theforeman/smart-proxy — pull request #31 by doherty (2012-08-22 16:39:16+00:00)
Title: Allow a Squid proxy to be managed by the Smart Proxy

When you are provisioning hosts that cannot reach the
Foreman server due to the network's design, you may
want to have a Squid proxy running on the subnet to
provide access. This permits such a proxy to be
managed with the Smart Proxy.

Currently, "managed" means adding and removing files
which control access to the proxy for a single host:

acl foreman_clients src host_that_cant_reach_foreman

This permits the host to use the Squid proxy to reach
Foreman, for example when notifying the server that the
build has completed.

Set "squid: true" and "squid_conf_dir" to the configuration
directory for your proxy (typically, /etc/squid or
/etc/squid3) to enable Squid management. Inside this
directory, you must create a directory called "foreman.d"
which will store the files that the Smart Proxy manages.
Include the directory with "include /etc/squid/foreman.d/*.conf"
and provide a url_regex ACL called "foreman_url" - this is the
resource that the Squid proxy will permit access to for the
ACL entries that the Smart Proxy manages.

An example configuration follows:

# hostname type proxy port icp port options
cache_peer foreman.localdomain parent 80 0 no-query

http_port 80

acl Safe_ports port 80 21 443 563 70 210 1025-65535
http_access deny !Safe_ports

acl SSL_ports port 443
acl CONNECT method CONNECT
http_access deny CONNECT !SSL_ports

acl foreman_url url_regex ^http://foreman.localdomain/unattended/
include /etc/squid3/foreman.d/*.conf

# Permit access only to known safe ports
http_access deny !safe_ports
http_access allow foreman_clients foreman_url

# Must be the last rule
http_access deny all

The user the Smart Proxy runs as must be able to use sudo
to run the squid binary as root without a password.

Caveats:
- There is no test suite for this feature yet

Resolves http://theforeman.org/issues/969