f2c80e17f1
Co-authored-by: Luca Prete <lucaprete@google.com> |
||
---|---|---|
.. | ||
README.md | ||
cloud-config.yaml | ||
instance.tf | ||
main.tf | ||
outputs-instance.tf | ||
outputs.tf | ||
squid.conf | ||
variables-instance.tf | ||
variables.tf |
README.md
Containerized Squid on Container Optimized OS
This module manages a cloud-config
configuration that starts a containerized Squid proxy on Container Optimized OS. The default configuration creates a filtering proxy that only allows connection to a whitelisted set of domains.
The resulting cloud-config
can be customized in a number of ways:
- a custom squid.conf configuration can be set using the
squid_config
variable - additional files (e.g. additional acls) can be passed in via the
files
variable - a completely custom
cloud-config
can be passed in via thecloud_config
variable, and additional template variables can be passed in viaconfig_variables
The default instance configuration inserts iptables rules to allow traffic on TCP port 3128.
Logging and monitoring are enabled via the Google Cloud Logging driver configured for the Squid container, and the Node Problem Detector service started by default on boot.
The module renders the generated cloud config in the cloud_config
output, to be used in instances or instance templates via the user-data
metadata.
For convenience during development or for simple use cases, the module can optionally manage a single instance via the test_instance
variable. If the instance is not needed the instance*tf
files can be safely removed. Refer to the top-level README for more details on the included instance.
Examples
Default Squid configuration
This example will create a cloud-config
that allows any client in the 10.0.0.0/8 CIDR to use the proxy to connect github.com or any subdomain of github.com.
module "cos-squid" {
source = "./modules/cos-container/squid"
whitelist = [".github.com"]
clients = ["10.0.0.0/8"]
}
# use it as metadata in a compute instance or template
resource "google_compute_instance" "default" {
metadata = {
user-data = module.cos-squid.cloud_config
}
Test Squid instance
This example shows how to create the single instance optionally managed by the module, providing all required attributes in the test_instance
variable. The instance is purposefully kept simple and should only be used in development, or when designing infrastructures.
module "cos-squid" {
source = "./modules/cos-container/squid"
whitelist = ["github.com"]
clients = ["10.0.0.0/8"]
test_instance = {
project_id = "my-project"
zone = "europe-west1-b"
name = "cos-squid"
type = "f1-micro"
network = "default"
subnetwork = "https://www.googleapis.com/compute/v1/projects/my-project/regions/europe-west1/subnetworks/my-subnet"
}
}
Variables
name | description | type | required | default |
---|---|---|---|---|
clients | List of CIDRs from which Squid will allow connections | list(string) |
[] |
|
cloud_config | Cloud config template path. If null default will be used. | string |
null |
|
config_variables | Additional variables used to render the cloud-config and Squid templates. | map(any) |
{} |
|
file_defaults | Default owner and permissions for files. | object({...}) |
... |
|
files | Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null. | map(object({...})) |
{} |
|
squid_config | Squid configuration path, if null default will be used. | string |
null |
|
test_instance | Test/development instance attributes, leave null to skip creation. | object({...}) |
null |
|
test_instance_defaults | Test/development instance defaults used for optional configuration. If image is null, COS stable will be used. | object({...}) |
... |
|
whitelist | List of domains Squid will allow connections to | list(string) |
[] |
Outputs
name | description | sensitive |
---|---|---|
cloud_config | Rendered cloud-config file to be passed as user-data instance metadata. | |
test_instance | Optional test instance name and address |