TLS-terminated Squid on :3128 with basic auth, restricted by ACL to
.anthropic.com / .claude.ai / .claude.com. CONNECT-only; no ssl_bump.
Stack:
- proxy: squid-openssl, reads cert from proxy_certs volume
- proxy-reloader: inotify-watches the cert dir, HUPs squid on rotation
(joins proxy's PID namespace so pkill finds PID 1)
- lego: ACME DNS-01 via Cloudflare for proxy.fhirworx.io,
issues into proxy_certs, renews when <30d remain
- cloudflared: new TCP ingress route proxy.fhirworx.io -> proxy:3128
Tests:
- proxy-reloader has no network by design (signal-only, PID-shared with
proxy), so add it to the network-assignment exempt set alongside wire.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fbf621c0ec