search

voxpupuli / puppet-squid

Puppet module for configuration of squid caching proxy.
https://forge.puppet.com/puppet/squid
Other
12 stars 54 forks source link
bsd-puppet-module centos-puppet-module debian-puppet-module freebsd-puppet-module hacktoberfest linux-puppet-module oraclelinux-puppet-module puppet redhat-puppet-module scientific-puppet-module ubuntu-puppet-module

readme

Puppet module for Squid

Build Status Code Coverage Puppet Forge Puppet Forge - downloads Puppet Forge - endorsement Puppet Forge - scores

Description

Puppet module for configuring the squid caching service.

Usage

The set up a simple squid server with a cache to forward http port 80 requests.

class { 'squid': }
squid::acl { 'Safe_ports':
  type    => port,
  entries => ['80'],
}
squid::http_access { 'Safe_ports':
  action => allow,
}
squid::http_access{ '!Safe_ports':
  action => deny,
}

This module will set the SELINUX-context for the cache_dir and/or port, requires puppet-selinux

Parameters for squid Class

Parameters to the squid class almost map 1 to 1 to squid.conf parameters themselves.

class { 'squid':
  cache_mem    => '512 MB',
  workers      => 3,
  coredump_dir => '/var/spool/squid',
}
class { 'squid':
  cache_mem                 => '512 MB',
  workers                   => 3,
  coredump_dir              => '/var/spool/squid',
  acls                      => { 'remote_urls' => {
                                   type    => 'url_regex',
                                   entries => ['http://example.org/path',
                                               'http://example.com/anotherpath'],
                                 },
                               },
  http_access               => { 'our_networks hosts' => { action => 'allow', }},
  http_ports                => { '10000' => { options => 'accel vhost', }},
  snmp_ports                => { '1000' => { process_number => 3, }},
  cache_dirs                => { '/data/' => { type => 'ufs', options => '15000 32 256 min-size=32769', process_number => 2 }},
  url_rewrite_program       => '/usr/bin/squidguard -c /etc/squidguard/squidguard.conf',
  url_rewrite_children      => 12,
  url_rewrite_child_options => startup=1,
}

The acls, http_access, http_ports, snmp_port, cache_dirs lines above are equivalent to their examples below.

Defined Type squid::acl

Defines acl entries for a squid server.

squid::acl { 'remote_urls':
   type    => 'url_regex',
   entries => ['http://example.org/path',
               'http://example.com/anotherpath'],
}

would result in a multi entry squid acl

acl remote_urls url_regex http://example.org/path
acl remote_urls url_regex http://example.com/anotherpath

These may be defined as a hash passed to squid

Parameters for Type squid::acl

Defined Type squid::cache_dir

Defines cache_dir entries for a squid server.

squid::cache_dir { '/data':
  type           => 'ufs',
  options        => '15000 32 256 min-size=32769',
  process_number => 2,
}

Results in the squid configuration of

if ${processor} = 2
cache_dir ufs 15000 32 256 min-size=32769
endif

Parameters for Type squid::cache_dir

Defined Type squid::cache

Defines cache entries for a squid server.

squid::cache { 'our_network_hosts_acl':
  action    => 'deny',
  comment   => 'Our networks hosts are denied for caching',
}

Adds a squid.conf line

# Our networks hosts denied for caching
cache deny our_network_hosts_acl

Defined Type squid::http_access

Defines http_access entries for a squid server.

squid::http_access { 'our_networks hosts':
  action => 'allow',
}

Adds a squid.conf line

# http_access fragment for out_networks hosts
http_access allow our_networks hosts
squid::http_access { 'our_networks hosts':
  action    => 'allow',
  comment   => 'Our networks hosts are allowed',
}

Adds a squid.conf line

# Our networks hosts are allowed
http_access allow our_networks hosts

Define Type squid::send_hit

Defines send_hit for a squid server.

squid:::send_hit{'PragmaNoCache':
  action => 'deny',
}

Adds a squid.conf line

send_hit deny PragmaNoCache

Parameters for Type squid::send\hit

value defaults to the namevar. The rule to allow or deny. action must one of deny or allow order by default is 05. comment A comment to add to the configuration file.

Defined Type squid::snmp_access

Defines snmp_access entries for a squid server.

squid::snmp_access { 'monitoring hosts':
  action => 'allow',
}

Adds a squid.conf line

# snmp_access fragment for monitoring hosts
snmp_access allow monitoring hosts
squid::snmp_access { 'monitoring hosts':
  action    => 'allow',
  comment   => 'Our monitoring hosts are allowed',
}

Adds a squid.conf line

# Our monitoring hosts are allowed
snmp_access allow monitoring hosts

These may be defined as a hash passed to squid

Defined Type squid::icp_access

Defines icp_access entries for a squid server.

squid::icp_access { 'our_networks hosts':
  action => 'allow',
}

Adds a squid.conf line

icp_access allow our_networks hosts

These may be defined as a hash passed to squid

Parameters for Type squid::http_allow

Defined Type Squid::Http_port

Defines http_port entries for a squid server. By setting optional ssl parameter to true will create https_port entries instead.

squid::http_port { '10000':
  options => 'accel vhost'
}
squid::http_port { '10001':
  ssl     => true,
  options => 'cert=/etc/squid/ssl_cert/server.cert key=/etc/squid/ssl_cert/server.key'
}
squid::http_port { '127.0.0.1:3128':
}

Results in a squid configuration of

http_port 10000 accel vhost
https_port 10001 cert=/etc/squid/ssl_cert/server.cert key=/etc/squid/ssl_cert/server.key
http_port 127.0.0.1:3128

Parameters for Type squid::http_port

Defined Type Squid::Https_port

Defines https_port entries for a squid server. As an alternative to using the Squid::Http_port defined type with ssl set to true, you can use this type instead. The result is the same. Internally this type uses Squid::Http_port to create the configuration entries.

Parameters for Type squid::https_port

Defined Type squid::url_rewrite_program

Defines url_rewrite_program for a squid server.

squid::url_rewrite_program { '/usr/bin/squidGuard -c /etc/squidguard/squidGuard.conf':
  children      => 8,
  child_options => 'startup=0 idle=1 concurrency=0',
}

would result in the following squid url rewrite program

url_rewrite_program /usr/bin/squidGuard -c /etc/squidguard/squidGuard.conf
url_rewrite_children 8 startup=0 idle=1 concurrency=0

Defined Type squid::refresh_pattern

Defines refresh_pattern entries for a squid server.

squid::refresh_pattern { '^ftp:':
  min     => 1440,
  max     => 10080,
  percent => 20,
  order   => 60,
}

squid::refresh_pattern { '(/cgi-bin/|\?)':
  case_sensitive => false,
  min            => 0,
  max            => 0,
  percent        => 0,
  order          => 61,
}

would result in the following squid refresh patterns

# refresh_pattern fragment for ^ftp
refresh_pattern ^ftp: 1440 20% 10080
# refresh_pattern fragment for (/cgi-bin/|\?)
refresh_pattern (/cgi-bin/|\?) -i 0 0% 0

These may be defined as a hash passed to squid

YAML example:

squid::refresh_patterns:
  '^ftp':
    max:     10080
    min:     1440
    percent: 20
    order:   '60'
  '^gopher':
    max:     1440
    min:     1440
    percent: 0
    order:   '61'
  '(/cgi-bin/|\?)':
    case_sensitive: false
    max:            0
    min:            0
    percent:        0
    order:          '62'
  '.':
    max:     4320
    min:     0
    percent: 20
    order:   '63'

Parameters for Type squid::refresh_pattern

Defined Type Squid::Snmp_port

Defines snmp_port entries for a squid server.

squid::snmp_port { '1000':
  process_number => 3
}

Results in a squid configuration of

if ${process_number} = 3
snmp_port 1000
endif

Parameters for Type squid::http_port

Defined Type squid::auth_param

Defines auth_param entries for a squid server.

squid::auth_param { 'basic auth_param':
  scheme  => 'basic',
  entries => [
    'program /usr/lib64/squid/basic_ncsa_auth /etc/squid/.htpasswd',
    'children 5',
    'realm Squid Basic Authentication',
    'credentialsttl 5 hours',
  ],
}

would result in multi entry squid auth_param

auth_param basic program /usr/lib64/squid/basic_ncsa_auth /etc/squid/.htpasswd
auth_param basic children 5
auth_param basic realm Squid Basic Authentication
auth_param basic credentialsttl 5 hours

These may be defined as a hash passed to squid

Parameters for Type squid::auth_param

Defined Type squid::ssl_bump

Defines ssl_bump entries for a squid server.

squid::ssl_bump { 'all':
  action => 'bump',
}

Adds a squid.conf line

ssl_bump bump all

These may be defined as a hash passed to squid

Parameters for Type squid::ssl_bump

Defined Type squid::sslproxy_cert_error

Defines sslproxy_cert_error entries for a squid server.

squid::sslproxy_cert_error { 'all':
  action => 'allow',
}

Adds a squid.conf line

sslproxy_cert_error allow all

These may be defined as a hash passed to squid

Parameters for Type squid::sslproxy_cert_error

Defined Type squid::extra_config_section

Squid has a large number of configuration directives. Not all of these have been exposed individually in this module. For those that haven't, the extra_config_section defined type can be used.

Using a hash of config_entries:

squid::extra_config_section { 'mail settings':
  order          => '60',
  config_entries => {
    'mail_from'    => 'squid@example.com',
    'mail_program' => 'mail',
  },
}

Results in a squid configuration of

# mail settings
mail_from squid@example.com
mail_program mail

Using an array of config_entries:

squid::extra_config_section { 'ssl_bump settings':
  order          => '60',
  config_entries => {
    'ssl_bump'         => ['server-first', 'all'],
    'sslcrtd_program'  => ['/usr/lib64/squid/ssl_crtd', '-s', '/var/lib/ssl_db', '-M', '4MB'],
    'sslcrtd_children' => ['8', 'startup=1', 'idle=1'],
  }
}

Results in a squid configuration of

# ssl_bump settings
ssl_bump server-first all
sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB
sslcrtd_children 8 startup=1 idle=1

Using an array of hashes of config_entries:

squid::extra_config_section { 'always_directs':
  order          => '60',
  config_entries => [{
    'always_direct' => ['deny    www.reallyreallybadplace.com',
                        'allow   my-good-dst',
                        'allow   my-other-good-dst'],
  }],
}

Results in a squid configuration of

# always_directs
always_direct deny    www.reallyreallybadplace.com
always_direct allow   my-good-dst
always_direct allow   my-other-good-dst

Parameters for Type squid::extra_config_section