إعداد خادم البروكسي: دليل Squid و HAProxy

# Ubuntu/Debian
sudo apt update
sudo apt install squid -y

# CentOS/RHEL
sudo dnf install squid -y

# حالة الخدمة
sudo systemctl enable --now squid
sudo systemctl status squid

# docker-compose.yml
version: '3.8'
services:
  squid:
    image: ubuntu/squid:latest
    container_name: squid-proxy
    restart: unless-stopped
    ports:
      - "3128:3128"
    volumes:
      - ./squid.conf:/etc/squid/squid.conf
      - squid_cache:/var/spool/squid
      - squid_logs:/var/log/squid

volumes:
  squid_cache:
  squid_logs:

# /etc/squid/squid.conf

# تعريفات الشبكة
acl localnet src 10.0.0.0/8
acl localnet src 172.16.0.0/12
acl localnet src 192.168.0.0/16

# تعريفات المنافذ
acl SSL_ports port 443
acl Safe_ports port 80
acl Safe_ports port 443
acl Safe_ports port 21
acl Safe_ports port 1025-65535
acl CONNECT method CONNECT

# قواعد الوصول
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localnet
http_access allow localhost
http_access deny all

# منفذ البروكسي
http_port 3128

# إعدادات التخزين المؤقت
cache_mem 256 MB
maximum_object_size_in_memory 512 KB
cache_dir ufs /var/spool/squid 10000 16 256
maximum_object_size 100 MB

# إعدادات السجلات
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log

# الخصوصية
forwarded_for off
request_header_access Via deny all
request_header_access X-Forwarded-For deny all

# حظر مواقع محددة
acl blocked_sites dstdomain .facebook.com .twitter.com .instagram.com
http_access deny blocked_sites

# حظر أنواع ملفات محددة
acl blocked_extensions urlpath_regex -i \.(mp3|mp4|avi|mkv)$
http_access deny blocked_extensions

# تقييد الوصول خارج ساعات العمل
acl work_hours time MTWHF 08:00-18:00
acl social_media dstdomain .youtube.com .reddit.com
http_access deny social_media !work_hours

sudo apt install apache2-utils -y
sudo htpasswd -c /etc/squid/passwords user1

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm مصادقة البروكسي
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny all

sudo apt update
sudo apt install haproxy -y
haproxy -v
sudo systemctl enable --now haproxy

version: '3.8'
services:
  haproxy:
    image: haproxy:latest
    container_name: haproxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8404:8404"
    volumes:
      - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
      - ./certs:/etc/haproxy/certs:ro

# /etc/haproxy/haproxy.cfg

global
    log /dev/log local0
    chroot /var/lib/haproxy
    user haproxy
    group haproxy
    daemon
    ssl-default-bind-options ssl-min-ver TLSv1.2

defaults
    log     global
    mode    http
    option  httplog
    option  forwardfor
    timeout connect 5000
    timeout client  50000
    timeout server  50000

listen stats
    bind *:8404
    stats enable
    stats uri /stats
    stats refresh 10s
    stats auth admin:كلمة_مرور_قوية123

frontend http_front
    bind *:80
    redirect scheme https code 301 if !{ ssl_fc }

frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    
    acl is_api path_beg /api
    use_backend api_servers if is_api
    default_backend web_servers

backend web_servers
    balance roundrobin
    option httpchk GET /health
    http-check expect status 200
    cookie SERVERID insert indirect nocache
    
    server web1 192.168.1.10:8080 check cookie web1
    server web2 192.168.1.11:8080 check cookie web2

backend api_servers
    balance leastconn
    server api1 192.168.1.20:3000 check
    server api2 192.168.1.21:3000 check

sudo cat /etc/letsencrypt/live/example.com/fullchain.pem \
     /etc/letsencrypt/live/example.com/privkey.pem \
     > /etc/haproxy/certs/example.com.pem

frontend https_front
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem
    
    stick-table type ip size 100k expire 30s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 200 }

sudo apt install keepalived -y

vrrp_script check_haproxy {
    script "/usr/bin/killall -0 haproxy"
    interval 2
    weight 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 101
    virtual_ipaddress {
        192.168.1.100/24
    }
    track_script {
        check_haproxy
    }
}

squid -k parse
haproxy -c -f /etc/haproxy/haproxy.cfg
curl -x http://proxy-ip:3128 http://example.com