fbf621c0ec
TLS-terminated Squid on :3128 with basic auth, restricted by ACL to
.anthropic.com / .claude.ai / .claude.com. CONNECT-only; no ssl_bump.
Stack:
- proxy: squid-openssl, reads cert from proxy_certs volume
- proxy-reloader: inotify-watches the cert dir, HUPs squid on rotation
(joins proxy's PID namespace so pkill finds PID 1)
- lego: ACME DNS-01 via Cloudflare for proxy.fhirworx.io,
issues into proxy_certs, renews when <30d remain
- cloudflared: new TCP ingress route proxy.fhirworx.io -> proxy:3128
Tests:
- proxy-reloader has no network by design (signal-only, PID-shared with
proxy), so add it to the network-assignment exempt set alongside wire.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
8 lines
243 B
Docker
8 lines
243 B
Docker
FROM debian:bookworm-slim
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
squid-openssl apache2-utils ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
EXPOSE 3128
|
|
CMD ["squid", "-N", "-f", "/etc/squid/squid.conf"]
|