Docker 部署Squid 代理缓存

启动容器

version: "3.8"
services:
  squid:
    image: sameersbn/squid:3.5.27-2
    container_name: squid
    restart: always
    ports:
      - "3128:3128"
    volumes:
      - /home/dockerapp/squid/squid.conf:/etc/squid/squid.conf
      - /home/dockerapp/squid/cache:/var/spool/squid
      - /home/dockerapp/squid/logs:/var/log/squid/

配置文件

acl SSL_ports port 443
acl Safe_ports port 80    # http
acl Safe_ports port 21    # ftp
acl Safe_ports port 443   # https
acl Safe_ports port 70    # gopher
acl Safe_ports port 210   # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280   # http-mgmt
acl Safe_ports port 488   # gss-http
acl Safe_ports port 591   # filemaker
acl Safe_ports port 777   # multiling http
acl CONNECT method CONNECT
dns_v4_first on
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow all
# http_port 3128
http_port 0.0.0.0:3128
refresh_pattern ^ftp:   1440  20% 10080
refresh_pattern ^gopher:  1440  0%  1440
refresh_pattern -i (/cgi-bin/|\?) 0 0%  0
refresh_pattern (Release|Packages(.gz)*)$      0       20%     2880
refresh_pattern .   0 20% 4320
coredump_dir /var/spool/squid
cache_dir aufs /var/spool/squid 4096 21 512
cache_mem 640 MB
maximum_object_size 40 MB
maximum_object_size_in_memory 2560 KB
ipcache_size 2048
# reply_body_max_size 10240000 allow all
access_log /var/log/squid/access.log  squid

终端下代理

export http_proxy=http://192.168.21.2:3128 && export https_proxy=http://192.168.21.2:3128

用户认证

创建密码文件

htpasswd -c /home/dockerapp/squid/passwd username

或使用 OpenSSL 生成 APR1 哈希后写入 /home/dockerapp/squid/passwd：

openssl passwd -apr1
echo "username:生成的哈希" >> /home/dockerapp/squid/passwd

挂载密码文件并启用认证

在 docker-compose.yml 中增加密码文件只读挂载：

version: "3.8"
services:
  squid:
    image: sameersbn/squid:3.5.27-2
    container_name: squid
    restart: always
    ports:
      - "3128:3128"
    volumes:
      - /home/dockerapp/squid/squid.conf:/etc/squid/squid.conf
      - /home/dockerapp/squid/cache:/var/spool/squid
      - /home/dockerapp/squid/logs:/var/log/squid/
      - /home/dockerapp/squid/passwd:/etc/squid/passwd:ro

在 squid.conf 中添加认证相关配置（路径可能因发行版不同而为 /usr/lib/squid/basic_ncsa_auth 或 /usr/lib64/squid/basic_ncsa_auth）：

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
auth_param basic realm Squid Proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
http_access deny all

客户端使用（携带凭据）

export http_proxy=http://username:password@192.168.21.2:3128
export https_proxy=http://username:password@192.168.21.2:3128

或使用 curl：

curl -x http://192.168.21.2:3128 -U username:password https://example.com

提高squid缓存的命中率

安装运行squid后用命令

squidclient -t 1 -h localhost -p 80 mgr:info 查看命中率情况
Request Hit Ratios:     5min: 99.6%, 60min: 98.7%    Cache Request命中率
Byte Hit Ratios:        5min: 100.0%, 60min: 100.0%    Cache Byte命中率

如果命中率低 则调整squid中的参数

# cache_mem 8 MB
cache_mem 64 MB

# maximum_object_size 4096 KB
maximum_object_size 16384 KB

# maximum_object_size_in_memory 8 KB
maximum_object_size_in_memory 256 KB

# ipcache_size 1024
ipcache_size 2048

#Default:
cache_dir ufs /usr/local/squid/cache 2048 32 512

参考引用

提高squid缓存的命中率_request hits ratios-CSDN博客

基于Docker版本squid搭建代理服务器 - jiftle - 博客园