.drone/build.sh

@@ -1,2 +0,0 @@
-echo "${CA_CRT}" > docker-dind/CA_crt.crt
-docker build docker-dind -t ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/docker-dind

.drone/deploy.sh

@@ -1,7 +0,0 @@
-docker stack rm squid
-echo 'sleeping...zzz'
-sleep 60
-mkdir -p .secrets
-echo "${CA_CRT}" > .secrets/ca.crt
-echo "${CA_KEY}" > .secrets/ca.key
-docker stack deploy -c docker-compose.yml squid

.drone/drone-home.jsonnet

@@ -1,33 +1,96 @@
-
+local images = import 'lib/images.libsonnet';
+local environment = import 'node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+local compose = import 'node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
 local secretSecrets = import 'lib/secret-secrets.libsonnet';
 local publicSecrets = import 'lib/public-secrets.libsonnet';
-
-local deploy = import 'node_modules/@sigyl/jsonnet-drone/deploy.libsonnet';
-local register = import 'node_modules/@sigyl/jsonnet-drone/register.libsonnet';
 [
-  register,
+  {
-  deploy(
+    kind: 'pipeline',
-    'squid',
+    type: 'docker',
-    '/stack/',
+    name: 'build',
-    [
+    clone: {
-      'CA_CRT',
+      disable: false,
-    ],
+      depth: 0,
-    publicSecrets,
-    secretSecrets,
-    [
-      'DOMAIN',
-      'REGISTRY_DOMAIN',
-      'REGISTRY_PORT',
-      'REGISTRY_PASSWORD',
-    ],
-  ) {
-    trigger +: {
-      event +: [
-        'promote',
-      ],
-      target +: [
-        'production',
-      ],
     },
-  },
+    services: [
+      images.docker {
+        privileged: true,
+        volumes: [
+          {
+            name: 'dockersock',
+            path: '/var/run',
+          },
+          {
+            name: 'ca',
+            path: '/etc/docker/certs.d',
+          },
+        ],
+      },
+    ],
+    volumes: [
+      {
+        name: 'dockersock',
+        temp: {},
+      },
+      {
+        name: 'ca',
+        host: {
+          path: '/etc/docker/certs.d',
+        },
+      },
+    ],
+    steps:[
+      images.scp(
+        '/stack/squid'
+      ),
+      images.wait(15),
+      images.docker {
+        name +: 'build docker image:',
+        environment +: environment.environmentSecrets([
+          'LOCAL_DOCKER_REGISTRY',
+          'LOCAL_REGISTRY_PASSWORD',
+        ]),
+        volumes: [
+          {
+            name: 'dockersock',
+            path: '/var/run',
+          },
+        ],
+        commands: [
+          'set -e',
+          'pwd',
+          'sleep 15',
+          'cd docker',
+          'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"',
+          'docker build . -t $${LOCAL_DOCKER_REGISTRY}squid',
+          'docker push $${LOCAL_DOCKER_REGISTRY}squid',
+          'docker logout $${LOCAL_DOCKER_REGISTRY}',
+        ],
+      },
+      compose([
+        environment.envSet('local-docker-registry'),
+        environment.envSet('local-registry-password'),
+      ])(
+        images.ssh  {
+          name: 'deploy squid',
+          settings +: {
+            script +: [
+              'set -e',
+              "docker network prune -f",
+              "cd /stack/squid/myCA",
+              'openssl genrsa -out CA_key.pem 2048',
+              'openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf    -subj "/C=US/ST=California/L=Mountain View/O=Google/OU=Enterprise/CN=MyCA"',
+              'cd ..',
+              "docker stack rm squid",
+              "sleep 31",
+              'export SQUID_IMAGE=$${LOCAL_DOCKER_REGISTRY}squid',
+              'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"',
+              'docker pull $${SQUID_IMAGE}',
+              "docker stack deploy -c docker-compose.yml squid",
+            ]
+          }
+        },
+      ),
+    ],
+  }
 ]

.drone/drone-home.yml

@@ -1,97 +1,56 @@
 ---
 kind: pipeline
 type: docker
-name: register
+name: build
-
-platform:
-  os: linux
-  arch: amd64
-
-clone:
-  disable: true
-
-trigger:
-  event:
-    exclude:
-    - promote
-
----
-kind: pipeline
-type: docker
-name: deploy
 
 platform:
   os: linux
   arch: amd64
 
 steps:
-- name: print env
-  image: appleboy/drone-ssh:1.6.2@sha256:b801dc2cd238c192b6e99acfa7bc3f5b9a03f312bd2feb1e10b3a7a28a1b80ea
-  settings:
-    envs:
-    - drone_tag
-    - drone_commit
-    - drone_build_number
-    - drone_repo_name
-    - drone_repo_namespace
-    - ca_crt
-    - ca_crt
-    - local_domain
-    - ca_key
-    host: ${SSH_HOST}
-    key: ${SSH_KEY}
-    passphrase: ${SSH_PASSPHRASE}
-    port: ${SSH_PORT}
-    script:
-    - rm -f env-squid
-    - "echo \"export CA_CRT='$${CA_CRT}'\" >> env-squid # \"ca-crt\""
-    - "echo \"export CA_CRT='$${CA_CRT}'\" >> env-squid # \"ca-crt\""
-    - "echo \"export LOCAL_DOMAIN='$${LOCAL_DOMAIN}'\" >> env-squid # \"local-domain\""
-    - "echo \"export CA_KEY='$${CA_KEY}'\" >> env-squid # \"ca-key\""
-    username: ${SSH_USER}
-  environment:
-    CA_CRT:
-      from_secret: ca-crt
-    CA_KEY:
-      from_secret: ca-key
-    LOCAL_DOMAIN:
-      from_secret: local-domain
-
 - name: scp
-  image: appleboy/drone-scp:1.6.2@sha256:bd37a55f4b97e7742b0de7333669b96220b3cc422d366e1fa8c34059b736ab47
+  image: appleboy/drone-scp
   settings:
     command_timeout: 2m
-    host: ${SSH_HOST}
+    host:
-    key: ${SSH_KEY}
+      from_secret: ssh-host
-    passphrase: ${SSH_PASSPHRASE}
+    key:
-    port: ${SSH_PORT}
+      from_secret: ssh-key
+    port:
+      from_secret: ssh-port
     source:
     - .
     target: /stack/squid
-    username: ${SSH_USER}
+    username:
+      from_secret: ssh-user
 
 - name: wait
-  image: alpine:3.12.0@sha256:90baa0922fe90624b05cb5766fa5da4e337921656c2f8e2b13bd3c052a0baac1
+  image: alpine
   commands:
   - sleep 15
 
-- name: "dockerbuild:"
+- name: "dockerbuild docker image:"
-  image: docker:19.03.12-dind@sha256:8dded163e463f4a59bf305b3dca98e312b2cfb89a43da3872e48f95a7554c48f
+  image: docker:dind
   commands:
   - set -e
-  - sh .drone/login.sh
+  - pwd
-  - sh .drone/build.sh
+  - sleep 15
-  - sh .drone/push.sh
+  - cd docker
-  - sh .drone/logout.sh
+  - docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"
+  - docker build . -t $${LOCAL_DOCKER_REGISTRY}squid
+  - docker push $${LOCAL_DOCKER_REGISTRY}squid
+  - docker logout $${LOCAL_DOCKER_REGISTRY}
   environment:
-    CA_CRT:
+    LOCAL_DOCKER_REGISTRY:
-      from_secret: ca-crt
+      from_secret: local-docker-registry
+    LOCAL_REGISTRY_PASSWORD:
+      from_secret: local-registry-password
   volumes:
   - name: dockersock
     path: /var/run
 
-- name: deploy
+- name: deploy squid
-  image: appleboy/drone-ssh:1.6.2@sha256:b801dc2cd238c192b6e99acfa7bc3f5b9a03f312bd2feb1e10b3a7a28a1b80ea
+  image: appleboy/drone-ssh
   settings:
     envs:
     - drone_tag
@@ -99,44 +58,38 @@ steps:
     - drone_build_number
     - drone_repo_name
     - drone_repo_namespace
-    - domain
+    - local_docker_registry
-    - registry_domain
+    - local_registry_password
-    - registry_port
+    host:
-    - registry_password
+      from_secret: ssh-host
-    - ca_crt
+    key:
-    - local_domain
+      from_secret: ssh-key
-    - ca_key
+    port:
-    - ca_crt
+      from_secret: ssh-port
-    host: ${SSH_HOST}
-    key: ${SSH_KEY}
-    passphrase: ${SSH_PASSPHRASE}
-    port: ${SSH_PORT}
     script:
-    - export CA_KEY=$${CA_KEY}
-    - export CA_CRT=$${CA_CRT}
-    - export LOCAL_DOMAIN=$${LOCAL_DOMAIN}
-    - export CA_CRT=$${CA_CRT}
-    - export DOMAIN=$${DOMAIN}
-    - export REGISTRY_DOMAIN=$${REGISTRY_DOMAIN}
-    - export REGISTRY_PORT=$${REGISTRY_PORT}
-    - export REGISTRY_PASSWORD=$${REGISTRY_PASSWORD}
     - set -e
-    - cd /stack/squid
+    - docker network prune -f
-    - sh .drone/login.sh
+    - cd /stack/squid/myCA
-    - sh .drone/pull.sh
+    - openssl genrsa -out CA_key.pem 2048
-    - sh .drone/deploy.sh
+    - openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf    -subj "/C=US/ST=California/L=Mountain View/O=Google/OU=Enterprise/CN=MyCA"
-    username: ${SSH_USER}
+    - cd ..
+    - docker stack rm squid
+    - sleep 31
+    - export SQUID_IMAGE=$${LOCAL_DOCKER_REGISTRY}squid
+    - docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"
+    - docker pull $${SQUID_IMAGE}
+    - docker stack deploy -c docker-compose.yml squid
+    username:
+      from_secret: ssh-user
   environment:
-    CA_CRT:
+    LOCAL_DOCKER_REGISTRY:
-      from_secret: ca-crt
+      from_secret: local-docker-registry
-    CA_KEY:
+    LOCAL_REGISTRY_PASSWORD:
-      from_secret: ca-key
+      from_secret: local-registry-password
-    LOCAL_DOMAIN:
-      from_secret: local-domain
 
 services:
 - name: docker
-  image: docker:19.03.12-dind@sha256:8dded163e463f4a59bf305b3dca98e312b2cfb89a43da3872e48f95a7554c48f
+  image: docker:dind
   privileged: true
   volumes:
   - name: dockersock
@@ -151,10 +104,4 @@ volumes:
   host:
     path: /etc/docker/certs.d
 
-trigger:
-  event:
-  - promote
-  target:
-  - production
-
 ...

.drone/lib/images.libsonnet

@@ -0,0 +1,38 @@
+local settings = import 'settings.libsonnet';
+{
+  docker: {
+    name: 'docker',
+    image: 'docker:dind',
+  },
+  scp(target): settings.ssh {
+    name: 'scp',
+    image: 'appleboy/drone-scp',
+    settings +: {
+      command_timeout: '2m',
+      target: target,
+      source: [
+        '.',
+      ],
+    },
+  },
+  ssh: settings.ssh {
+    image: 'appleboy/drone-ssh',    
+    settings +: {
+      envs: [
+        'drone_tag',
+        'drone_commit',
+        'drone_build_number',
+        'drone_repo_name',
+        'drone_repo_namespace',
+      ],
+      script: [],
+    },
+  },
+  wait(delay): {
+    image: 'alpine',
+    name: 'wait',
+    commands: [
+      'sleep %s' % delay,
+    ],
+  }
+}

.drone/lib/public-secrets.libsonnet

@@ -1,4 +1,6 @@
 [
-  'ca-crt',
+  'ssh-host',
-  'local-domain'
+  'ssh-user',
+  'ssh-root-user',
+  'local-docker-registry',
 ]

.drone/lib/secret-secrets.libsonnet

@@ -1,3 +1,5 @@
 [
-  'ca-key',
+  'ssh-password',
+  'ssh-key',
+  'local-registry-password',
 ]

.drone/lib/settings.libsonnet

@@ -0,0 +1,11 @@
+local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+{
+  ssh: {
+    settings +: {
+      host: environment.fromSecret('ssh-host'),
+      port: environment.fromSecret('ssh-port'),
+      username: environment.fromSecret('ssh-user'),
+      key: environment.fromSecret('ssh-key'),  
+    },
+  },
+}

.drone/lib/util.libsonnet

@@ -0,0 +1,18 @@
+local compose = import '../node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
+local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+{
+  printEnv(file, env): function(step) compose([
+    environment.envSet(env),
+    function(step) step {
+      settings +: {
+        script +: [
+          'echo "export %(environment)s=\'$${%(environment)s}\'" >> %(file)s # "%(secret)s"' % {
+            environment: environment.environment(env),
+            file: file,
+            secret: environment.secret(env),
+          },
+        ],
+      },
+    },
+  ])(step),
+}

.drone/login.sh

@@ -1 +0,0 @@
-docker login ${REGISTRY_DOMAIN}:${REGISTRY_PORT} --username client --password "${REGISTRY_PASSWORD}"

.drone/logout.sh

@@ -1 +0,0 @@
-docker logout ${REGISTRY_DOMAIN}:${REGISTRY_PORT}

.drone/package.json

@@ -4,6 +4,7 @@
     "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
   },
   "dependencies": {
-    "@sigyl/jsonnet-drone": "^0.1.0"
+    "@sigyl/jsonnet-compose": "^0.0.2",
+    "@sigyl/jsonnet-drone-environment": "0.0.5"
   }
 }

.drone/pull.sh

@@ -1 +0,0 @@
-docker pull ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/docker-dind

.drone/push.sh

@@ -1 +0,0 @@
-docker push ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/docker-dind

.drone/yarn-error.log

@@ -1,21 +1,23 @@
 Arguments: 
-  /usr/local/Cellar/node/11.9.0/bin/node /usr/local/Cellar/yarn/1.13.0/libexec/bin/yarn.js
+  /usr/bin/node /home/giles/.yarn/bin/yarn.js
 
 PATH: 
-  /Users/giles/.cargo/bin:/Users/giles/.local/bin:/Users/giles/Library/Python/3.7/bin:/Library/Frameworks/Python.framework/Versions/3.7/bin:/opt/local/bin:/opt/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/share/dotnet:/usr/local/share/dotnet/sdk:/usr/local/share/dotnet/sdk/2.2.101:/opt/X11/bin:~/.dotnet/tools:/usr/local/bin:/usr/local/Cellar/openssl/1.0.2j/bin/openssl
+  /home/giles/.yarn/bin:/home/giles/.config/yarn/global/node_modules/.bin:/home/giles/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/go/bin
 
 Yarn version: 
-  1.13.0
+  1.22.4
 
 Node version: 
-  12.13.1
+  11.14.0
 
 Platform: 
-  darwin x64
+  linux x64
 
 Trace: 
-  Error: getaddrinfo ENOTFOUND registry.yarnpkg.com
+  Error: self signed certificate in certificate chain
-      at GetAddrInfoReqWrap.onlookup [as oncomplete] (dns.js:60:26)
+      at TLSSocket.onConnectSecure (_tls_wrap.js:1176:34)
+      at TLSSocket.emit (events.js:193:13)
+      at TLSSocket._finishInit (_tls_wrap.js:667:8)
 
 npm manifest: 
   {
@@ -24,7 +26,7 @@ npm manifest:
       "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
     },
     "dependencies": {
-      "@sigyl/jsonnet-drone": "^0.0.3"
+      "@sigyl/jsonnet-compose": "^0.0.2"
     }
   }
 
@@ -32,24 +34,4 @@ yarn manifest:
   No manifest
 
 Lockfile: 
-  # THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+  No lockfile
-  # yarn lockfile v1
-  
-  
-  "@sigyl/jsonnet-compose@^0.0.2":
-    version "0.0.2"
-    resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-compose/-/jsonnet-compose-0.0.2.tgz#8900a21e8cd8109929b6042703f8645aacb9bcda"
-    integrity sha512-wWS3CgPeNi/o1pcS6n/4pafxlMD0KC9/RKMZr/ySmzeGNRW++sPuKuxajYse2TNd47uNDdeUSnk4aEeEIKL0zA==
-  
-  "@sigyl/jsonnet-drone-environment@0.0.5":
-    version "0.0.5"
-    resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff"
-    integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw==
-  
-  "@sigyl/jsonnet-drone@^0.0.2":
-    version "0.0.2"
-    resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone/-/jsonnet-drone-0.0.2.tgz#64572524155eaa2c2b8bda6102f238a0269cafbb"
-    integrity sha512-1/EZR5Vbo8oKAm+R31XIzsS6VZxcEIcRLyrLi53JQ0+z+CWLPvrUwiq0homBysYJhqk1XRzYF6+ctwbbmmzxrA==
-    dependencies:
-      "@sigyl/jsonnet-compose" "^0.0.2"
-      "@sigyl/jsonnet-drone-environment" "0.0.5"

.drone/yarn.lock

@@ -11,11 +11,3 @@
   version "0.0.5"
   resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff"
   integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw==
-
-"@sigyl/jsonnet-drone@^0.1.0":
-  version "0.1.0"
-  resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone/-/jsonnet-drone-0.1.0.tgz#feda1797e8e9ef799cad72e65f7163ca26a9e3a5"
-  integrity sha512-QY/ngucxFOtLfL8Mt0f2bxN4fQDUOGOFtaRpSH2cNyg84xADkzehT0ORZtbLitr+AwhyF5KN/zAGvzkyNAoqPw==
-  dependencies:
-    "@sigyl/jsonnet-compose" "^0.0.2"
-    "@sigyl/jsonnet-drone-environment" "0.0.5"

.gitignore

@@ -1,3 +1,2 @@
+myCA/*.pem
 node_modules
-*.log
-.secrets

.versionrc

@@ -1,3 +0,0 @@
-{
-  "compareUrlFormat": "{{repoUrl}}/compare/{{previousTag}}...{{currentTag}}"
-}

CHANGELOG.md

@@ -2,51 +2,6 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-### [0.0.8](https://sigyl.com/git/stack/squid/compare/v0.0.7...v0.0.8) (2020-08-28)
-
-
-### Bug Fixes
-
-* no need for cd to myCA ([8135c9c](https://sigyl.com///commit/8135c9c88c18e864d5b2084d79523dc116cd356d))
-* rename local_registry_password ([eb113d0](https://sigyl.com///commit/eb113d091d1c2ae1f35ad986d924f081d7f0e5cc))
-* rename local-registry-password to registry-password ([2e09f39](https://sigyl.com///commit/2e09f39cdc99314e90f2f78ce02ff5e094fb0bd5))
-* rm stack ([581abb7](https://sigyl.com///commit/581abb7746a33dbff8cf94668d8b49e8d89f1311))
-* wrong folder! ([8233fe2](https://sigyl.com///commit/8233fe28be8e25a36d0ffaa1bba54e3314729333))
-
-### [0.0.7](https://sigyl.com/git/stack/squid/compare/v0.0.6...v0.0.7) (2020-08-12)
-
-
-### Features
-
-* pre-commit hook to build jsonnet ([2377c54](https://sigyl.com///commit/2377c542e3a7f6e026239a1655d1c50c9d87e019))
-
-
-### Bug Fixes
-
-* change file mode ([c03054a](https://sigyl.com///commit/c03054a23c227305c7b1dfb943241c2b5ac16677))
-* git-hooks ([0d61cf5](https://sigyl.com///commit/0d61cf53ca9db5b10b9800f9af4628612cd4950f))
-
-### [0.0.6](https://sigyl.com/git/stack/squid/compare/v0.0.5...v0.0.6) (2020-08-12)
-
-
-### Bug Fixes
-
-* sigyl/squid-4 v 1.1.0 ([69b2292](https://sigyl.com///commit/69b229280c19fb536f2648aca325381cb26b22ad))
-* squid-4 ([55175d4](https://sigyl.com///commit/55175d4cb56dc218541ea1ceb295f09aba06359c))
-
-### [0.0.5](https://sigyl.com/git/stack/squid/compare/v0.0.4...v0.0.5) (2020-08-06)
-
-
-### Bug Fixes
-
-* added dhparam.pem ([bd1e63d](https://sigyl.com///commit/bd1e63d3c23fedb951c96b0ed378ab7489e0b033))
-
-### [0.0.4](https://sigyl.com/git/stack/squid/compare/v0.0.3...v0.0.4) (2020-08-05)
-
-### [0.0.3](https://sigyl.com/git/stack/squid/compare/v0.0.2...v0.0.3) (2020-08-05)
-
-### [0.0.2](https://sigyl.com/git/stack/squid/compare/v0.0.1...v0.0.2) here tis (2020-08-05)
-
 ### 0.0.1 (2020-08-05)
 
 

README.md

@@ -7,26 +7,9 @@ inspired by https://github.com/salrashid123/squid_proxy
 ## making a CA
 
 ```shell
+cd myCA
 openssl genrsa -out CA_key.pem 2048
-openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf    -subj "/C=UK/ST=Devon/L=Rose Ash/O=Google/OU=SiGyl/CN=Proxy-ca"
+openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf    -subj "/C=US/ST=California/L=Mountain View/O=Google/OU=Enterprise/CN=MyCA"
-```
-
-then set drone secrets ca-crt and ca-key to the created files
-
-## making dockerconfigjson
-
-the drone secret dockerconfigjson allows images to be pulled from the local docker repository
-
-if you login to this repository with:
-
-```shell
-docker login $LOCAL_DOCKER_REGISTRY --username client --password $REGISTRY_PASSWORD
-```
-
-then you will find the required content with:
-
-```shell
-cat ~/.docker/config.json
 ```
 
 ## releasing

docker-compose.yml

@@ -1,39 +1,23 @@
 version: "3.7"
 services:
-  squid-4:
+  squid:
     deploy:
       placement:
         constraints: [node.labels.com.sigyl.git-stack == yes]
       replicas: 1
       restart_policy:
         condition: any
-    image: sigyl/squid-4:1.1.0
+    image: ${SQUID_IMAGE}
-    environment:
-      - MITM_PROXY=yes
-      - HTTP_PORT=3128
-      - MITM_CERT=/run/secrets/ca.crt
-      - MITM_KEY=/run/secrets/ca.key
-      - VISIBLE_HOSTNAME=$LOCAL_DOMAIN
-      - >
-        EXTRA_CONFIG1=tls_outgoing_options
-        capath=/etc/ssl/certs
-        options=NO_SSLv3,NO_TLSv1 min-version=1.2
-      # - EXTRA_CONFIG2=sslproxy_cipher ECDHE+ECDSA+AESGCM:ECDHE+RSA+AESGCM:EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM #:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
-      # these are basically to make everything canched
-      - 'EXTRA_CONFIG2=refresh_pattern ^http:  999999999     1000000000%    999999999 override-expire'
-      - 'EXTRA_CONFIG3=refresh_pattern ^https:  999999999     1000000000%    999999999 override-expire'
-      - EXTRA_CONFIG4= acl no_cache_domains dstdomain auth.docker.io
-      - EXTRA_CONFIG5=cache deny no_cache_domains
     volumes:
-      - squid-4-cache:/var/cache/squid4
+      - squid-cache:/apps/squid/var/cache/squid
+      #- ./squid.intercept.conf:/etc/squid/squid.conf
+      - ./myCA/CA_crt.pem:/apps/CA_crt.pem
+      - ./myCA/CA_key.pem:/apps/CA_key.pem      
     ports:
       - 3128:3128
     networks:
       - appnet
       - externalnet
-    secrets:
-      - ca.crt
-      - ca.key
   squid-deb:
     deploy:
       placement:
@@ -41,7 +25,7 @@ services:
       replicas: 1
       restart_policy:
         condition: any
-    image: sigyl/squid-deb-proxy:1.0.0
+    image: mikepurvis/squid-deb-proxy:latest
     volumes:
       - squid-deb-cache:/cachedir
     ports:
@@ -50,7 +34,7 @@ services:
       - appnet
       - externalnet
 volumes:
-  squid-4-cache:
+  squid-cache:
   squid-deb-cache:
 
 networks:
@@ -59,9 +43,3 @@ networks:
   externalnet:
     driver: overlay
     external: true
-
-secrets:
-  'ca.crt':
-    file: .secrets/ca.crt
-  'ca.key':
-    file: .secrets/ca.key

docker-dind/Dockerfile

@@ -1,3 +0,0 @@
-FROM docker:18.06.0-dind
-COPY ./CA_crt.crt /usr/local/share/ca-certificates/CA_crt.crt
-RUN update-ca-certificates

docker/Dockerfile

@@ -0,0 +1,24 @@
+FROM debian:8
+RUN apt-get -y update
+RUN apt-get install -y curl supervisor git openssl  build-essential libssl-dev wget vim curl
+RUN mkdir -p /var/log/supervisor
+WORKDIR /apps/
+RUN wget -O - http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.27.tar.gz | tar zxfv - \
+    && CPU=$(( `nproc --all`-1 )) \
+    && cd /apps/squid-3.5.27/ \
+    && ./configure --prefix=/apps/squid --enable-icap-client --enable-ssl --with-openssl --enable-ssl-crtd --enable-auth --enable-basic-auth-helpers="NCSA" \
+    && make -j$CPU \
+    && make install \
+    && cd /apps \
+    && rm -rf /apps/squid-3.5.27
+ADD . /apps/
+
+RUN chown -R nobody:nogroup /apps/
+RUN mkdir -p  /apps/squid/var/lib/
+RUN /apps/squid/libexec/ssl_crtd -c -s /apps/squid/var/lib/ssl_db -M 4MB
+RUN /apps/squid/sbin/squid -N -f /apps/squid.cache.conf -z
+RUN chown -R nobody:nogroup /apps/
+
+EXPOSE 3128
+ENTRYPOINT ["/apps/squid/sbin/squid", "-NsY", "-f"]
+CMD ["/apps/squid.intercept.conf"]

docker/squid.cache.conf

@@ -0,0 +1,3 @@
+cache_dir aufs /apps/squid/var/cache/squid 10000 16 256
+
+coredump_dir /apps/squid/var/cache

docker/squid.intercept.conf

@@ -0,0 +1,70 @@
+always_direct allow all
+
+acl localhost src 127.0.0.1/32
+acl to_localhost dst 127.0.0.0/8
+acl localnet src 10.0.0.0/8	# RFC1918 possible internal network
+acl localnet src 172.16.0.0/12	# RFC1918 possible internal network
+acl localnet src 192.168.0.0/16	# RFC1918 possible internal network
+acl SSL_ports port 443
+acl Safe_ports port 80		# http
+acl Safe_ports port 21		# ftp
+acl Safe_ports port 443		# https
+acl Safe_ports port 70		# gopher
+acl Safe_ports port 210		# wais
+acl Safe_ports port 1025-65535	# unregistered ports
+acl Safe_ports port 280		# http-mgmt
+acl Safe_ports port 488		# gss-http
+acl Safe_ports port 591		# filemaker
+acl Safe_ports port 777		# multiling http
+acl CONNECT method CONNECT
+
+http_access allow all
+http_access allow manager localhost
+http_access deny manager
+
+htcp_access allow localnet
+htcp_access deny all
+
+
+visible_hostname git.local-domain
+
+http_port 3128 ssl-bump generate-host-certificates=on cert=/apps/CA_crt.pem key=/apps/CA_key.pem
+
+always_direct allow all
+acl excluded_sites ssl::server_name .wellsfargo.com
+ssl_bump splice excluded_sites
+ssl_bump bump all
+
+sslproxy_cert_error deny all
+sslcrtd_program /apps/squid/libexec/ssl_crtd -s /apps/squid/var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1
+
+icap_enable          on
+icap_preview_enable  on
+icap_preview_size    128
+icap_send_client_ip  on
+
+adaptation_access url_check  allow all
+
+access_log /apps/squid/var/logs/access.log squid
+
+# these are basically to make everything canched
+refresh_pattern ^http:  999999999     1000000000%    999999999 ignore-no-cache override-expire ignore-reload
+refresh_pattern ^https:  999999999     1000000000%    999999999 ignore-no-cache override-expire ignore-reload
+
+debug_options 11,2  22,10
+
+refresh_pattern ^ftp:		1440	20%	10080
+refresh_pattern ^gopher:	1440	0%	1440
+refresh_pattern (cgi-bin|\?)	0	0%	0
+refresh_pattern .		0	20%	4320
+
+icp_port 3130
+
+
+coredump_dir /apps/squid/var/cache
+
+
+cache_mem 1000 MB
+
+maximum_object_size 4096 MB
+cache_dir aufs /apps/squid/var/cache/squid 10000 16 256

git-hooks/pre-commit

@@ -1,3 +0,0 @@
-drone jsonnet --source .drone/drone-home.jsonnet --target .drone/drone-home.yml --stream \
-&& git add .drone/drone-home.yml \
-&& echo "jsonnet built"

package.json

@@ -1,12 +1,11 @@
 {
   "private": true,
-  "version": "0.0.8",
+  "version": "0.0.1",
   "scripts": {
     "release": "standard-version",
-    "release:message": "standard-version --releaseCommitMessageFormat",
     "jsonnet:home": "drone jsonnet --source .drone/drone-home.jsonnet --target .drone/drone-home.yml --stream"
   },
   "devDependencies": {
-    "standard-version": "https://github.com/gilesbradshaw/standard-version"
+    "standard-version": "^8.0.2"
   }
-}
+}

yarn.lock

@@ -1327,9 +1327,10 @@ split@^1.0.0:
   dependencies:
     through "2"
 
-"standard-version@https://github.com/gilesbradshaw/standard-version":
+standard-version@^8.0.2:
-  version "9.0.0"
+  version "8.0.2"
-  resolved "https://github.com/gilesbradshaw/standard-version#708c6e4385c16f772812eed72f07fc033c3e7200"
+  resolved "https://registry.yarnpkg.com/standard-version/-/standard-version-8.0.2.tgz#02ed7131f83046bd04358dc54f97d42c4b2fd828"
+  integrity sha512-L8X9KFq2SmVmaeZgUmWHFJMOsEWpjgFAwqic6yIIoveM1kdw1vH4Io03WWxUDjypjGqGU6qUtcJoR8UvOv5w3g==
   dependencies:
     chalk "^2.4.2"
     conventional-changelog "3.1.21"