How to install squid in reverse-proxy mode
This is a simple config file to be used as a template:
http_port 80 transparent
sslproxy_client_certificate /etc/ssl/pem/cernvm.pem
sslproxy_client_key /etc/ssl/private/cernvm.key
acl all src 0.0.0.0/0.0.0.0
acl inHttp port 80
acl inHttps port 443
acl fromFrontend dstdomain cernvm.cern.ch
cache_peer 137.138.170.216 parent 80 0 no-query originserver name=rbuilder login=PASS
acl rbuilder_doms dstdomain rbuilder.cern.ch cernvm.cern.ch cernvm-test.cern.ch cernvm-devel.cern.ch
cache_peer_access rbuilder allow rbuilder_doms inHttp
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
cache_mem 32 MB
cache_swap_low 90
cache_swap_high 95
maximum_object_size 524288 KB
ipcache_size 1024
ipcache_low 90
ipcache_high 95
fqdncache_size 1024
cache_replacement_policy heap LFUDA
memory_replacement_policy lru
cache_dir aufs /var/spool/squid 8192 16 256
logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %h" ref:"%{Referer}>h" ua:"%{User-Agent}>h" %Ss:%Sh
access_log /var/log/squid/access.log combined
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
emulate_httpd_log off
mime_table /etc/squid/mime.conf
log_mime_hdrs off
pid_filename /var/run/squid.pid
debug_options ALL,1
check_hostnames on
hosts_file /etc/hosts
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl CONNECT method CONNECT
acl CERN src 128.141.0.0/255.255.0.0
acl CERN src 128.142.0.0/255.255.0.0
acl CERN src 137.138.0.0/255.255.0.0
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny to_localhost
acl cernvm_cluster dstdomain cernvm.cern.ch rbuilder.cern.ch cernvm-test.cern.ch cernvm-devel.cern.ch
http_access allow cernvm_cluster
http_access allow CONNECT cernvm_cluster SSL_ports
http_access allow localhost
http_access deny all
icp_access allow all
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
cache_mgr cernvm.administrator@cern.ch
mail_from cernvm.administrator@cern.ch
httpd_suppress_version_string on
visible_hostname cernvm.cern.ch
icp_port 0
error_map http://cernvm.cern.ch/error/triggered.html.var 403 404
forwarded_for on
coredump_dir /var/spool/squid
|
--
CarlosAguado - 13 May 2008