Skip to content

devops: update squid to v6 #282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mxschmitt wants to merge 5 commits into
base: main
Choose a base branch
from
Open

devops: update squid to v6 #282

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7f64cb4
devops: update squid to v6
mxschmitt Sep 12, 2024
639bc27
update to 6
mxschmitt Nov 4, 2025
2935ab9
speculative fix
mxschmitt Nov 4, 2025
4286052
nit
mxschmitt Nov 4, 2025
584b0e1
fixes
mxschmitt Nov 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions squid/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
FROM alpine:3.16
FROM alpine:3.20

EXPOSE 3128

ADD ./squid/squid.conf /etc/squid/squid.con
ADD ./squid/squid.conf /etc/squid/squid.conf

RUN apk add squid=5.5-r1
RUN apk add squid=6.9-r0

ENTRYPOINT ["squid", "-f", "/etc/squid/squid.conf", "-NYCd", "1"]
14 changes: 14 additions & 0 deletions squid/squid.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,12 @@
# should be allowed
acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN)

# Deny access to private IP ranges as destinations (prevent access to internal services)
acl private_dst dst 10.0.0.0/8 # RFC 1918
acl private_dst dst 172.16.0.0/12 # RFC 1918
acl private_dst dst 192.168.0.0/16 # RFC 1918
acl private_dst dst 127.0.0.0/8 # Loopback

acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 443 # https
Expand All @@ -16,6 +22,9 @@ http_access deny !Safe_ports
# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Deny access to private IP destinations (internal services)
http_access deny private_dst

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager
Expand All @@ -28,9 +37,14 @@ http_access deny to_localhost
#
# INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
#
http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Disable caching (forward proxy only)
cache deny all

# Squid normally listens to port 3128
http_port 3128
Loading