6.6 KiB

Raw Blame History

Containerized Squid on Container Optimized OS

This module manages a cloud-config configuration that starts a containerized Squid proxy on Container Optimized OS. The default configuration creates a filtering proxy that only allows connection to a whitelisted set of domains.

The resulting cloud-config can be customized in a number of ways:

a custom squid.conf configuration can be set using the squid_config variable
additional files (e.g. additional acls) can be passed in via the files variable
a completely custom cloud-config can be passed in via the cloud_config variable, and additional template variables can be passed in via config_variables

The default instance configuration inserts iptables rules to allow traffic on TCP port 3128. With the default squid.conf, deny rules take precedence over allow rules.

Logging and monitoring are enabled via the Google Cloud Logging agent configured for the instance via the google-logging-enabled metadata property, and the Node Problem Detector service started by default on boot.

The module renders the generated cloud config in the cloud_config output, to be used in instances or instance templates via the user-data metadata.

For convenience during development or for simple use cases, the module can optionally manage a single instance via the test_instance variable. If the instance is not needed the instance*tf files can be safely removed. Refer to the top-level README for more details on the included instance.

Examples

Default Squid configuration

This example will create a cloud-config that allows any client in the 10.0.0.0/8 CIDR to use the proxy to connect github.com or any subdomain of github.com.

module "cos-squid" {
  source           = "./fabric/modules/cloud-config-container/squid"
  whitelist = [".github.com"]
  clients   = ["10.0.0.0/8"]
}

# use it as metadata in a compute instance or template
module "vm-squid" {
  source = "./fabric/modules/compute-vm"
  metadata = {
    user-data              = module.cos-squid.cloud_config
    google-logging-enabled = true
  }
}

Test Squid instance

This example shows how to create the single instance optionally managed by the module, providing all required attributes in the test_instance variable. The instance is purposefully kept simple and should only be used in development, or when designing infrastructures.

module "cos-squid" {
  source           = "./fabric/modules/cloud-config-container/squid"
  whitelist = ["github.com"]
  clients   = ["10.0.0.0/8"]
  test_instance = {
    project_id = "my-project"
    zone       = "europe-west1-b"
    name       = "cos-squid"
    type       = "f1-micro"
    network    = "default"
    subnetwork = "https://www.googleapis.com/compute/v1/projects/my-project/regions/europe-west1/subnetworks/my-subnet"
  }
}

Variables

name	description	type	default
allow	List of domains Squid will allow connections to.	`list(string)`	`[]`
clients	List of CIDR ranges from which Squid will allow connections.	`list(string)`	`[]`
cloud_config	Cloud config template path. If null default will be used.	`string`	`null`
config_variables	Additional variables used to render the cloud-config and Squid templates.	`map(any)`	`{}`
default_action	Default action for domains not matching neither the allow or deny lists.	`string`	`"deny"`
deny	List of domains Squid will deny connections to.	`list(string)`	`[]`
file_defaults	Default owner and permissions for files.	`object({…})`	`{…}`
files	Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null.	`map(object({…}))`	`{}`
squid_config	Squid configuration path, if null default will be used.	`string`	`null`
test_instance	Test/development instance attributes, leave null to skip creation.	`object({…})`	`null`
test_instance_defaults	Test/development instance defaults used for optional configuration. If image is null, COS stable will be used.	`object({…})`	`{…}`

Outputs

name	description	sensitive
cloud_config	Rendered cloud-config file to be passed as user-data instance metadata.
test_instance	Optional test instance name and address.

6.6 KiB Raw Blame History