# /etc/squid/squid.conf — 推荐的配置结构

# ============================================================
# Section 1: 网络端口
# ============================================================
http_port 3128
# https_port 443 ...

# ============================================================
# Section 2: ACL 定义
# ============================================================
# --- 网络 ACL ---
acl localnet src 192.168.0.0/16
acl localhost src 127.0.0.0/8 ::1

# --- 端口 ACL ---
acl Safe_ports port 80 443 21 70 8080 8443
acl SSL_ports port 443 8443

# --- 方法 ACL ---
acl CONNECT method CONNECT

# --- 时间 ACL ---
acl work_hours time MTWHF 08:30-18:00

# --- 认证 ACL ---
acl auth proxy_auth REQUIRED

# --- 内容 ACL ---
acl blocked_sites dstdomain "/etc/squid/blocked.txt"

# ============================================================
# Section 3: 认证配置
# ============================================================
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic children 5
auth_param basic realm Proxy
auth_param basic credentialsttl 2 hours

# ============================================================
# Section 4: 访问控制规则
# ============================================================
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow localnet
http_access deny !auth
http_access deny blocked_sites
http_access deny all

# ============================================================
# Section 5: 缓存配置
# ============================================================
cache_dir ufs /var/spool/squid 10000 16 256
cache_mem 512 MB
maximum_object_size 128 MB

refresh_pattern -i \.(jpg|png|gif|css|js)$ 1440 90% 43200
refresh_pattern . 60 20% 1440

# ============================================================
# Section 6: 日志配置
# ============================================================
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log

# ============================================================
# Section 7: 安全配置
# ============================================================
via off
forwarded_for delete
httpd_suppress_version_string on
visible_hostname proxy.example.com

# ============================================================
# Section 8: 性能参数
# ============================================================
# memory_replacement_policy heap GDSF
# cache_replacement_policy heap GDSF
# pipeline_prefetch on

# 版本控制配置文件
cd /etc/squid
git init
git add squid.conf
git commit -m "Initial squid config"

# 修改前备份
cp squid.conf squid.conf.$(date +%Y%m%d%H%M%S)

# 修改后验证
squid -k parse && echo "Config OK" || echo "Config ERROR"

# 热重载
squid -k reconfigure

# 配置差异比较
diff squid.conf.bak squid.conf

#!/bin/bash
# squid-ha-failover.sh — Squid 高可用故障转移脚本

PRIMARY="192.168.1.10"
SECONDARY="192.168.1.11"
VIP="192.168.1.1"

check_squid() {
    curl -s -o /dev/null -w "%{http_code}" \
        --max-time 5 \
        http://$1:3128/squid-internal-mgr/info
}

# 检查主节点
if [ "$(check_squid $PRIMARY)" != "200" ]; then
    echo "Primary Squid is down, switching to secondary"
    # 更新 VIP 指向
    ip addr del $VIP/24 dev eth0 2>/dev/null
    ssh root@$SECONDARY "ip addr add $VIP/24 dev eth0"
fi

# 边缘节点配置
http_port 80
https_port 443 cert=/etc/squid/ssl/site.pem

# 区域父代理
cache_peer parent-huabei.example.com parent 80 0 \
    no-query default weight=10

# 缓存配置
cache_dir aufs /var/spool/squid 50000 256 4096
cache_mem 4096 MB
maximum_object_size 256 MB

# 缓存策略
refresh_pattern -i \.(jpg|png|gif|css|js|woff2|mp4)$ 1440 90% 43200
refresh_pattern . 60 20% 1440

# 安全
via off
forwarded_for delete

# /etc/squid/squid.conf — 审计模式配置

# 详细日志格式（包含完整请求信息）
logformat audit %ts.%03tu %6tr %>a %[un %Ss/%03>Hs %<st %rm %ru %Sh/%<a %mt %>ha{User-Agent} %ssl::>sni
access_log /var/log/squid/access.log audit

# 不遗漏任何请求
# 不使用 access_log ... squid !internal 过滤

# 保留完整请求头（调试用，生产环境慎用）
# log_mime_hdrs on

# 日志轮转 180 天（合规要求）
# logrotate 配置 rotate 180

# SSL Bump 解密 HTTPS（需要合规授权）
# http_port 3129 ssl-bump cert=...
# ssl_bump bump all

# 禁止删除日志
# 通过文件系统权限限制

#!/bin/bash
# squid-backup.sh — Squid 备份脚本

BACKUP_DIR="/backup/squid/$(date +%Y%m%d)"
mkdir -p "$BACKUP_DIR"

# 备份配置
tar czf "$BACKUP_DIR/config.tar.gz" /etc/squid/

# 备份密码文件
cp /etc/squid/passwd "$BACKUP_DIR/"
cp /etc/squid/ssl/* "$BACKUP_DIR/" 2>/dev/null

# 备份缓存索引（不备份缓存数据，太大）
cp /var/spool/squid/swap.state "$BACKUP_DIR/" 2>/dev/null

# 备份日志（最近 7 天）
find /var/log/squid/ -name "*.log*" -mtime -7 \
    -exec cp {} "$BACKUP_DIR/" \;

# 清理 30 天前的备份
find /backup/squid/ -mtime +30 -exec rm -rf {} \; 2>/dev/null

echo "Backup completed: $BACKUP_DIR"

#!/bin/bash
# squid-restore.sh — Squid 恢复脚本

BACKUP_DIR="$1"

if [ -z "$BACKUP_DIR" ]; then
    echo "Usage: $0 /backup/squid/20260510"
    exit 1
fi

# 停止服务
sudo systemctl stop squid

# 恢复配置
sudo tar xzf "$BACKUP_DIR/config.tar.gz" -C /

# 恢复密码文件
sudo cp "$BACKUP_DIR/passwd" /etc/squid/

# 恢复 SSL 证书
sudo cp "$BACKUP_DIR"/*.pem /etc/squid/ssl/ 2>/dev/null

# 检查配置
sudo squid -k parse

# 重建缓存目录（如果缓存数据丢失）
sudo squid -z

# 启动
sudo systemctl start squid

echo "Restore completed from: $BACKUP_DIR"

# 变更前
□ 备份当前配置
□ squid -k parse 语法检查
□ 记录变更内容和原因

# 变更中
□ squid -k reconfigure 热重载
□ 观察 cache.log 错误

# 变更后
□ 功能验证测试
□ 性能指标检查
□ 日志检查
□ 通知相关人员
□ 更新文档

# ansible/playbook.yml
---
- name: Deploy Squid Proxy
  hosts: squid_servers
  become: yes
  tasks:
    - name: Install Squid
      apt:
        name: squid
        state: present
        update_cache: yes

    - name: Copy config
      template:
        src: squid.conf.j2
        dest: /etc/squid/squid.conf
        owner: root
        group: proxy
        mode: '0640'
      notify: Restart Squid

    - name: Ensure cache directory
      file:
        path: /var/spool/squid
        state: directory
        owner: proxy
        group: proxy
        mode: '0750'

    - name: Initialize cache
      command: squid -z
      when: squid_config.changed

    - name: Enable and start
      systemd:
        name: squid
        state: started
        enabled: yes

  handlers:
    - name: Restart Squid
      systemd:
        name: squid
        state: restarted

#!/bin/bash
# squid-health-monitor.sh — 定时健康检查

PROXY="localhost:3128"
ALERT_EMAIL="admin@example.com"

# 检查进程
if ! pgrep squid > /dev/null; then
    echo "Squid down at $(date)" | mail -s "SQUID ALERT" $ALERT_EMAIL
    systemctl restart squid
fi

# 检查缓存命中率
HIT_RATIO=$(squidclient -h localhost mgr:info | grep "Request Hit Ratios" | grep -oP '\d+\.\d+' | head -1)
if (( $(echo "$HIT_RATIO < 30" | bc -l) )); then
    echo "Low cache hit ratio: $HIT_RATIO%" | mail -s "SQUID WARNING" $ALERT_EMAIL
fi

# 检查错误率
TOTAL=$(tail -1000 /var/log/squid/access.log | wc -l)
ERRORS=$(tail -1000 /var/log/squid/access.log | grep -c "TCP_DENIED\|TCP_ERROR")
if [ $TOTAL -gt 0 ]; then
    ERROR_RATE=$((ERRORS * 100 / TOTAL))
    if [ $ERROR_RATE -gt 10 ]; then
        echo "High error rate: $ERROR_RATE%" | mail -s "SQUID WARNING" $ALERT_EMAIL
    fi
fi

# Squid 标准操作手册

## 基本信息
- 服务器：proxy.example.com
- IP：192.168.1.1
- 端口：3128
- 版本：Squid 6.10
- 管理员：admin@example.com

## 日常操作
- 查看状态：systemctl status squid
- 重载配置：squid -k reconfigure
- 查看日志：tail -f /var/log/squid/access.log

## 紧急操作
- 重启：systemctl restart squid
- 停止：systemctl stop squid
- 清缓存：rm -rf /var/spool/squid/* && squid -z

## 联系方式
- 主管：manager@example.com
- 供应商：vendor@example.com