4.6 KiB
Containerized Squid on Container Optimized OS
This module manages a cloud-config
configuration that starts a containerized Squid proxy on Container Optimized OS. The default configuration creates a filtering proxy that only allows connection to a whitelisted set of domains.
The resulting cloud-config
can be customized in a number of ways:
- a custom squid.conf configuration can be set using the
squid_config
variable - additional files (e.g. additional acls) can be passed in via the
files
variable - a completely custom
cloud-config
can be passed in via thecloud_config
variable, and additional template variables can be passed in viaconfig_variables
The default instance configuration inserts iptables rules to allow traffic on TCP port 3128. With the default squid.conf
, deny rules take precedence over allow rules.
Logging and monitoring are enabled via the Google Cloud Logging agent configured for the instance via the google-logging-enabled
metadata property, and the Node Problem Detector service started by default on boot.
The module renders the generated cloud config in the cloud_config
output, to be used in instances or instance templates via the user-data
metadata.
For convenience during development or for simple use cases, the module can optionally manage a single instance via the test_instance
variable. If the instance is not needed the instance*tf
files can be safely removed. Refer to the top-level README for more details on the included instance.
Examples
Default Squid configuration
This example will create a cloud-config
that allows any client in the 10.0.0.0/8 CIDR to use the proxy to connect github.com or any subdomain of github.com.
module "cos-squid" {
source = "./fabric/modules/cloud-config-container/squid"
allow = [".github.com"]
clients = ["10.0.0.0/8"]
}
module "vm" {
source = "./fabric/modules/compute-vm"
project_id = "my-project"
zone = "europe-west8-b"
name = "cos-squid"
network_interfaces = [{
network = "default"
subnetwork = "gce"
}]
metadata = {
user-data = module.cos-squid.cloud_config
google-logging-enabled = true
}
boot_disk = {
image = "projects/cos-cloud/global/images/family/cos-stable"
type = "pd-ssd"
size = 10
}
tags = ["http-server", "ssh"]
}
# tftest modules=1 resources=1
Variables
name | description | type | required | default |
---|---|---|---|---|
allow | List of domains Squid will allow connections to. | list(string) |
[] |
|
clients | List of CIDR ranges from which Squid will allow connections. | list(string) |
[] |
|
cloud_config | Cloud config template path. If null default will be used. | string |
null |
|
config_variables | Additional variables used to render the cloud-config and Squid templates. | map(any) |
{} |
|
default_action | Default action for domains not matching neither the allow or deny lists. | string |
"deny" |
|
deny | List of domains Squid will deny connections to. | list(string) |
[] |
|
file_defaults | Default owner and permissions for files. | object({…}) |
{…} |
|
files | Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null. | map(object({…})) |
{} |
|
squid_config | Squid configuration path, if null default will be used. | string |
null |
Outputs
name | description | sensitive |
---|---|---|
cloud_config | Rendered cloud-config file to be passed as user-data instance metadata. |