---
- name: Install and configure Squid proxy on Ubuntu 24
  hosts: squid_servers
  become: true
  vars:
    squid_port: 3128
    squid_localnet: 192.168.0.0/16   # Change to match your LAN

  tasks:

    - name: Update apt cache
      ansible.builtin.apt:
        update_cache: yes

    - name: Install squid package
      ansible.builtin.apt:
        name: squid
        state: present

    - name: Backup original squid.conf
      ansible.builtin.copy:
        src: /etc/squid/squid.conf
        dest: /etc/squid/squid.conf.bak
        remote_src: yes
        backup: yes
      when: not ansible_check_mode

    - name: Configure Squid for LAN access and HTTPS
      ansible.builtin.blockinfile:
        path: /etc/squid/squid.conf
        marker: "# {mark} ANSIBLE MANAGED BLOCK"
        block: |
          # Safe ports
          acl SSL_ports port 443
          acl Safe_ports port 80
          acl CONNECT method CONNECT

          # Access rules
          acl localnet src {{ squid_localnet }}
          http_access allow localnet
          http_access deny all

          http_port {{ squid_port }}
          cache_dir ufs /var/spool/squid 1000 16 256
          cache_mem 256 MB
          maximum_object_size 100 MB
          minimum_object_size 0 KB

          refresh_pattern -i \.rpm$ 1440 100% 10080
          refresh_pattern -i \.deb$ 1440 100% 10080
          refresh_pattern -i \.iso$ 1440 100% 10080
          refresh_pattern -i \.tar.gz$ 1440 100% 10080
          refresh_pattern -i \.zip$ 1440 100% 10080
          refresh_pattern ^http://deb.debian.org/ 1440 20% 10080
          refresh_pattern ^https://pkgs.k8s.io/ 1440 20% 10080
          refresh_pattern . 0 20% 4320


          # --- LOGGING ---
          access_log /var/log/squid/access.log
          cache_log /var/log/squid/cache.log
          cache_store_log /var/log/squid/store.log
      notify:
        - restart squid

    - name: Ensure Squid service is enabled and running
      ansible.builtin.service:
        name: squid
        state: started
        enabled: true

  handlers:
    - name: restart squid
      ansible.builtin.service:
        name: squid
        state: restarted