build

roles/squid/tasks/main.yml

@@ -4,7 +4,7 @@
   become: true
   vars:
     squid_port: 3128
-    squid_localnet: 192.168.77.0/24   # Change to match your LAN
+    squid_localnet: 192.168.0.0/16   # Change to match your LAN
 
   tasks:
 
@@ -30,32 +30,36 @@
         path: /etc/squid/squid.conf
         marker: "# {mark} ANSIBLE MANAGED BLOCK"
         block: |
-          # Define ACL for local network
+          # Safe ports
-          acl localnet src {{ squid_localnet }}
-
-          # Define safe ports
           acl SSL_ports port 443
           acl Safe_ports port 80
-          acl Safe_ports port 443
           acl CONNECT method CONNECT
 
-          # Deny invalid ports
+          # Access rules
-          http_access deny !Safe_ports
+          acl localnet src {{ squid_localnet }}
-          http_access deny CONNECT !SSL_ports
-
-          # Allow localhost
-          http_access allow localhost
-
-          # Allow local network
           http_access allow localnet
-
-          # Deny everything else
           http_access deny all
 
-          # Listen port
           http_port {{ squid_port }}
+          cache_dir ufs /var/spool/squid 1000 16 256
+          cache_mem 256 MB
+          maximum_object_size 100 MB
+          minimum_object_size 0 KB
 
-          coredump_dir /var/spool/squid
+          refresh_pattern -i \.rpm$ 1440 100% 10080
+          refresh_pattern -i \.deb$ 1440 100% 10080
+          refresh_pattern -i \.iso$ 1440 100% 10080
+          refresh_pattern -i \.tar.gz$ 1440 100% 10080
+          refresh_pattern -i \.zip$ 1440 100% 10080
+          refresh_pattern ^http://deb.debian.org/ 1440 20% 10080
+          refresh_pattern ^https://pkgs.k8s.io/ 1440 20% 10080
+          refresh_pattern . 0 20% 4320
+
+
+          # --- LOGGING ---
+          access_log /var/log/squid/access.log
+          cache_log /var/log/squid/cache.log
+          cache_store_log /var/log/squid/store.log
       notify:
         - restart squid