1d06b28064
- keepalived: pg_role='standby' hat Vorrang vor role für BACKUP-Bestimmung - keepalived-master.sh: gecrasht Dienste beim MASTER-Übergang starten (nicht nur reload) - confighash: ip_addresses per Interface-Name hashen statt per FK (Cross-Node-Drift-Fix) - TOTP/2FA: RFC 6238 — Setup-Flow, QR-Code, Admin-Disable; two-step Login - Firewall-UI: Enterprise-Design — auto-Beschreibung, icon-only Actions, zero-hit Indikator - fe80-Filter: Link-local IPv6 aus NTP/DNS Listen-Dropdowns entfernen - VIP-Dashboard, Dual-Path VRRP, GW-Tracking (Migrations 0033/0034) - Forward Proxy + DNS erweiterte Einstellungen (Migrations 0031/0032) - unbound-control: edgeguard in unbound-Gruppe via postinst Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
67 lines
2.1 KiB
Smarty
67 lines
2.1 KiB
Smarty
# Generated by edgeguard — do not edit by hand.
|
|
# Source: internal/squid/squid.go (template: squid.cfg.tpl).
|
|
# Re-generate via `edgeguard-ctl render-config --only=squid`.
|
|
|
|
{{range .ListenAddrs -}}
|
|
{{if .Addr}}http_port {{.Addr}}:{{.Port}}
|
|
{{else}}http_port {{.Port}}
|
|
{{end}}{{- end}}
|
|
|
|
cache_dir ufs /var/spool/squid {{.CacheDirMB}} 16 256
|
|
cache_mem {{.CacheMemMB}} MB
|
|
maximum_object_size {{.MaxObjSizeMB}} MB
|
|
|
|
# Logging — combined access log, rotated by logrotate.
|
|
access_log /var/log/squid/access.log squid
|
|
cache_log /var/log/squid/cache.log
|
|
|
|
# Standard safe defaults.
|
|
acl localnet src 10.0.0.0/8
|
|
acl localnet src 172.16.0.0/12
|
|
acl localnet src 192.168.0.0/16
|
|
acl localnet src fc00::/7
|
|
acl localnet src fe80::/10
|
|
|
|
acl SSL_ports port 443
|
|
acl Safe_ports port 80 # http
|
|
acl Safe_ports port 21 # ftp
|
|
acl Safe_ports port 443 # https
|
|
acl Safe_ports port 70 # gopher
|
|
acl Safe_ports port 210 # wais
|
|
acl Safe_ports port 1025-65535 # unregistered
|
|
acl Safe_ports port 280 # http-mgmt
|
|
acl Safe_ports port 488 # gss-http
|
|
acl Safe_ports port 591 # filemaker
|
|
acl Safe_ports port 777 # multiling http
|
|
acl CONNECT method CONNECT
|
|
|
|
# Operator-defined ACLs from /api/v1/forward-proxy-acls. Order is
|
|
# priority desc — first http_access match wins.
|
|
{{- range .ACLs}}
|
|
{{- if .Active}}
|
|
# {{if .Comment}}{{.Comment}}{{else}}{{.Name}} (priority {{.Priority}}){{end}}
|
|
acl {{.Name}} {{.ACLType}} {{.Value}}
|
|
http_access {{.Action}} {{.Name}}
|
|
{{- end}}
|
|
{{- end}}
|
|
|
|
# Built-in safety rules — same as squid's default; placed after
|
|
# operator-rules so they act as fallbacks, not overrides.
|
|
http_access deny !Safe_ports
|
|
http_access deny CONNECT !SSL_ports
|
|
http_access allow localhost manager
|
|
http_access deny manager
|
|
http_access allow localhost
|
|
# Default-policy: only localnet may use the proxy if no operator-rule
|
|
# explicitly allowed/denied. Stricter than squid's default to keep
|
|
# the proxy from becoming an open relay.
|
|
http_access allow localnet
|
|
http_access deny all
|
|
|
|
connect_timeout {{.ConnectTimeout}} seconds
|
|
read_timeout {{.ReadTimeout}} seconds
|
|
request_timeout {{.RequestTimeout}} seconds
|
|
|
|
visible_hostname edgeguard-proxy
|
|
forwarded_for on
|