
Advertisement
Guest User

squid-external.conf.mas

a guest
Nov 13th, 2013
187
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.61 KB | None | 0 0
raw download clone embed print report
  1. <%doc>
  2. Main configuration file for Squid daemon
  3.  
  4. Parameters:
  5.  
  6. snmpEnabled - Boolean indicating if SNMP is enabled or not
  7. </%doc>
  8. <%args>
  9. $port
  10. $transparent => undef
  11.  
  12. $hostfqdn
  13. $realm => ''
  14.  
  15. $memory
  16. $cacheDirSize
  17. $max_object_size
  18.  
  19. @nameservers
  20. $append_domain
  21.  
  22. $cache_host
  23. $cache_port
  24. $cache_user
  25. $cache_passwd
  26.  
  27. $urlRewriteProgram => undef
  28. @objectsDelayPools
  29. @notCachedDomains
  30.  
  31. $snmpEnabled => 0
  32. </%args>
  33. <%shared>
  34. our $anyPrefix = 'any_src_';
  35. our $maxAclNameLength = 31;
  36. our %longAclNames = ();
  37. </%shared>
  38. <%perl>
  39. # needed because space scape doesnt work in acl names
  40. sub _escapeWS
  41. {
  42. my ($string) = @_;
  43. $string =~ s{ }{__}g;
  44. return $string;
  45. }
  46. # needed to avoid log acl problems
  47. sub _aclName
  48. {
  49. my ($name) = @_;
  50. if (length($name) <= $maxAclNameLength) {
  51. return _escapeWS($name);
  52. }
  53.  
  54. if (not exists $longAclNames{$name}) {
  55. my $nextId = 1 + keys %longAclNames;
  56. $nextId = 'longAcl' . $nextId;
  57. $longAclNames{$name} = $nextId;
  58. }
  59.  
  60. return _escapeWS($longAclNames{$name});
  61. }
  62. </%perl>
  63. <%def .rulesACLs>
  64. <%args>
  65. @rules
  66. $realm
  67. </%args>
  68. % foreach my $rule (@rules) {
  69. % if ($rule->{any}) {
  70. <& .timeACLs, rule => $rule, id => $anyPrefix . $rule->{number} &>
  71. % next;
  72. % }
  73. % my $object = $rule->{object};
  74. % my $group = $rule->{group};
  75. % my $src = $object ? $object : $group;
  76. % my $aclName = _aclName($src);
  77. % if ($object) {
  78. acl <% $aclName %> src <% join ' ', @{ $rule->{addresses} } %>
  79. % } else {
  80. % # escape user names
  81. % my @users = map { $_ =~ s{ }{\\ }g; $_ } @{$rule->{users}};
  82. % if ($realm) {
  83. % @users = map { $_ . '@' . $realm } @users;
  84. % }
  85. acl <% $aclName %> proxy_auth <% join (' ', @users) %>
  86. % }
  87. <& .timeACLs, rule => $rule, id => $src &>
  88. % }
  89. </%def>
  90.  
  91. <%def .timeACLs>
  92. <%args>
  93. $rule
  94. $id
  95. </%args>
  96. % if ($rule->{timeDays}) {
  97. acl <% _aclName('timeDays_' . $id) %> time <% $rule->{timeDays} %>
  98. % }
  99. % if ($rule->{timeHours}) {
  100. acl <% _aclName('timeHours_' . $id) %> time <% $rule->{timeHours} %>
  101. % }
  102. </%def>
  103.  
  104. <%def .delayPools>
  105. <%args>
  106. @objectsDelayPools
  107. </%args>
  108. % if ( @objectsDelayPools ) {
  109. % my $pools = @objectsDelayPools;
  110. delay_pool_uses_indirect_client on
  111. delay_pools <% $pools %>
  112. % }
  113. <%perl>
  114. my $id = 0;
  115. foreach my $objPool (@objectsDelayPools) {
  116. $id++;
  117. my $rate = $objPool->{rate};
  118. if ($rate > 0) {
  119. $rate *= 1024;
  120. }
  121. my $size = $objPool->{size};
  122. if ($size > 0) {
  123. $size *= 1024 * 1024;
  124. }
  125. </%perl>
  126. delay_class <% $id %> <% $objPool->{class} %>
  127. % if ( $objPool->{class} eq '1' ) {
  128. delay_parameters <% $id %> <% $rate %>/<% $size %>
  129. % } elsif ( $objPool->{class} eq '2' ) {
  130. <%perl>
  131. my $clt_rate = $objPool->{clt_rate};
  132. if ($clt_rate > 0) {
  133. $clt_rate *= 1024;
  134. }
  135. my $clt_size = $objPool->{clt_size};
  136. if ($clt_size > 0) {
  137. $clt_size *= 1024 * 1024;
  138. }
  139. </%perl>
  140. delay_parameters <% $id %> <% $rate %>/<% $size %> <% $clt_rate %>/<% $clt_size %>
  141. % }
  142. delay_initial_bucket_level 90
  143. delay_access <% $id %> allow <% $objPool->{object} %>
  144. delay_access <% $id %> deny all
  145. % }
  146. </%def>
  147.  
  148. <%def .snmp>
  149. <%doc>
  150. Define the SNMP configuration as SNMP agent
  151. </%doc>
  152. acl snmppublic snmp_community public
  153. snmp_port 3401
  154. snmp_access allow snmppublic from_localhost
  155. snmp_access deny all
  156. </%def>
  157. ###################################################################################
  158. http_port localhost:<% $port %> ignore-cc
  159.  
  160.  
  161. visible_hostname (external)<% $hostfqdn %>
  162.  
  163. coredump_dir /var/spool/squid3
  164. cache_effective_user proxy
  165. cache_effective_group proxy
  166. cache_mem 640 MB
  167. maximum_object_size_in_memory 256 KB
  168. cache_dir diskd /var/spool/squid3 <% $cacheDirSize %> 16 256
  169. maximum_object_size 800 MB
  170. buffered_logs on
  171. client_db off
  172. pipeline_prefetch on
  173. ipcache_size 10240
  174. memory_pools off
  175. redirect_children 55
  176. range_offset_limit 200 MB
  177. quick_abort_min -1
  178. access_log /var/log/squid3/external-access.log squid
  179. cache_log /var/log/squid3/external-cache.log
  180. cache_store_log /var/log/squid3/external-store.log
  181. pid_filename /var/run/squid3-external.pid
  182.  
  183. % if (@nameservers) {
  184. % my $dns_nameservers = '';
  185. % foreach my $srv (@nameservers) {
  186. % $dns_nameservers .= "$srv ";
  187. % }
  188. dns_nameservers <% $dns_nameservers %>
  189. % }
  190. % if ($append_domain) {
  191. append_domain .<% $append_domain %>
  192. % }
  193.  
  194. # refresh patterns
  195.  
  196. # windows updates
  197. refresh_pattern http://.*\.windowsupdate\.microsoft\.com/ 0 80% 20160 reload-into-ims
  198. refresh_pattern http://.*\.update\.microsoft\.com/ 0 80% 20160 reload-into-ims
  199. refresh_pattern http://download\.microsoft\.com/ 0 80% 20160 reload-into-ims
  200. refresh_pattern http://windowsupdate\.microsoft\.com/ 0 80% 20160 reload-into-ims
  201. refresh_pattern http://.*\.download\.windowsupdate\.com/ 0 80% 20160 reload-into-ims
  202. refresh_pattern http://office\.microsoft\.com/ 0 80% 20160 reload-into-ims
  203. refresh_pattern http://w?xpsp[0-9]\.microsoft\.com/ 0 80% 20160 reload-into-ims
  204. refresh_pattern http://w2ksp[0-9]\.microsoft\.com/ 0 80% 20160 reload-into-ims
  205.  
  206. # linux updates
  207. refresh_pattern http://.*\.archive\.ubuntu\.com/ 0 80% 20160 reload-into-ims
  208. refresh_pattern http://(ftp|http)[0-9]*\.[a-z]+\.debian\.org/ 0 80% 20160 reload-into-ims
  209.  
  210. refresh_pattern ^ftp: 1440 20% 10080
  211. refresh_pattern ^gopher: 1440 0% 1440
  212. refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
  213. refresh_pattern . 0 20% 4320
  214.  
  215. # end refresh patterns
  216.  
  217. % if ($cache_host and $cache_port) {
  218. % my $peerAuth = '';
  219. % if ($cache_user and $cache_passwd) {
  220. # WARN: remember that for squid auth % are HTML escapes
  221. % $peerAuth = 'login=' . $cache_user . ':' . $cache_passwd;
  222. % }
  223. cache_peer <% $cache_host %> parent <% $cache_port %> 0 no-query no-digest <% $peerAuth %>
  224. % }
  225.  
  226. % if ($urlRewriteProgram) {
  227. url_rewrite_program <% $urlRewriteProgram %>
  228. % }
  229.  
  230. <& .rulesACLs, rules => [ @objectsDelayPools ], realm => $realm &>
  231. acl_uses_indirect_client on
  232.  
  233. # no cache domains acl
  234. % foreach my $domain (@notCachedDomains) {
  235. acl noCached dstdomain <% $domain %>
  236. % }
  237.  
  238.  
  239. acl from_localhost src 127.0.0.0/8 ::1
  240. acl to_localhost dst 127.0.0.0/8 ::1
  241. acl manager url_regex -i ^cache_object:// +i ^https?://[^/]+/squid-internal-mgr/
  242. acl SSL_ports port 443 # https, snews
  243. acl SSL_ports port 873 # rsync
  244. acl Safe_ports port 80 # http
  245. acl Safe_ports port 21 # ftp
  246. acl Safe_ports port 443 563 # https, snews
  247. acl Safe_ports port 70 # gopher
  248. acl Safe_ports port 210 # wais
  249. acl Safe_ports port 1025-65535 # unregistered ports
  250. acl Safe_ports port 280 # http-mgmt
  251. acl Safe_ports port 488 # gss-http
  252. acl Safe_ports port 591 # filemaker
  253. acl Safe_ports port 631 # cups
  254. acl Safe_ports port 777 # multiling http
  255. acl Safe_ports port 873 # rsync
  256. acl Safe_ports port 901 # SWAT
  257.  
  258. acl CONNECT method CONNECT
  259. acl purge method PURGE
  260.  
  261.  
  262. follow_x_forwarded_for allow from_localhost
  263. log_uses_indirect_client on
  264.  
  265. http_access allow manager to_localhost
  266.  
  267. http_access deny manager
  268. http_access deny purge
  269. #http_access deny !Safe_ports
  270.  
  271. #http_access deny CONNECT !SSL_ports
  272. http_access allow from_localhost
  273.  
  274. # we use firewall to deny clients from the outside
  275. http_access allow all
  276. % if ($cache_host and $cache_port) {
  277. never_direct allow all
  278. % }
  279.  
  280. <& .delayPools, objectsDelayPools => \@objectsDelayPools &>
  281.  
  282. % if ( $snmpEnabled ) {
  283. <& .snmp &>
  284. % }
  285.  
  286. always_direct allow to_localhost
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!