52 lines
1.4 KiB
YAML
52 lines
1.4 KiB
YAML
squid_acl:
|
|
localnet:
|
|
- 'src 10.0.0.0/8 # RFC 1918 local private network (LAN)'
|
|
- 'src 172.16.0.0/12 # RFC 1918 local private network (LAN)'
|
|
- 'src 192.168.0.0/16 # RFC 1918 local private network (LAN)'
|
|
- 'src fc00::/7 # RFC 4193 local private network range'
|
|
- 'src fe80::/10 # RFC 4291 link-local (directly plugged) machines'
|
|
trusted:
|
|
- src 172.30.0.0/26
|
|
SSL_ports:
|
|
- port 443
|
|
Safe_ports:
|
|
- 'port 80 # http'
|
|
- 'port 443 # https'
|
|
CONNECT:
|
|
- method CONNECT
|
|
kickstart:
|
|
- url_regex rosalina.pyrocufflink.blue/~dustin/kickstart/.*\.ks$
|
|
fcos_updates:
|
|
- dstdomain updates.coreos.fedoraproject.org
|
|
- dstdomain ostree.fedoraproject.org
|
|
fedora_repo:
|
|
- dstdomain mirrors.fedoraproject.org
|
|
- dstdomain dl.fedoraproject.org
|
|
google_fonts:
|
|
- dstdomain fonts.googleapis.com
|
|
- dstdomain fonts.gstatic.com
|
|
grafana_rpm:
|
|
- dstdomain rpm.grafana.com
|
|
|
|
squid_http_access:
|
|
- 'deny !Safe_ports'
|
|
- 'deny CONNECT !SSL_ports'
|
|
- allow localhost manager
|
|
- deny manager
|
|
- deny to_localhost
|
|
- allow localnet fcos_updates
|
|
- allow localnet fedora_repo
|
|
- allow localnet grafana_rpm
|
|
- allow google_fonts
|
|
- allow trusted kickstart
|
|
- deny all
|
|
|
|
squid_cache_dir:
|
|
- ufs /var/cache/squid 20480 16 256
|
|
|
|
squid_refresh_pattern:
|
|
- \.{{ ansible_domain|replace('.', '\.') }} 0 0% 0
|
|
- repomd\.xml$ 0 0% 0
|
|
- (vmlinuz|(initrd|squashfs|install)\.img)$ 480 20% 10080
|
|
- \.rpm$ 86400 80% 2592000
|