Skip to content

Commit 3602dc9

Browse files
sjpbsd109
sjpb
and
sd109
authored
Add squid role (#401)
* add squid role + config * make systemd proxy config idempotent (and clearer) * fix defaults for squid/builder * bump CI image * fix squid cache dir definition error * Fix squid README nits Co-authored-by: Scott Davidson <[email protected]> * Fix squid README nits Co-authored-by: Scott Davidson <[email protected]> * Fix squid README nits Co-authored-by: Scott Davidson <[email protected]> * Fix squid README nits Co-authored-by: Scott Davidson <[email protected]> * make proxy default to squid port --------- Co-authored-by: Scott Davidson <[email protected]>
1 parent 7ee7eee commit 3602dc9

File tree

17 files changed

+197
-11
lines changed

17 files changed

+197
-11
lines changed

‎ansible/.gitignore

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,6 @@ roles/*
5353
!roles/persist_hostkeys/
5454
!roles/persist_hostkeys/**
5555
!roles/ofed/
56-
!roles/ofed/**
56+
!roles/ofed/**
57+
!roles/squid/
58+
!roles/squid/**

‎ansible/bootstrap.yml

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,6 @@
4646
path: /etc/profile
4747
search_string: HOSTNAME=$(/usr/bin/hostnamectl --transient 2>/dev/null) || \
4848
state: absent
49-
- name: Remove RHEL cockpit
50-
dnf:
51-
name: cockpit-ws
52-
state: "{{ appliances_cockpit_state }}"
5349
- name: Add system user groups
5450
ansible.builtin.group: "{{ item.group }}"
5551
loop: "{{ appliances_local_users }}"
@@ -91,6 +87,16 @@
9187
policy: "{{ selinux_policy }}"
9288
register: sestatus
9389

90+
# --- tasks after here require access to package repos ---
91+
- hosts: squid
92+
tags: squid
93+
gather_facts: yes
94+
become: yes
95+
tasks:
96+
- name: Configure squid proxy
97+
import_role:
98+
name: squid
99+
94100
- hosts: freeipa_server
95101
# Done here as it might be providing DNS
96102
tags:
@@ -104,7 +110,15 @@
104110
name: freeipa
105111
tasks_from: server.yml
106112

107-
# --- tasks after here require access to package repos ---
113+
- hosts: cluster
114+
gather_facts: false
115+
become: yes
116+
tags: cockpit
117+
tasks:
118+
- name: Remove RHEL cockpit
119+
dnf:
120+
name: cockpit-ws
121+
state: "{{ appliances_cockpit_state }}"
108122

109123
- hosts: firewalld
110124
gather_facts: false

‎ansible/roles/proxy/tasks/main.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,10 @@
4343
path: /etc/systemd/system.conf.d/90-proxy.conf
4444
section: Manager
4545
option: DefaultEnvironment
46-
value: >
47-
"http_proxy={{ proxy_http_proxy }}" "https_proxy={{ proxy_http_proxy }}" "no_proxy={{ proxy_no_proxy }}"
46+
value: >-
47+
"http_proxy={{ proxy_http_proxy }}"
48+
"https_proxy={{ proxy_http_proxy }}"
49+
"no_proxy={{ proxy_no_proxy }}"
4850
no_extra_spaces: true
4951
owner: root
5052
group: root

‎ansible/roles/squid/README.md

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# squid
2+
3+
Deploy a caching proxy.
4+
5+
**NB:** The default configuration is aimed at providing a proxy for package installs etc. for
6+
nodes which do not have direct internet connectivity. It assumes access to the proxy is protected
7+
by the OpenStack security groups applied to the cluster. The generated configuration should be
8+
reviewed if this is not case.
9+
10+
## Role Variables
11+
12+
Where noted these map to squid parameters of the same name without the `squid_` prefix - see [squid documentation](https://www.squid-cache.org/Doc/config) for details.
13+
14+
- `squid_conf_template`: Optional str. Path (using Ansible search paths) to squid.conf template. Default is in-role template.
15+
- `squid_started`: Optional bool. Whether to start squid service. Default `true`.
16+
- `squid_enabled`: Optional bool. Whether squid service is enabled on boot. Default `true`.
17+
- `squid_cache_mem`: Required str. Size of memory cache, e.g "1024 KB", "12 GB" etc. See squid parameter.
18+
- `squid_cache_dir`: Optional. Path to cache directory. Default `/var/spool/squid`.
19+
- `squid_cache_disk`: Required int. Size of disk cache in MB. See Mbytes under "ufs" store type for squid parameter [cache_dir](https://www.squid-cache.org/Doc/config/cache_dir/).
20+
- `squid_maximum_object_size_in_memory`: Optional str. Upper size limit for objects in memory cache, default '64 MB'. See squid parameter.
21+
- `squid_maximum_object_size`: Optional str. Upper size limit for objects in disk cache, default '200 MB'. See squid parameter.
22+
- `squid_http_port`: Optional str. Socket addresses to listen for client requests, default '3128'. See squid parameter.
23+
- `squid_acls`: Optional str, can be multiline. Define access lists. Default `acl anywhere src all`, i.e. rely on OpenStack security groups (or other firewall if deployed). See squid parameter `acl`. NB: The default template also defines acls for `SSL_ports` and `Safe_ports` as is common practice.
24+
- `squid_http_access`: Optional str, can be multiline. Allow/deny access based on access lists. Default:
25+
26+
# Deny requests to certain unsafe ports
27+
http_access deny !Safe_ports
28+
# Deny CONNECT to other than secure SSL ports
29+
http_access deny CONNECT !SSL_ports
30+
# Only allow cachemgr access from localhost
31+
http_access allow localhost manager
32+
http_access deny manager
33+
# Rules allowing http access
34+
http_access allow anywhere
35+
http_access allow localhost
36+
# Finally deny all other access to this proxy
37+
http_access deny all
38+
39+
See squid parameter.

‎ansible/roles/squid/defaults/main.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
squid_conf_template: squid.conf.j2
2+
squid_started: true
3+
squid_enabled: true
4+
5+
squid_cache_mem: "{{ undef(hint='squid_cache_mem required, e.g. \"12 GB\"') }}"
6+
squid_cache_dir: /var/spool/squid
7+
squid_cache_disk: "{{ undef(hint='squid_cache_disk (in MB) required, e.g. \"1024\"') }}" # always in MB
8+
squid_maximum_object_size_in_memory: '64 MB'
9+
squid_maximum_object_size: '200 MB'
10+
squid_http_port: 3128
11+
squid_acls: acl anywhere src all # rely on openstack security groups
12+
squid_http_access: |
13+
# Deny requests to certain unsafe ports
14+
http_access deny !Safe_ports
15+
# Deny CONNECT to other than secure SSL ports
16+
http_access deny CONNECT !SSL_ports
17+
# Only allow cachemgr access from localhost
18+
http_access allow localhost manager
19+
http_access deny manager
20+
# Rules allowing http access
21+
http_access allow anywhere
22+
http_access allow localhost
23+
# Finally deny all other access to this proxy
24+
http_access deny all

‎ansible/roles/squid/handlers/main.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
- name: Restart squid
2+
service:
3+
name: squid
4+
state: restarted
5+
when: squid_started | bool

‎ansible/roles/squid/tasks/configure.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
- name: Ensure squid cache directory exists
2+
file:
3+
path: "{{ squid_cache_dir }}"
4+
# based on what dnf package creates:
5+
owner: squid
6+
group: squid
7+
mode: u=rwx,g=rw,o=
8+
9+
- name: Template squid configuration
10+
template:
11+
src: "{{ squid_conf_template }}"
12+
dest: /etc/squid/squid.conf
13+
owner: squid
14+
group: squid
15+
mode: ug=rwX,go=
16+
notify: Restart squid
17+
18+
- meta: flush_handlers
19+
20+
- name: Ensure squid service state
21+
systemd:
22+
name: squid
23+
state: "{{ 'started' if squid_started | bool else 'stopped' }}"
24+
enabled: "{{ true if squid_enabled else false }}"

‎ansible/roles/squid/tasks/install.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
- name: Install squid package
2+
dnf:
3+
name: squid

‎ansible/roles/squid/tasks/main.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
- import_tasks: install.yml
2+
- import_tasks: configure.yml

‎ansible/roles/squid/templates/squid.conf.j2

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#
2+
# Based on combination of configs from
3+
# - https://github.com/stackhpc/docker-squid/blob/master/squid.conf
4+
# - https://github.com/drosskopp/squid-cache/blob/main/squid.conf
5+
#
6+
7+
# Define ACLs:
8+
{{ squid_acls }}
9+
10+
acl SSL_ports port 443
11+
acl Safe_ports port 80 # http
12+
acl Safe_ports port 21 # ftp
13+
acl Safe_ports port 443 # https
14+
acl Safe_ports port 70 # gopher
15+
acl Safe_ports port 210 # wais
16+
acl Safe_ports port 1025-65535 # unregistered ports
17+
acl Safe_ports port 280 # http-mgmt
18+
acl Safe_ports port 488 # gss-http
19+
acl Safe_ports port 591 # filemaker
20+
acl Safe_ports port 777 # multiling http
21+
acl CONNECT method CONNECT
22+
23+
# Rules allowing http access
24+
{{ squid_http_access}}
25+
26+
# Squid normally listens to port 3128
27+
http_port {{ squid_http_port }}
28+
29+
# Define cache parameters:
30+
cache_dir ufs /var/spool/squid {{ squid_cache_disk | int }} 16 256
31+
cache_mem {{ squid_cache_mem }}
32+
maximum_object_size_in_memory {{ squid_maximum_object_size_in_memory }}
33+
maximum_object_size {{ squid_maximum_object_size }}
34+
35+
# Keep largest objects around longer:
36+
cache_replacement_policy heap LFUDA
37+
38+
memory_replacement_policy heap GDSF
39+
40+
# Leave coredumps in the first cache dir
41+
coredump_dir /var/spool/squid
42+
43+
# Configure refresh
44+
# cache repodata only few minutes and then query parent whether it is fresh:
45+
refresh_pattern /XMLRPC/GET-REQ/.*/repodata/.*$ 0 1% 1440 ignore-no-cache reload-into-ims refresh-ims
46+
# rpm will hardly ever change, force it to cache for very long time:
47+
refresh_pattern \.rpm$ 10080 100% 525960 override-expire override-lastmod ignore-reload reload-into-ims
48+
refresh_pattern ^ftp: 1440 20% 10080
49+
refresh_pattern ^gopher: 1440 0% 1440
50+
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
51+
refresh_pattern . 0 20% 4320
52+
53+
# Disable squid doing logfile rotation as the RockyLinux dnf package configures logrotate
54+
logfile_rotate 0

‎environments/.stackhpc/inventory/extra_groups

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,7 @@ cluster
2727
# Allows demo; also installs manila client in fat image
2828
login
2929
compute
30+
31+
[squid:children]
32+
# Install squid into fat image
33+
builder

‎environments/.stackhpc/terraform/main.tf

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,8 @@ variable "cluster_image" {
2929
description = "single image for all cluster nodes, keyed by os_version - a convenience for CI"
3030
type = map(string)
3131
default = {
32-
# https://github.com/stackhpc/ansible-slurm-appliance/pull/399
33-
RL8: "openhpc-RL8-240619-0949-66c0e540"
34-
RL9: "openhpc-ofed-RL9-240619-0949-66c0e540"
32+
RL8: "openhpc-RL8-240619-0949-66c0e540" # https://github.com/stackhpc/ansible-slurm-appliance/pull/399
33+
RL9: "openhpc-ofed-RL9-240621-1308-96959324" # https://github.com/stackhpc/ansible-slurm-appliance/pull/401
3534
}
3635
}
3736

‎environments/common/inventory/group_vars/all/proxy.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# default proxy address to first squid api address port 3128 if squid group non-empty, else empty string to avoid breaking hostvars
2+
proxy_http_proxy: "{{ 'http://' + hostvars[groups['squid'].0].api_address + ':' + squid_http_port if groups['squid'] else '' }}"

‎environments/common/inventory/group_vars/all/squid.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
squid_http_port: 3128 # defined here for proxy role

‎environments/common/inventory/group_vars/builder/defaults.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,7 @@ opensearch_state: stopped # avoid writing config+certs+db into image
1616
cuda_persistenced_state: stopped # probably don't have GPU in Packer build VMs
1717
firewalld_enabled: false # dnf install of firewalld enables it
1818
firewalld_state: stopped
19+
squid_started: false
20+
squid_enabled: false
21+
squid_cache_disk: 0 # just needs to be defined
22+
squid_cache_mem: 0

‎environments/common/inventory/groups

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ openhpc
3232
opensearch
3333
filebeat
3434
mysql
35+
squid
3536

3637
[prometheus]
3738
# Single node to host monitoring server.
@@ -126,3 +127,6 @@ freeipa_client
126127

127128
[persist_hostkeys]
128129
# Hosts to persist hostkeys for across reimaging. NB: Requires appliances_state_dir on hosts.
130+
131+
[squid]
132+
# Hosts to run squid proxy

‎environments/common/layouts/everything

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,6 @@ openhpc
7272

7373
[persist_hostkeys]
7474
# Hosts to persist hostkeys for across reimaging. NB: Requires appliances_state_dir on hosts.
75+
76+
[squid]
77+
# Hosts to run squid proxy

0 commit comments

Comments
 (0)