2025-06-26-13-33-49: Cronjob

roles/lmn_localproxy/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+localproxy: false
+localproxy_parent: "firewall.{{ domain }}"

roles/lmn_localproxy/files/usersquid.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Run squid in usermode using user kerberos ticket
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/startusersquid.sh
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=xdg-desktop-autostart.target

roles/lmn_localproxy/tasks/main.yml

@@ -0,0 +1,48 @@
+---
+- name: Install squid
+  ansible.builtin.apt:
+    name:
+      - squid
+
+- name: Disable squid
+  ansible.builtin.systemd:
+    name: squid
+    enabled: false
+    state: stopped
+
+- name: Deploy squid user mode configuration
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/squid/{{ item }}"
+    mode: '0644'
+  loop:
+    - squid-usermode.conf
+    - squid-usermode-external.conf
+
+- name: Deploy startusersquid script
+  ansible.builtin.template:
+    src: startusersquid.sh.j2
+    dest: /usr/local/bin/startusersquid.sh
+    mode: '0755'
+
+- name: Provide usersquid service
+  ansible.builtin.copy:
+    src: usersquid.service
+    dest: /etc/systemd/user/usersquid.service
+    mode: '0644'
+
+- name: Enable usersquid service
+  ansible.builtin.systemd:
+    name: usersquid.service
+    scope: global
+    enabled: true
+
+- name: Deploy http proxy config
+  ansible.builtin.copy:
+    dest: /etc/environment.d/10-lmn-proxy.conf
+    mode: '0644'
+    content: |
+      http_proxy="http://localhost:3128"
+      https_proxy="http://localhost:3128"
+      ftp_proxy="http://localhost:3128"
+      no_proxy="{{ no_proxy }}"

roles/lmn_localproxy/templates/squid-usermode-external.conf.j2

@@ -0,0 +1,14 @@
+acl local-servers dstdomain .{{ domain }}
+cache_peer {{ localproxy_parent }} parent 3128 0 no-query default login=NEGOTIATE auth-no-keytab
+never_direct deny local-servers
+always_direct allow all
+#access_log stdio:/tmp/access.log squid
+access_log none
+cache_log /dev/null
+logfile_rotate 0
+pid_filename none
+{% if vm_support %}
+http_port 192.168.122.1:3128
+{% endif %}
+http_port 127.0.0.1:3128
+http_access allow all

roles/lmn_localproxy/templates/squid-usermode.conf.j2

@@ -0,0 +1,14 @@
+acl local-servers dstdomain .{{ domain }}
+cache_peer {{ localproxy_parent }} parent 3128 0 no-query default login=NEGOTIATE auth-no-keytab
+never_direct deny local-servers
+never_direct allow all
+#access_log stdio:/tmp/access.log squid
+access_log none
+cache_log /dev/null
+logfile_rotate 0
+pid_filename none
+{% if vm_support %}
+http_port 192.168.122.1:3128
+{% endif %}
+http_port 127.0.0.1:3128
+http_access allow all

roles/lmn_localproxy/templates/startusersquid.sh.j2

@@ -0,0 +1,8 @@
+#!/usr/bin/bash
+#
+
+if nslookup firewall.{{ domain }}; then
+   /usr/sbin/squid --foreground -f /etc/squid/squid-usermode.conf
+else
+   /usr/sbin/squid --foreground -f /etc/squid/squid-usermode-external.conf
+fi