Configuring Squid on Your CloudSOE Instance

This guide covers the configuration that ships on the CloudSOE Squid image on both AWS and Azure. It assumes you’ve finished one of the getting-started guides (AWS, Azure).

File locations

What the shipped config does

The image replaces the distribution’s squid.conf entirely. The important decisions:

• Who may connect — a localnet ACL covering RFC 1918 (10/8, 172.16/12, 192.168/16), carrier-grade NAT (100.64/10), link-local ranges and their IPv6 equivalents. Only these sources are allowed; everything else hits the final http_access deny all.
• Where they may go — the standard Safe_ports list (80, 443, 21, 1025-65535 and a few legacy ports); CONNECT is only allowed to port 443.
• Listening port — http_port 3128.
• Logging — a custom logformat squid_custom emitting one key=value line per request, plus apt-friendly refresh_pattern rules so Ubuntu/Debian package metadata is cached correctly.
• A nightly cron job runs /usr/sbin/squid -k rotate at midnight to rotate the logs.

The edit-validate-reload workflow

Always parse before you reload — a typo in squid.conf can take the proxy down:

sudo vi /etc/squid/squid.conf
sudo squid -k parse && sudo systemctl reload squid

reload re-reads the configuration without dropping established client connections; use sudo systemctl restart squid only when a directive requires it.

A note on rule order (and conf.d)

Squid evaluates http_access rules top-down and stops at the first match. In the shipped config, the include /etc/squid/conf.d/*.conf line sits after http_access allow localnet — so drop-in files cannot restrict what internal clients reach (the allow has already matched). To tighten access for localnet clients, add your rules in /etc/squid/squid.conf above the http_access allow localnet line.

Restricting destinations

To allow only a list of domains, add above http_access allow localnet:

acl allowed_sites dstdomain .ubuntu.com .example.com
http_access deny localnet !allowed_sites

Adding basic authentication

sudo apt install apache2-utils
sudo htpasswd -c /etc/squid/passwords proxyuser

Then in /etc/squid/squid.conf (auth_param lines near the top, the allow rule above http_access allow localnet):

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access deny !authenticated

Validate and reload as above. The user= field in the access log will now record the authenticated username.

Enabling a disk cache

The shipped config has no cache_dir, so Squid caches in memory only. For a persistent disk cache (here 10 GB under /var/spool/squid):

echo 'cache_dir ufs /var/spool/squid 10000 16 256' | sudo tee -a /etc/squid/squid.conf
sudo squid -k parse
sudo systemctl stop squid
sudo squid -z          # build the cache directory structure
sudo systemctl start squid

Size the instance’s disk accordingly, and see tips & tricks for cache_mem and object-size tuning.

Next steps

• Tips & tricks — reading the log format, cache tuning, monitoring with squidclient