+ - name: make the app be real

+   # hosts: os_control_stg[0]:os_control[0]

+   hosts: os_control_stg[0]

+   user: root

+   gather_facts: False

+ 

+   vars_files:

+     - /srv/web/infra/ansible/vars/global.yml

+     - /srv/private/ansible/vars.yml

+     - /srv/web/infra/ansible/vars/{{ ansible_distribution }}.yml

+ 

+   vars:

+ 

+   roles:

+     - role: openshift/project

+       app: flatpak-cache

+       description: "Flatpak Cache"

+       appowners:

+         - leo

+         - kevin

+         - adamwill

+       tags:

+         - apply-appowners

+ 

+     - role: openshift/object

+       app: flatpak-cache

+       file: imagestream.yml

+       objectname: imagestream.yml

+ 

+     - role: openshift/object

+       app: flatpak-cache

+       template: buildconfig.yml

+       objectname: buildconfig.yml

+ 

+     - role: openshift/object

+       app: flatpak-cache

+       file: storage.yml

+       objectname: storage.yml

+ 

+     - role: openshift/secret-file

+       app: flatpak-cache

+       secret_name: flatpak-cache-ca

+       key: ca.crt

+       privatefile: "flatpak-cache-certs/{{env}}/pki/ca.crt"

+ 

+     - role: openshift/secret-file

+       app: flatpak-cache

+       secret_name: flatpak-cache-key

+       key: ca.key

+       privatefile: "flatpak-cache-certs/{{env}}/pki/ca.key"

+ 

+     - role: openshift/secret-file

+       app: flatpak-cache

+       secret_name: flatpak-cache-dhparam

+       key: dh.pem

+       privatefile: "flatpak-cache-certs/{{env}}/pki/dh.pem"

+ 

+     - role: openshift/object

+       app: flatpak-cache

+       template: configmap.yml

+       objectname: configmap.yml

+ 

+     - role: openshift/object

+       app: flatpak-cache

+       file: service.yml

+       objectname: service.yml

+ 

+     # Routes

+     - role: openshift/route

+       app: flatpak-cache

+       routename: web

+       host: "flatpak-cache.apps.ocp{{ env_suffix }}.fedoraproject.org"

+       servicename: web

+       serviceport: web

+       annotations:

+         haproxy.router.openshift.io/timeout: 5m

+ 

+     - role: openshift/object

+       app: flatpak-cache

+       template: deployment.yml

+       objectname: deployment.yml

+ apiVersion: image.openshift.io/v1

+ items:

+ - apiVersion: image.openshift.io/v1

+   kind: ImageStream

+   metadata:

+     name: flatpak-cache

+     labels:

+       build: flatpak-cache

+ kind: List

+ metadata: {}

+ apiVersion: v1

+ kind: Service

+ metadata:

+   name: flatpak-cache

+   labels:

+     app: flatpak-cache

+     service: flatpak-cache

+   namespace: flatpak-cache

+ spec:

+   ports:

+     - name: web

+       port: 80

+       targetPort: 3128

+   selector:

+     deploymentconfig: flatpak-cache

+ apiVersion: v1

+ kind: PersistentVolumeClaim

+ metadata:

+   name: data

+ spec:

+   accessModes:

+     - ReadWriteMany

+   resources:

+     requests:

+       storage: 20Gi

+   storageClassName: ocs-storagecluster-cephfs

+ ---

+ apiVersion: build.openshift.io/v1

+ items:

+ - apiVersion: build.openshift.io/v1

+   kind: BuildConfig

+   metadata:

+     labels:

+       build: flatpak-cache-build

+     name: flatpak-cache-build

+   spec:

+     runPolicy: Serial

+     source:

+       dockerfile: |-

+         FROM fedora:39

+         LABEL \

+           name="flatpak-cache" \

+           vendor="Fedora Infrastructure" \

+           license="MIT"

+         RUN dnf install -y \

+                 gettext \

+                 hostname \

+                 nss_wrapper \

+                 bind-utils \

+                 squid && \

+             dnf autoremove -y && \

+             dnf clean all -y

+             RUN mkdir -p /var/spool/squid

+         EXPOSE 80

+       type: Dockerfile

+     strategy:

+       type: Docker

+       dockerStrategy:

+         noCache: true

+     output:

+       to:

+         kind: ImageStreamTag

+         name: flatpak-cache:latest

+     triggers:

+     - type: ImageChange

+     - type: ConfigChange

+ kind: List

+ metadata: {}

+ {% macro load_file(filename) %}{% include filename %}{%- endmacro -%}

+ ---

+ apiVersion: v1

+ kind: List

+ metadata: {}

+ items:

+ - apiVersion: v1

+   kind: ConfigMap

+   metadata:

+     name: flatpak-cache-configmap

+     labels:

+       app: flatpak-cache

+   data:

+     flatpak-cache.vcl: |-

+       {{ load_file('squid.conf') | indent(6) }}

+     start.sh: |-

+       {{ load_file('start.sh') | indent(6) }}

+ - apiVersion: apps/v1

+   kind: Deployment

+   metadata:

+     labels:

+       app: flatpak-cache

+       app.kubernetes.io/component: flatpak-cache

+       app.kubernetes.io/instance: flatpak-cache

+       app.kubernetes.io/name: flatpak-cache

+       app.kubernetes.io/part-of: flatpak-cache-app

+     name: flatpak-cache

+   spec:

+     progressDeadlineSeconds: 600

+     replicas: 1

+     revisionHistoryLimit: 10

+     selector:

+       matchLabels:

+         app: flatpak-cache

+     strategy:

+       type: Recreate

+     template:

+       metadata:

+         creationTimestamp: null

+         labels:

+           app: flatpak-cache

+           deployment: flatpak-cache

+       spec:

+         containers:

+         - env:

+           volumeMounts:

+           - name: config-volume

+             mountPath: /etc/squid

+             readOnly: true

+           - name: data

+             mountPath: /srv

+           - name: flatpak-cache-ca-volume

+             mountPath: /etc/pki/squid/ca

+             readOnly: true

+           - name: flatpak-cache-key-volume

+             mountPath: /etc/pki/squid/key

+             readOnly: true

+           - name: flatpak-cache-dhparam

+             mountPath: /etc/pki/squid/dhparam

+             readOnly: true

+           imagePullPolicy: Always

+           name: flatpak-cache

+           command:

+             - bash

+           args:

+             - /etc/squid/start.sh

+           resources: {}

+           terminationMessagePath: /dev/termination-log

+           terminationMessagePolicy: File

+         dnsPolicy: ClusterFirst

+         restartPolicy: Always

+         schedulerName: default-scheduler

+         securityContext: {}

+         terminationGracePeriodSeconds: 30

+         volumes:

+         - name: config-volume

+           configMap:

+             name: flatpak-cache-configmap

+         - name: data

+           persistentVolumeClaim:

+             claimName: data

+         - name: flatpak-cache-ca-volume

+           secret:

+             secretName: flatpak-cache-ca

+         - name: flatpak-cache-key-volume

+           secret:

+             secretName: flatpak-cache-key

+         - name: flatpak-cache-dhparam-volume

+           secret:

+             secretName: flatpak-cache-dhparam

+ acl openqa src 10.3.174.21-10.3.174.64

+ 

+ acl SSL_ports port 443

+ acl Safe_ports port 80 443

+ acl CONNECT method CONNECT

+ 

+ acl intermediate_fetching transaction_initiator certificate-fetching

+ http_access allow intermediate_fetching

+ 

+ # Deny requests to certain unsafe ports

+ http_access deny !Safe_ports

+ 

+ # Deny CONNECT to other than secure SSL ports

+ http_access deny CONNECT !SSL_ports

+ 

+ # Only allow cachemgr access from openqa

+ http_access allow openqa

+ 

+ # Only cache flathub

+ acl cacheDomain dstdomain dl.flathub.org

+ cache deny !cacheDomain

+ 

+ # And finally deny all other access to this proxy

+ http_access deny all

+ 

+ 

+ http_port 3128 tcpkeepalive=60,30,3 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=20MB tls-cert=/etc/pki/squid/ca/ca.crt tls-key=/etc/pki/squid/key/ca.key cipher=HIGH:MEDIUM:!LOW:!RC4:!SEED:!IDEA:!3DES:!MD5:!EXP:!PSK:!DSS options=NO_TLSv1,NO_SSLv3,SINGLE_DH_USE,SINGLE_ECDH_USE tls-dh=prime256v1:/etc/pki/squid/dhparam/dh.pem

+ 

+ sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 20MB

+ sslcrtd_children 5

+ ssl_bump server-first all

+ ssl_bump stare all

+ sslproxy_cert_error deny all

+ 

+ # Uncomment and adjust the following to add a disk cache directory.

+ maximum_object_size 6 GB

+ cache_dir ufs /srv/squid 20000 16 256

+ 

+ # Leave coredumps in the first cache dir

+ coredump_dir /var/spool/squid

+ 

+ #

+ # Add any of your own refresh_pattern entries above these.

+ #

+ refresh_pattern -i dl.flathub.org\/.*   1440    20%     10080 override-expire ignore-no-cache ignore-no-store ignore-private

+ refresh_pattern .  0 20% 4320

+ 

+ 

+ # <Client IP> <Username> [<Local Time>] "<Request Method> <Request URL> HTTP/<Protocol Version> <Response Status Code> \

+ # <Sent reply size (with hdrs)> <Referer> <User Agent> <Squid Request Status>:<Squid Hierarchy Status>

+ logformat combined %>a %un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh

+ access_log /var/log/squid/squid.log squid

+ access_log /var/log/squid/access.log combined 

+ exec squid 

+   --foreground 

+   -f /etc/squid/squid.conf